fix(controlplane): check the certificate organization at push time only

Viewing a stored run no longer checks that the signing certificate was issued
to the run's organization. Runs signed with certificates that do not carry the
organization, for example issued by an EJBCA profile that did not map it, do
not turn into failed verifications. The check still runs on every push.

A run without an organization now fails the push with a validation error.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 3ed0fe4b-8701-40f8-bb35-c85ce99f6fd1

Author: migmartri

app/controlplane/pkg/biz/workflowrun.go

@@ -700,7 +700,12 @@ func (uc *WorkflowRunUseCase) verifyAttestationToStore(ctx context.Context, run
 		return nil
 	}
 
-	validation, err := uc.verifyRunBundle(ctx, run, bundle)
+	// Bind the signing certificate to the organization that owns the run
+	if run.Workflow == nil || run.Workflow.OrgID == uuid.Nil {
+		return NewErrValidation(fmt.Errorf("attestation verification failed: workflow run %s has no organization", run.ID))
+	}
+
+	validation, err := uc.verifyRunBundle(ctx, bundle, verifier.WithExpectedOrganization(run.Workflow.OrgID.String()))
 	if err != nil {
 		// only returned when verification is not forced
 		if errors.Is(err, verifier.ErrInvalidBundle) {
@@ -729,16 +734,12 @@ func (uc *WorkflowRunUseCase) verifyAttestationToStore(ctx context.Context, run
 	return NewErrValidation(fmt.Errorf("attestation verification failed: %s", validation.FailureReason))
 }
 
-// verifyRunBundle verifies a bundle of the run, bound to the run's organization.
+// verifyRunBundle verifies a bundle and applies the enforcement policy.
 // When verification is forced, a bundle that can't be verified is reported as a
 // failed verification. Otherwise it is reported as not applicable (nil result),
 // or as an ErrInvalidBundle error for data that is not a bundle.
-func (uc *WorkflowRunUseCase) verifyRunBundle(ctx context.Context, run *WorkflowRun, bundle []byte) (*VerificationResult, error) {
-	if run.Workflow == nil || run.Workflow.OrgID == uuid.Nil {
-		return nil, fmt.Errorf("workflow run %s has no organization", run.ID)
-	}
-
-	vr, err := uc.verifyBundle(ctx, bundle, verifier.WithExpectedOrganization(run.Workflow.OrgID.String()))
+func (uc *WorkflowRunUseCase) verifyRunBundle(ctx context.Context, bundle []byte, opts ...verifier.VerifyOption) (*VerificationResult, error) {
+	vr, err := uc.verifyBundle(ctx, bundle, opts...)
 	if !uc.signingUseCase.ForceVerification {
 		return vr, err
 	}
@@ -772,7 +773,10 @@ func (uc *WorkflowRunUseCase) VerifyRun(ctx context.Context, run *WorkflowRun) (
 		return &VerificationResult{FailureReason: "the attestation bundle could not be retrieved"}, nil
 	}
 
-	return uc.verifyRunBundle(ctx, run, run.Attestation.Bundle)
+	// The organization binding is enforced at push time only. Stored runs
+	// signed with certificates that do not carry the organization, for example
+	// issued by an EJBCA profile that did not map it, must not turn into failures.
+	return uc.verifyRunBundle(ctx, run.Attestation.Bundle)
 }
 
 func (uc *WorkflowRunUseCase) verifyBundle(ctx context.Context, bundle []byte, opts ...verifier.VerifyOption) (*VerificationResult, error) {

app/controlplane/pkg/biz/workflowrun_verification_test.go

@@ -131,9 +131,18 @@ func TestValidateAttestationContractEnforcesKeylessVerification(t *testing.T) {
 		name    string
 		signing *biz.SigningUseCase
 		bundle  []byte
+		// the run has no organization
+		noOrg bool
 		// signature check is expected to reject the attestation
 		wantRejected bool
 	}{
+		{
+			name:         "run without organization",
+			signing:      forced,
+			bundle:       newSignedTestBundle(t, forced, orgID.String(), bundleWithCert),
+			noOrg:        true,
+			wantRejected: true,
+		},
 		{
 			name:    "keyless certificate issued to the run organization",
 			signing: forced,
@@ -191,9 +200,11 @@ func TestValidateAttestationContractEnforcesKeylessVerification(t *testing.T) {
 			runID := uuid.New()
 			// the run has no contract revision, so an attestation that passes
 			// the signature check is stopped at the contract check instead
-			repo.On("FindByID", mock.Anything, runID).Return(&biz.WorkflowRun{
-				ID: runID, Workflow: &biz.Workflow{OrgID: orgID},
-			}, nil)
+			run := &biz.WorkflowRun{ID: runID, Workflow: &biz.Workflow{OrgID: orgID}}
+			if tc.noOrg {
+				run.Workflow = nil
+			}
+			repo.On("FindByID", mock.Anything, runID).Return(run, nil)
 
 			err = uc.ValidateAttestationContract(context.Background(), runID.String(), tc.bundle)
 			require.Error(t, err)
@@ -228,10 +239,12 @@ func TestVerifyRunKeyless(t *testing.T) {
 			wantResult: true,
 		},
 		{
+			// the organization is checked at push time only, so stored runs
+			// signed before the certificate carried the organization still verify
 			name:       "keyless certificate issued to another organization",
 			signing:    forced,
 			bundle:     newSignedTestBundle(t, forced, uuid.NewString(), bundleWithCert),
-			wantReason: "organization mismatch",
+			wantResult: true,
 		},
 		{
 			name:       "keyless certificate issued to the run organization, with a tampered signature",
@@ -280,12 +293,6 @@ func TestVerifyRunKeyless(t *testing.T) {
 			digest:  "sha256:0f9b2a1c",
 			wantNil: true,
 		},
-		{
-			name:       "opt-out: keyless certificate issued to another organization is not verified",
-			signing:    optOut,
-			bundle:     newSignedTestBundle(t, forced, uuid.NewString(), bundleWithCert),
-			wantReason: "organization mismatch",
-		},
 		{
 			name:       "opt-out: keyless certificate with a tampered signature is not verified",
 			signing:    optOut,