Use Sigstore staging for test recordings

This commit modifies the acceptance tests which rely on recordings to be
based on the staging instance of Sigstore.

The main advantage of this approach is that to regenerate the data, we
no longer need to spin up a local instance of Sigstore which can be
quite resource intensive. Also, since the stagning Sigstore instance is
not an ephemeral instance, we can be selective in only re-generating the
data that expires.

It would be great to eventually tie this into a GitHub Workflow so a PR
can be created every so often.

Signed-off-by: Luiz Carvalho <[email protected]>

Makefile

@@ -146,6 +146,7 @@ LICENSE_IGNORE=\
 -ignore 'configs/*/*.yaml' \
 -ignore 'node_modules/**' \
 -ignore 'hack/**/charts/**' \
+-ignore 'acceptance/wiremock/recordings/**' \
 -ignore '.tekton/*.yaml'
 
 LINT_TO_GITHUB_ANNOTATIONS='map(map(.)[])[][] as $$d | $$d.posn | split(":") as $$posn | "::warning file=\($$posn[0]),line=\($$posn[1]),col=\($$posn[2])::\($$d.message)"'

acceptance/cli/cli.go

@@ -385,8 +385,8 @@ func setupTUF(ctx context.Context, vars map[string]string, environment []string)
 	}
 	vars["TUF"] = tufURL
 
-	vars["CERT_IDENTITY"] = "https://kubernetes.io/namespaces/default/serviceaccounts/default"
-	vars["CERT_ISSUER"] = "https://kubernetes.default.svc.cluster.local"
+	vars["CERT_IDENTITY"] = "[email protected]"
+	vars["CERT_ISSUER"] = "https://github.com/login/oauth"
 
 	environment = append(environment, fmt.Sprintf("TUF_ROOT=%s", tuf.Root(ctx)))
 

acceptance/image/image.go

@@ -26,7 +26,6 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -603,14 +602,17 @@ func createAndPushKeylessImage(ctx context.Context, imageName string) (context.C
 				sig.Certificate = certPEM
 			}
 
-			if cert, ok := l.Annotations[static.ChainAnnotationKey]; ok {
-				if strings.Contains(cert, "-\n-") {
-					return errors.New("thus far we have only seen chain of length 1, fix the test to support more than one certificate in chain")
+			if certs, ok := l.Annotations[static.ChainAnnotationKey]; ok {
+				for block, rest := pem.Decode([]byte(certs)); block != nil; block, rest = pem.Decode(rest) {
+					if block.Type != "CERTIFICATE" {
+						continue
+					}
+					cert := new(strings.Builder)
+					if err := pem.Encode(cert, block); err != nil {
+						return err
+					}
+					sig.Chain = append(sig.Chain, cert.String())
 				}
-				if !strings.HasSuffix(cert, "\n") { // for whatever reason the trailing newline is missing in the annotation
-					cert += "\n"
-				}
-				sig.Chain = []string{cert} // TODO hmm
 			}
 
 			where[imageName] = sig

acceptance/image/testimage/blobs/sha256/996e60caeba5a31621dbd69fc744e2686287d10564a6510bd8ef0d902960d33c → acceptance/image/testimage/blobs/sha256/46c62a1c8d201a84273c26611e5b8deb17fbc8597bd750eef9beeab163fe3715

@@ -1 +1 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","digest":"sha256:3eaf7ec07c9bee51f9b4a1d1722b7f340c31045867335ab8a0b4946df7f96bb8","size":326},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:bd9ddc54bea929a22b334e73e026d4136e5b73f5cc29942896c72e4ece69b13d","size":34}],"annotations":{"org.opencontainers.image.base.digest":"","org.opencontainers.image.base.name":""}}
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","digest":"sha256:e76feb45a3e513d30d053440066b0d9fb2bd47999894bd38fb1fb64d72d80ce3","size":326},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:bd9ddc54bea929a22b334e73e026d4136e5b73f5cc29942896c72e4ece69b13d","size":34}],"annotations":{"org.opencontainers.image.base.digest":"","org.opencontainers.image.base.name":""}}

acceptance/image/testimage/blobs/sha256/62d2613715e73c0bd327283235e25cb2c3800a5b085c88784c686458d47a4812

@@ -0,0 +1 @@
+{"architecture":"","created":"0001-01-01T00:00:00Z","history":[{"created":"0001-01-01T00:00:00Z"}],"os":"","rootfs":{"type":"layers","diff_ids":["sha256:77d53490dbc8f3f67c8c36a6c5e9c57d624b6ed61850247559e634651ed07864"]},"config":{}}

acceptance/image/testimage/blobs/sha256/177cd430fc38b5aef38d8cb30d21960a3782b8c39a49997eb8b0785270940611 → acceptance/image/testimage/blobs/sha256/6b3cc5d7cd086fd1a30bd21104a8975e8dad61f711d458a3998aefaa524afa5e

@@ -1 +1 @@
-{"payloadType":"application/vnd.in-toto+json","payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjAuMiIsInN1YmplY3QiOlt7Im5hbWUiOiJyZWdpc3RyeS5sb2NhbDo1MDAwL3NpZ3N0b3JlL3Rlc3RpbWFnZSIsImRpZ2VzdCI6eyJzaGEyNTYiOiI5OTZlNjBjYWViYTVhMzE2MjFkYmQ2OWZjNzQ0ZTI2ODYyODdkMTA1NjRhNjUxMGJkOGVmMGQ5MDI5NjBkMzNjIn19XSwicHJlZGljYXRlIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL3Rla3Rvbi5kZXYvY2hhaW5zL3YyIn0sImJ1aWxkVHlwZSI6InRla3Rvbi5kZXYvdjEvUGlwZWxpbmVSdW4iLCJpbnZvY2F0aW9uIjp7ImNvbmZpZ1NvdXJjZSI6e319LCJtZXRhZGF0YSI6eyJidWlsZFN0YXJ0ZWRPbiI6IjIwMjMtMDMtMjJUMTk6Mzg6MDFaIiwiYnVpbGRGaW5pc2hlZE9uIjoiMjAyMy0wMy0yMlQxOTo0MTowNVoiLCJjb21wbGV0ZW5lc3MiOnsicGFyYW1ldGVycyI6ZmFsc2UsImVudmlyb25tZW50IjpmYWxzZSwibWF0ZXJpYWxzIjpmYWxzZX0sInJlcHJvZHVjaWJsZSI6ZmFsc2V9fX0=","signatures":[{"keyid":"","sig":"MEUCIQDP7+yZSiEkHNBrLbAj88+/pnog1TlrP3FKmJQ5k2XFmgIgQ8Wiw+Zvocck+IqAAq450S6hKyvkaEcPsseqPPXuPNg="}]}
+{"payloadType":"application/vnd.in-toto+json","payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjAuMiIsInN1YmplY3QiOlt7Im5hbWUiOiJyZWdpc3RyeS5sb2NhbDo1MDAwL3NpZ3N0b3JlL3Rlc3RpbWFnZSIsImRpZ2VzdCI6eyJzaGEyNTYiOiI0NmM2MmExYzhkMjAxYTg0MjczYzI2NjExZTViOGRlYjE3ZmJjODU5N2JkNzUwZWVmOWJlZWFiMTYzZmUzNzE1In19XSwicHJlZGljYXRlIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL3Rla3Rvbi5kZXYvY2hhaW5zL3YyIn0sImJ1aWxkVHlwZSI6InRla3Rvbi5kZXYvdjEvUGlwZWxpbmVSdW4iLCJpbnZvY2F0aW9uIjp7ImNvbmZpZ1NvdXJjZSI6e319LCJtZXRhZGF0YSI6eyJidWlsZFN0YXJ0ZWRPbiI6IjIwMjMtMDMtMjJUMTk6Mzg6MDFaIiwiYnVpbGRGaW5pc2hlZE9uIjoiMjAyMy0wMy0yMlQxOTo0MTowNVoiLCJjb21wbGV0ZW5lc3MiOnsicGFyYW1ldGVycyI6ZmFsc2UsImVudmlyb25tZW50IjpmYWxzZSwibWF0ZXJpYWxzIjpmYWxzZX0sInJlcHJvZHVjaWJsZSI6ZmFsc2V9fX0=","signatures":[{"keyid":"","sig":"MEYCIQDE8DNuhyR4GB/H25r4XZrpMSJGgKLryCoSvDtVcJkETQIhALZJ2xmyM1g8V4c70HEp9doDe/ymHCw7zIo+3WqfS6NM"}]}

acceptance/image/testimage/blobs/sha256/d59509ea5b901bdc5062ecee23f9edf8dc05a89a7a505ed2f2e4bda14edb3296 → acceptance/image/testimage/blobs/sha256/77d53490dbc8f3f67c8c36a6c5e9c57d624b6ed61850247559e634651ed07864

@@ -1 +1 @@
-{"critical":{"identity":{"docker-reference":"registry.local:5000/sigstore/testimage"},"image":{"docker-manifest-digest":"sha256:996e60caeba5a31621dbd69fc744e2686287d10564a6510bd8ef0d902960d33c"},"type":"cosign container image signature"},"optional":null}
+{"critical":{"identity":{"docker-reference":"registry.local:5000/sigstore/testimage"},"image":{"docker-manifest-digest":"sha256:46c62a1c8d201a84273c26611e5b8deb17fbc8597bd750eef9beeab163fe3715"},"type":"cosign container image signature"},"optional":null}