Skip to content

Use ValidateVSAAndComparePolicy for ec validate image VSA skip #3489

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
st3penta merged 1 commit into from
Aug 19, 2026
Merged

Use ValidateVSAAndComparePolicy for ec validate image VSA skip #3489

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions cmd/validate/image.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,6 +296,11 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
}
Comment thread
st3penta marked this conversation as resolved.
}

Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
// Require --vsa-public-key when the VSA skip path is active
Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
if len(data.vsaUpload) > 0 && data.vsaPublicKey == "" && data.vsaExpiration > 0 {
allErrors = errors.Join(allErrors, fmt.Errorf("--vsa-public-key required when --vsa-upload is set with --vsa-expiration > 0"))
}

return
},

Expand Down Expand Up @@ -367,9 +372,20 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
var out *output.Output
var err error
if data.vsaExpiration > 0 {
vsaChecker := vsa.CreateVSACheckerFromUploadFlags(data.vsaUpload)
if vsaChecker != nil {
out, err = image.ValidateImageWithVSACheck(ctx, comp, data.spec, data.policy, evaluators, data.info, vsaChecker, data.vsaExpiration)
retriever := vsa.CreateRetrieverFromUploadFlags(data.vsaUpload)
Comment thread
st3penta marked this conversation as resolved.
if retriever != nil {
vsaEffectiveTime := data.effectiveTime
if vsaEffectiveTime == "attestation" {
Comment thread
st3penta marked this conversation as resolved.
vsaEffectiveTime = policy.Now
}
vsaConfig := &vsa.VSAValidationConfig{
Retriever: retriever,
VSAExpiration: data.vsaExpiration,
PublicKeyPath: data.vsaPublicKey,
PolicySpec: data.policy.Spec(),
EffectiveTime: vsaEffectiveTime,
}
out, err = image.ValidateImageWithVSACheck(ctx, comp, data.spec, data.policy, evaluators, data.info, vsaConfig)
} else {
// Fall back to normal validation if no VSA retriever is available
out, err = validate(ctx, comp, data.spec, data.policy, evaluators, data.info)
Expand Down Expand Up @@ -583,6 +599,7 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
cmd.Flags().BoolVar(&data.vsaEnabled, "vsa", false, "Generate a Verification Summary Attestation (VSA) for each validated image.")
Comment thread
st3penta marked this conversation as resolved.
cmd.Flags().StringVar(&data.attestationFormat, "attestation-format", "dsse", "Attestation output format: dsse (signed envelope), predicate (raw JSON)")
cmd.Flags().StringVar(&data.vsaSigningKey, "vsa-signing-key", "", "Path to the private key for signing the VSA. Supports file paths and Kubernetes secret references (k8s://namespace/secret-name/key-field).")
Comment thread
st3penta marked this conversation as resolved.
Comment thread
st3penta marked this conversation as resolved.
cmd.Flags().StringVar(&data.vsaPublicKey, "vsa-public-key", "", "Path to the public key for VSA signature verification. Required when --vsa-upload is set and --vsa-expiration is greater than 0.")
cmd.Flags().StringSliceVar(&data.vsaUpload, "vsa-upload", nil, "Storage backends for VSA upload. Format: backend@url?param=value. Examples: rekor@https://rekor.sigstore.dev, local@./vsa-dir")
cmd.Flags().DurationVar(&data.vsaExpiration, "vsa-expiration", data.vsaExpiration, "Expiration threshold for existing VSAs. If a valid VSA exists and is newer than this threshold, validation will be skipped. (default 168h)")
cmd.Flags().StringVar(&data.attestationOutputDir, "attestation-output-dir", "", "Directory for attestation output files. Defaults to a temp directory under /tmp. Must be under /tmp or the current working directory.")
Expand Down Expand Up @@ -667,6 +684,7 @@ type imageData struct {
vsaEnabled bool
Comment thread
st3penta marked this conversation as resolved.
attestationFormat string
vsaSigningKey string
Comment thread
st3penta marked this conversation as resolved.
vsaPublicKey string
vsaUpload []string
vsaExpiration time.Duration
attestationOutputDir string
Expand Down
45 changes: 45 additions & 0 deletions cmd/validate/image_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1471,6 +1471,7 @@ func TestValidateImageCommand_VSAUpload_Success(t *testing.T) {
"--vsa",
"--vsa-signing-key", "/tmp/vsa-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1543,6 +1544,39 @@ func TestValidateImageCommand_VSAUpload_NoStorageBackends(t *testing.T) {
// Don't assert no error since VSA processing might fail, but upload logic should be reached
}

func TestValidateImageCommand_VSAPublicKeyRequired(t *testing.T) {
// --vsa-public-key is required when --vsa-upload is set
validateImageCmd := validateImageCmd(happyValidator())
cmd := setUpCobra(validateImageCmd)
Comment thread
qodo-for-conforma[bot] marked this conversation as resolved.

fs := afero.NewMemMapFs()
ctx := utils.WithFS(context.Background(), fs)

client := fake.FakeClient{}
commonMockClient(&client)
ctx = oci.WithClient(ctx, &client)
cmd.SetContext(ctx)

cmd.SetArgs([]string{
"validate", "image",
"--image", "registry/image:tag",
"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
"--vsa-upload", "local@/tmp/vsa-test",
// Missing --vsa-public-key
})

var out bytes.Buffer
cmd.SetOut(&out)
cmd.SilenceErrors = true
cmd.SilenceUsage = true

utils.SetTestRekorPublicKey(t)

err := cmd.Execute()
assert.Error(t, err)
assert.Contains(t, err.Error(), "--vsa-public-key required when --vsa-upload is set with --vsa-expiration > 0")
}

func TestValidateImageCommand_ShowWarningsFlag(t *testing.T) {
// Create a validator that returns warnings
warningValidator := func(_ context.Context, component app.SnapshotComponent, _ *app.SnapshotSpec, _ policy.Policy, _ []evaluator.Evaluator, _ bool) (*output.Output, error) {
Expand Down Expand Up @@ -1676,6 +1710,7 @@ func TestValidateImageCommand_VSAFormat_DSSE(t *testing.T) {
"--attestation-format", "dsse",
"--vsa-signing-key", "/tmp/vsa-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1712,6 +1747,7 @@ func TestValidateImageCommand_VSAFormat_Predicate(t *testing.T) {
"--vsa",
"--attestation-format", "predicate",
"--vsa-upload", "local@/tmp/vsa-predicates",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1747,6 +1783,7 @@ func TestValidateImageCommand_VSAFormat_InvalidFormat(t *testing.T) {
"--attestation-format", "invalid-format",
"--vsa-signing-key", "/tmp/vsa-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1784,6 +1821,7 @@ func TestValidateImageCommand_VSAFormat_DSSE_RequiresSigningKey(t *testing.T) {
"--attestation-format", "dsse",
// Missing --vsa-signing-key
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1822,6 +1860,7 @@ func TestValidateImageCommand_VSAFormat_Predicate_WorksWithoutSigningKey(t *test
"--attestation-format", "predicate",
// No --vsa-signing-key provided
"--vsa-upload", "local@/tmp/vsa-predicates",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1940,6 +1979,7 @@ func TestGenerateVSAsDSSE_Errors(t *testing.T) {
"--attestation-format", "dsse",
"--vsa-signing-key", "/tmp/invalid-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -1974,6 +2014,7 @@ func TestGenerateVSAsDSSE_Errors(t *testing.T) {
"--attestation-format", "dsse",
"--vsa-signing-key", "/tmp/nonexistent-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -2025,6 +2066,7 @@ func TestGenerateVSAsDSSE_Errors(t *testing.T) {
"--attestation-format", "dsse",
"--vsa-signing-key", "/tmp/vsa-key.pem",
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -2060,6 +2102,7 @@ func TestGenerateVSAsPredicates_Errors(t *testing.T) {
"--attestation-format", "predicate",
"--attestation-output-dir", "/etc/invalid-dir", // Invalid directory outside /tmp and cwd
"--vsa-upload", "local@/tmp/vsa-predicates",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -2096,6 +2139,7 @@ func TestGenerateVSAsPredicates_Errors(t *testing.T) {
"--attestation-format", "predicate",
"--attestation-output-dir", "/tmp/vsa-predicates",
"--vsa-upload", "local@/tmp/vsa-predicates",
"--vsa-public-key", "/tmp/vsa-pub.pem",
})

var out bytes.Buffer
Expand Down Expand Up @@ -2175,6 +2219,7 @@ func TestVSAGeneration_WithOutputDir(t *testing.T) {
"--attestation-format", tt.format,
"--attestation-output-dir", tt.outputDir,
"--vsa-upload", "local@/tmp/vsa-test",
"--vsa-public-key", "/tmp/vsa-pub.pem",
}

if tt.needsKey {
Expand Down
1 change: 1 addition & 0 deletions docs/modules/ROOT/pages/ec_validate_image.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,7 @@ JSON of the "spec" or a reference to a Kubernetes object [<namespace>/]<name>
-s, --strict:: Return non-zero status on non-successful validation. Defaults to true. Use --strict=false to return a zero status code. (Default: true)
--vsa:: Generate a Verification Summary Attestation (VSA) for each validated image. (Default: false)
--vsa-expiration:: Expiration threshold for existing VSAs. If a valid VSA exists and is newer than this threshold, validation will be skipped. (default 168h) (Default: 168h0m0s)
--vsa-public-key:: Path to the public key for VSA signature verification. Required when --vsa-upload is set and --vsa-expiration is greater than 0.
--vsa-signing-key:: Path to the private key for signing the VSA. Supports file paths and Kubernetes secret references (k8s://namespace/secret-name/key-field).
--vsa-upload:: Storage backends for VSA upload. Format: backend@url?param=value. Examples: rekor@https://rekor.sigstore.dev, local@./vsa-dir (Default: [])
--workers:: Number of workers to use for validation. Defaults to 5. (Default: 5)
Expand Down
2 changes: 1 addition & 1 deletion features/__snapshots__/vsa.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@
---

[TestFeatures/VSA expiration flag functionality:stderr - 1]
time="${TIMESTAMP}" level=warning msg="Failed to check for existing VSA for image ${REGISTRY}/acceptance/vsa-expiration-image@sha256:${REGISTRY_acceptance/vsa-expiration-image:latest_DIGEST}: failed to retrieve VSA envelope: no entries found in Rekor for image digest: sha256:${REGISTRY_acceptance/vsa-expiration-image:latest_DIGEST}"
time="${TIMESTAMP}" level=warning msg="Failed to validate existing VSA for image ${REGISTRY}/acceptance/vsa-expiration-image@sha256:${REGISTRY_acceptance/vsa-expiration-image:latest_DIGEST}: failed to check existing VSA: failed to retrieve VSA envelope: no entries found in Rekor for image digest: sha256:${REGISTRY_acceptance/vsa-expiration-image:latest_DIGEST}"
Comment thread
st3penta marked this conversation as resolved.

---

Expand Down
37 changes: 30 additions & 7 deletions features/vsa.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ Feature: VSA generation and storage
]
}
"""
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-test-image --policy acceptance/vsa-ec-policy --public-key ${vsa-test_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-test_PRIVATE_KEY} --vsa-upload local@${TMPDIR}/vsa-output --vsa-expiration 0 --output json"
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-test-image --policy acceptance/vsa-ec-policy --public-key ${vsa-test_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-test_PRIVATE_KEY} --vsa-upload local@${TMPDIR}/vsa-output --vsa-public-key ${vsa-test_PUBLIC_KEY} --vsa-expiration 0 --output json"
Then the exit status should be 0
Then the output should match the snapshot
And VSA envelope files should exist in "${TMPDIR}/vsa-output"
Expand All @@ -52,7 +52,7 @@ Feature: VSA generation and storage
}
"""
Given VSA upload to Rekor should be expected
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-rekor-image --policy acceptance/vsa-rekor-ec-policy --public-key ${vsa-rekor_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-rekor_PRIVATE_KEY} --vsa-upload rekor@${REKOR} --vsa-expiration 0 --output json"
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-rekor-image --policy acceptance/vsa-rekor-ec-policy --public-key ${vsa-rekor_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-rekor_PRIVATE_KEY} --vsa-upload rekor@${REKOR} --vsa-public-key ${vsa-rekor_PUBLIC_KEY} --vsa-expiration 0 --output json"
Then the exit status should be 0
Then the output should match the snapshot
And VSA should be uploaded to Rekor successfully
Expand All @@ -77,7 +77,7 @@ Feature: VSA generation and storage
}
"""
Given VSA upload to Rekor should be expected
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-multi-image --policy acceptance/vsa-multi-ec-policy --public-key ${vsa-multi_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-multi_PRIVATE_KEY} --vsa-upload local@${TMPDIR}/vsa-multi-output --vsa-upload rekor@${REKOR} --vsa-expiration 0 --output json"
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-multi-image --policy acceptance/vsa-multi-ec-policy --public-key ${vsa-multi_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-multi_PRIVATE_KEY} --vsa-upload local@${TMPDIR}/vsa-multi-output --vsa-upload rekor@${REKOR} --vsa-public-key ${vsa-multi_PUBLIC_KEY} --vsa-expiration 0 --output json"
Then the exit status should be 0
Then the output should match the snapshot
And VSA envelope files should exist in "${TMPDIR}/vsa-multi-output"
Expand All @@ -102,7 +102,7 @@ Feature: VSA generation and storage
]
}
"""
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-invalid-image --policy acceptance/vsa-invalid-ec-policy --public-key ${vsa-invalid_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-invalid_PRIVATE_KEY} --vsa-upload invalid-backend@somewhere --vsa-expiration 0 --output json"
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-invalid-image --policy acceptance/vsa-invalid-ec-policy --public-key ${vsa-invalid_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-invalid_PRIVATE_KEY} --vsa-upload invalid-backend@somewhere --vsa-public-key ${vsa-invalid_PUBLIC_KEY} --vsa-expiration 0 --output json"
Then the exit status should be 0
Then the output should match the snapshot

Expand All @@ -126,7 +126,7 @@ Feature: VSA generation and storage
]
}
"""
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-expiration-image@sha256:${REGISTRY_acceptance/vsa-expiration-image:latest_DIGEST} --policy acceptance/vsa-expiration-ec-policy --public-key ${vsa-expiration_PUBLIC_KEY} --rekor-url ${REKOR} --vsa-expiration 1h --vsa-upload rekor@${REKOR} --output json"
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-expiration-image@sha256:${REGISTRY_acceptance/vsa-expiration-image:latest_DIGEST} --policy acceptance/vsa-expiration-ec-policy --public-key ${vsa-expiration_PUBLIC_KEY} --rekor-url ${REKOR} --vsa-expiration 1h --vsa-upload rekor@${REKOR} --vsa-public-key ${vsa-expiration_PUBLIC_KEY} --output json"
Then the exit status should be 0
Then the output should match the snapshot

Expand All @@ -153,7 +153,7 @@ Feature: VSA generation and storage
Given VSA upload to Rekor should be expected
# First, generate a VSA and upload it to Rekor
Given VSA upload to Rekor should be expected
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-existing-image@sha256:${REGISTRY_acceptance/vsa-existing-image:latest_DIGEST} --policy acceptance/vsa-existing-ec-policy --public-key ${vsa-existing_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-existing_PRIVATE_KEY} --vsa-upload rekor@${REKOR} --vsa-expiration 0 --output json"
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-existing-image@sha256:${REGISTRY_acceptance/vsa-existing-image:latest_DIGEST} --policy acceptance/vsa-existing-ec-policy --public-key ${vsa-existing_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-existing_PRIVATE_KEY} --vsa-upload rekor@${REKOR} --vsa-public-key ${vsa-existing_PUBLIC_KEY} --vsa-expiration 0 --output json"
Then the exit status should be 0
And VSA should be uploaded to Rekor successfully

Expand Down Expand Up @@ -206,6 +206,29 @@ Feature: VSA generation and storage
}
"""
Given Rekor upload should fail
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-upload-fail-image --policy acceptance/vsa-upload-fail-ec-policy --public-key ${vsa-upload-fail_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-upload-fail_PRIVATE_KEY} --vsa-upload rekor@${REKOR} --vsa-expiration 0 --output json"
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-upload-fail-image --policy acceptance/vsa-upload-fail-ec-policy --public-key ${vsa-upload-fail_PUBLIC_KEY} --rekor-url ${REKOR} --vsa --vsa-signing-key ${vsa-upload-fail_PRIVATE_KEY} --vsa-upload rekor@${REKOR} --vsa-public-key ${vsa-upload-fail_PUBLIC_KEY} --vsa-expiration 0 --output json"
Then the exit status should be 0
And the log output should contain "[VSA] Failed to upload in-toto 0.0.2 entry"

Scenario: Missing vsa-public-key with vsa-upload errors
Given a key pair named "vsa-pubkey"
Given an image named "acceptance/vsa-pubkey-image"
Given a valid image signature of "acceptance/vsa-pubkey-image" image signed by the "vsa-pubkey" key
Given a valid attestation of "acceptance/vsa-pubkey-image" signed by the "vsa-pubkey" key
Given a git repository named "vsa-pubkey-policy" with
| main.rego | examples/happy_day.rego |
Given policy configuration named "vsa-pubkey-ec-policy" with specification
"""
{
"sources": [
{
"policy": [
"git::https://${GITHOST}/git/vsa-pubkey-policy.git"
]
}
]
}
"""
When ec command is run with "validate image --image ${REGISTRY}/acceptance/vsa-pubkey-image --policy acceptance/vsa-pubkey-ec-policy --public-key ${vsa-pubkey_PUBLIC_KEY} --rekor-url ${REKOR} --vsa-upload local@${TMPDIR}/vsa-pubkey-output --output json"
Then the exit status should be 1
And the log output should contain "--vsa-public-key required when --vsa-upload is set with --vsa-expiration > 0"
Loading
Loading