Skip to content

feat: Add OCI 1.1+ experimental support to tree #4205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
bobcallaway merged 1 commit into from
Jul 14, 2025
Merged

feat: Add OCI 1.1+ experimental support to tree #4205

bobcallaway merged 1 commit into from
Jul 14, 2025

Conversation

@ralphbean
Copy link
Contributor

@ralphbean ralphbean commented May 14, 2025 •
edited
Loading

Summary

Adds OCI 1.1 Referrers support to cosign tree.

Resolves #4204.

Example usage:

❯ ./cosign tree --experimental-oci11 quay.io/rbean/tree-scsa:example
📦 Supply Chain Security Related artifacts for an image: quay.io/rbean/tree-scsa:example
└── 🔐 Signatures for an image tag: quay.io/rbean/tree-scsa:sha256-b3454025ce78fa93aba879b2824a06a59e2b8c5005b2a4286368433cd0f41cde.sig
   └── 🍒 sha256:ef4e39921eeb670ea453be070877d0fef225a13f97a9f9bf107d4d04d4c0dba6
└── 💾 Attestations for an image tag: quay.io/rbean/tree-scsa:sha256-b3454025ce78fa93aba879b2824a06a59e2b8c5005b2a4286368433cd0f41cde.att
   ├── 🍒 sha256:105da535ba7425024b03685048c33a458b3147315458fc1291479bae34f34997
   └── 🍒 sha256:98c6b2784ffe8a38cc4533d9a5d845cfe4ce72c2aa7e7f00a0682718d0259472
└── 🔗 application/vnd.dev.sigstore.bundle.v0.3+json artifacts via OCI referrer: quay.io/rbean/tree-scsa@sha256:01ca3469ae921632f7bd965cb34f9c10f07a723ea68223008871e86052bcfec8
   └── 🍒 sha256:a336d1bfe93e60ae8a5cbbe546663517719d8f3ce1e628ffc0196c0cdf658314

Release Note

  • Updated cosign tree to additionally display artifacts found via the OCI 1.1 Referrers API when --experimental-oci11 is specified.

Documentation

IMO, no docs needed beyond make docgen.

@ralphbean ralphbean requested a review from a team as a code owner May 14, 2025 21:47
@ralphbean ralphbean mentioned this pull request May 16, 2025
Closed
@ralphbean ralphbean force-pushed the oci11-tree branch 2 times, most recently from 08efcaf to ba8c379 Compare July 10, 2025 02:31
@bobcallaway
Copy link
Member

bobcallaway commented Jul 10, 2025

thanks for the PR; i'll try to take a detailed look today.

@codecov
Copy link

codecov bot commented Jul 10, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 0% with 46 lines in your changes missing coverage. Please review.

Project coverage is 34.26%. Comparing base (2ef6022) to head (a2c8e13).
Report is 434 commits behind head on main.

Files with missing lines Patch % Lines
cmd/cosign/cli/tree.go 0.00% 42 Missing ⚠️
cmd/cosign/cli/options/tree.go 0.00% 4 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #4205      +/-   ##
==========================================
- Coverage   40.10%   34.26%   -5.84%     
==========================================
  Files         155      211      +56     
  Lines       10044    14127    +4083     
==========================================
+ Hits         4028     4841     +813     
- Misses       5530     8672    +3142     
- Partials      486      614     +128

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ralphbean
Copy link
Contributor Author

ralphbean commented Jul 11, 2025

Fixed golangci-lint issue.

@ralphbean
feat: Add OCI 1.1+ experimental support to tree
a2c8e13 
Support was previously added to attach, sign, and verify to use the OCI
1.1 referrer's API for associated supply chain artifacts.

This change adds the same support to cosign tree.

Signed-off-by: Ralph Bean <[email protected]>
bobcallaway
bobcallaway approved these changes Jul 14, 2025
View reviewed changes
Copy link
Member

@bobcallaway bobcallaway left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks!

@bobcallaway bobcallaway merged commit 3b3c0fc into sigstore:main Jul 14, 2025
29 checks passed
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jul 28, 2025
build(deps): update cosign to v2.5.3
0883d41 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cosign](https://github.com/sigstore/cosign) | patch | `2.5.2` -> `2.5.3` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>sigstore/cosign (cosign)</summary>

### [`v2.5.3`](https://github.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v253)

[Compare Source](sigstore/cosign@v2.5.2...v2.5.3)

#### Features

- Add signing-config create command ([#&#8203;4280](sigstore/cosign#4280))
- Allow multiple services to be specified for trusted-root create ([#&#8203;4285](sigstore/cosign#4285))
- feat: Add OCI 1.1+ experimental support to tree ([#&#8203;4205](sigstore/cosign#4205))
- Add validity period end for trusted-root create ([#&#8203;4271](sigstore/cosign#4271))

#### Bug Fixes

- Fix cert verification logic for trusted-root/SCTs ([#&#8203;4294](sigstore/cosign#4294))
- force when copying the latest image to overwrite ([#&#8203;4298](sigstore/cosign#4298))
- avoid double-loading trustedroot from file ([#&#8203;4264](sigstore/cosign#4264))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90Il19-->
@ralphbean ralphbean mentioned this pull request Oct 24, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bobcallaway bobcallaway bobcallaway approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

cosign tree support for OCI 1.1 Referrers

2 participants

@ralphbean @bobcallaway