ClusterImagePolicy’s code to set use-sigstore-attachments does not set it for mirrors

[mtrmac]

When a ClusterImagePolicy is set on a scope to accept sigstore signatures, the underlying registry needs to be configured with use-sigstore-attachments: true.

machine-config-operator/pkg/controller/container-runtime-config/helpers.go

Line 936 in 444decb

func generateSigstoreRegistriesdConfig(clusterScopePolicies map[string]signature.PolicyRequirements) ([]byte, error) {

does do that for the configured scope; but the use-sigstore-attachments option applies not to the “logical name”, but to each underlying mirror individually.

I.e. the option needs to be on every mirror of the scope. Without that, if the image is found on one of such mirrors, the c/image code will not be looking for signatures on the mirror, and policy enforcement is likely to fail.

[mtrmac]

Thanks to @wking for reporting and tracking down this issue.

[wking]

Thanks for writing up this summary 🙇 I've opened OCPBUGS-36344 with a Jira-side copy of this report, and an attempt at reproducer steps, so for convenient tracking on the Jira side.

[QiWang19]

I will look into this next sprint. 👀