verifysignature

Documentation

Index

• func IsNoMatchingSignatures(err error) bool
• func IsNoSignaturesFound(err error) bool
• func NewCacheVerifier(cache SignatureVerificationResultCache, verifier Verifier) *cacheVerifier
• func NewDirectVerifier(keys lakomconfig.CompletedConfig, allowInsecureRegistries bool) *directVerifier
• func NewSignatureVerificationResultCache(refreshInterval, cachedObjectTTL time.Duration) (*signatureVerificationResultCache, error)
• type HandleBuilder
  • func NewHandleBuilder() HandleBuilder
  • func (hb HandleBuilder) Build() (*handler, error)
  • func (hb HandleBuilder) WithAllowInsecureRegistries(allowInsecureRegistries bool) HandleBuilder
  • func (hb HandleBuilder) WithAllowUntrustedImages(allowUntrustedImages bool) HandleBuilder
  • func (hb HandleBuilder) WithCacheRefreshInterval(refreshInterval time.Duration) HandleBuilder
  • func (hb HandleBuilder) WithCacheTTL(ttl time.Duration) HandleBuilder
  • func (hb HandleBuilder) WithLakomConfig(config config.Config) HandleBuilder
  • func (hb HandleBuilder) WithLogger(logger logr.Logger) HandleBuilder
  • func (hb HandleBuilder) WithManager(mgr manager.Manager) HandleBuilder
  • func (hb HandleBuilder) WithUseOnlyImagePullSecrets(useOnlyImagePullSecrets bool) HandleBuilder
• type SignatureVerificationResultCache
• type Verifier

Functions

func IsNoMatchingSignatures

func IsNoMatchingSignatures(err error) bool

IsNoMatchingSignatures checks if error is of type cosign.ErrNoMatchingSignatures.

func IsNoSignaturesFound

func IsNoSignaturesFound(err error) bool

IsNoSignaturesFound checks if error is of type cosign.ErrNoSignaturesFound.

func NewCacheVerifier

func NewCacheVerifier(cache SignatureVerificationResultCache, verifier Verifier) *cacheVerifier

NewCacheVerifier creates cached verifier from the provided cache and verifier.

func NewDirectVerifier

func NewDirectVerifier(keys lakomconfig.CompletedConfig, allowInsecureRegistries bool) *directVerifier

NewDirectVerifier creates new verifier and returns it.

func NewSignatureVerificationResultCache

func NewSignatureVerificationResultCache(refreshInterval, cachedObjectTTL time.Duration) (*signatureVerificationResultCache, error)

NewSignatureVerificationResultCache creates and returns a SignatureVerificationResultCache.

Types

type HandleBuilder

type HandleBuilder struct {
	// contains filtered or unexported fields
}

HandleBuilder implements builder pattern that builds admission handle.

func NewHandleBuilder

func NewHandleBuilder() HandleBuilder

NewHandleBuilder returns new handle builder.

func (HandleBuilder) Build

func (hb HandleBuilder) Build() (*handler, error)

Build builds a handler from the HandleBuilder.

func (HandleBuilder) WithAllowInsecureRegistries

func (hb HandleBuilder) WithAllowInsecureRegistries(allowInsecureRegistries bool) HandleBuilder

WithAllowInsecureRegistries configures lakom to communicate via HTTP with registries if HTTPS is not possible

func (HandleBuilder) WithAllowUntrustedImages

func (hb HandleBuilder) WithAllowUntrustedImages(allowUntrustedImages bool) HandleBuilder

WithAllowUntrustedImages configures the webhook to allow images without trusted signature.

func (HandleBuilder) WithCacheRefreshInterval

func (hb HandleBuilder) WithCacheRefreshInterval(refreshInterval time.Duration) HandleBuilder

WithCacheRefreshInterval sets the refresh interval for the cache.

func (HandleBuilder) WithCacheTTL

func (hb HandleBuilder) WithCacheTTL(ttl time.Duration) HandleBuilder

WithCacheTTL sets the TTL for the cache.

func (HandleBuilder) WithLakomConfig

func (hb HandleBuilder) WithLakomConfig(config config.Config) HandleBuilder

WithLakomConfig sets the lakom config with the public keys and their properties.

func (HandleBuilder) WithLogger

func (hb HandleBuilder) WithLogger(logger logr.Logger) HandleBuilder

WithLogger sets the logger.

func (HandleBuilder) WithManager

func (hb HandleBuilder) WithManager(mgr manager.Manager) HandleBuilder

WithManager sets the manager.

func (HandleBuilder) WithUseOnlyImagePullSecrets

func (hb HandleBuilder) WithUseOnlyImagePullSecrets(useOnlyImagePullSecrets bool) HandleBuilder

WithUseOnlyImagePullSecrets sets only the image pull secrets to be used to access the OCI Registry.

type SignatureVerificationResultCache

type SignatureVerificationResultCache interface {
	GetSignatureVerificationResult(string) (bool, bool)
	StoreSignatureVerificationResult(string, bool)
}

SignatureVerificationResultCache is interface which implementations should store the signature verification status of an image.

type Verifier

type Verifier interface {
	Verify(context.Context, string, utils.KeyChainReader) (bool, error)
}

Verifier is interface which implementations should verify cosign signatures of an image.