cosigned: Unify cue data and policy before evaluating it #1793
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## main #1793 +/- ##
==========================================
- Coverage 32.70% 32.70% -0.01%
==========================================
Files 147 147
Lines 9300 9313 +13
==========================================
+ Hits 3042 3046 +4
- Misses 5903 5909 +6
- Partials 355 358 +3
Continue to review full report at Codecov.
|
hectorj2f
force-pushed
the
unify_cue_data_and_policy
branch
2 times, most recently
from
f80b402
to
7625488
Compare
|
Can we try removing this and test if it now passes? 🤩 |
hectorj2f
force-pushed
the
unify_cue_data_and_policy
branch
from
7625488
to
13fd665
Compare
vaikas
reviewed
Apr 23, 2022
test/testdata/cosigned/e2e/cip-requires-two-signatures-and-two-attestations.yaml
Show resolved
Hide resolved
hectorj2f
force-pushed
the
unify_cue_data_and_policy
branch
from
13fd665
to
c4796ec
Compare
hectorj2f
changed the title
hectorj2f
force-pushed
the
unify_cue_data_and_policy
branch
4 times, most recently
from
e027cff
to
7a87d68
Compare
added 8 commits
April 26, 2022 01:21
Signed-off-by: hectorj2f <hectorf@vmware.com>
Signed-off-by: hectorj2f <hectorf@vmware.com>
Signed-off-by: hectorj2f <hectorf@vmware.com>
Signed-off-by: hectorj2f <hectorf@vmware.com>
Signed-off-by: hectorj2f <hectorf@vmware.com>
Signed-off-by: hectorj2f <hectorf@vmware.com>
Signed-off-by: hectorj2f <hectorf@vmware.com>
Signed-off-by: hectorj2f <hectorf@vmware.com>
hectorj2f
force-pushed
the
unify_cue_data_and_policy
branch
from
7a87d68
to
2923f3d
Compare
vaikas
reviewed
Apr 26, 2022
mlieberman85
pushed a commit
to mlieberman85/cosign
that referenced
this pull request
May 6, 2022
* chore: update cue policy evaluation Signed-off-by: hectorj2f <hectorf@vmware.com> * chore: change cue policy for the cip Signed-off-by: hectorj2f <hectorf@vmware.com> * chore: avoid using names with hyphens Signed-off-by: hectorj2f <hectorf@vmware.com> * test: add unit tests for the eval policy func Signed-off-by: hectorj2f <hectorf@vmware.com> * test: delete job before creating it Signed-off-by: hectorj2f <hectorf@vmware.com> * test: add statement to check the length of a struct Signed-off-by: hectorj2f <hectorf@vmware.com> * test: add more unit tests for eval policy Signed-off-by: hectorj2f <hectorf@vmware.com> * fix: wrong redirected file directory Signed-off-by: hectorj2f <hectorf@vmware.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds code to compile both the policy and attestations data, then unify both cue files and finally validate them. The recommendation is to avoid using cuejson.Validate which expects the cue to be self-contained and applied as a schema to the JSON.
Ticket Link
Fixes
Release Note