ci: emit legacy-format VSAs in the embedded promote-to-prod producer [sc-19163] - #32
Merged
Merged
Conversation
…[sc-19163] Mirrors chronicleprotocol/actions-workflows#40. Kyverno (1.18.1 and 1.19.0) cannot read cosign v3 new-bundle-format attestations on registries without the OCI Referrers API; ghcr serves none, so VSAs emitted by this producer verify as count 0 (kyverno#16678). The legacy sha256-<digest>.att layout verifies on both Kyverno versions (twin-kind proven under Deny). cosign pinned to the validated v3.1.3; tlog upload stays on (required). Deprecated flags: revert when Kyverno reads referrer bundles (tracked in sc-19163).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirrors chronicleprotocol/actions-workflows#40 (see it for the full evidence: twin kind clusters, Kyverno 1.18.1 + 1.19.0, Deny admission end-to-end). Kyverno cannot read cosign v3 new-bundle-format attestations on registries without the OCI Referrers API, and ghcr serves none, so VSAs from this embedded producer verify as count 0 (kyverno#16678). This pins cosign v3.1.3 and switches the VSA attest to the legacy .att layout, which verifies on both Kyverno versions; tlog upload stays on (required). SBOM attest and self-verify unchanged. Deprecated flags, shelf life bounded by cosign v4; revert once Kyverno reads referrer bundles (sc-19163).