cosign: Allow use of regex in CertSubjectEmailVerifier #300
Conversation
dave-tucker
force-pushed
the
cert-regex
branch
from
ce043ee to
e93beff
Compare
There was a problem hiding this comment.
I like the idea, I'm in favor of implementing this change.
The code looks good, but I have some suggestions. These might be a matter of personal taste, hence I'm open to have a discussion about how to proceed.
My proposal would be to change the StringVerifier from being a trait to be a simple enum. We could have something like StringVerifier::ExactMatch(String) and StringVerifier::Regex(Regex). This would make the code easier to understand for our end consumers and we could get rid of the dynamic dispatch introduced by the usage of the trait.
What do you think?
dave-tucker
force-pushed
the
cert-regex
branch
from
e93beff to
c67f5cb
Compare
Makes sense to me. I've updated the patch with your proposal. |
This allows for either an exact match [StringVerifier::ExactMatch] or it allows for a regular expression [StringVerifier::Regex] This supports the use case of trusting signatures from a collection of email addresses e.g .*@redhat.com and or from a collection of issuers. Fixes: sigstore#299 Signed-off-by: Dave Tucker <[email protected]>
|
@Xynnn007 can you please give me an approval? I had to fix the conflicts with the |
|
@Xynnn007 thanks! @dave-tucker sorry about the delay! |
== What's Changed * cosign: Allow use of regex in CertSubjectEmailVerifier by @dave-tucker in sigstore#300 * build(deps): bump rustsec/audit-check from 1.4.1 to 2.0.0 by @dependabot in sigstore#396 * build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by @dependabot in sigstore#397 * build(deps): update rstest requirement from 0.22 to 0.23 by @dependabot in sigstore#399 * build(deps): update testcontainers requirement from 0.22 to 0.23 by @dependabot in sigstore#398 * automation: fix GHA invoking cargo audit by @flavio in sigstore#400 * Cosign | Add support for client to configure a proxy to pull signatures by @Xynnn007 in sigstore#392 * build(deps): bump actions/checkout from 4.2.0 to 4.2.1 by @dependabot in sigstore#401 * CONTRIBUTORS.md: Add note about tests and building by @jku in sigstore#404 * cosign: fix regex dependency import by @Xynnn007 in sigstore#411 * Lint tests too by @jku in sigstore#405 * Simplify cosign verify-bundle example by @jku in sigstore#408 * Examples: Add a minimal example of bundle sign/verify by @jku in sigstore#410 * build(deps): update tough requirement from 0.18 to 0.19 by @dependabot in sigstore#407 * cosign: Make verify-blob compatible with sigstore-python by @jku in sigstore#403 * build(deps): update oci-client requirement from 0.13 to 0.14 by @dependabot in sigstore#418 * build(deps): bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot in sigstore#417 * Deprecate actions-rs actions by @jku in sigstore#415 * build(deps): update cached requirement from 0.53 to 0.54 by @dependabot in sigstore#421 * build(deps): update thiserror requirement from 1.0 to 2.0 by @dependabot in sigstore#420 * build(deps): bump Swatinem/rust-cache from 2.7.5 to 2.7.7 by @dependabot in sigstore#422 * fix clippy complaint by @bobcallaway in sigstore#425 * fix zizmor issues in github actions workflows by @bobcallaway in sigstore#424 * build(deps): update rstest requirement from 0.23 to 0.24 by @dependabot in sigstore#423 * Update embedded trust root by @jku in sigstore#431 * build(deps): update sigstore_protobuf_specs requirement from 0.3 to 0.4 by @dependabot in sigstore#430 * chore(deps): upgrade openidconnect by @flavio in sigstore#433 == New Contributors * @dave-tucker made their first contribution in sigstore#300 * @jku made their first contribution in sigstore#404 **Full Changelog**: sigstore/sigstore-rs@v0.10.0...v0.11.0 Signed-off-by: Flavio Castelli <[email protected]>
Summary
This allows for either an exact match [StringVerifier::ExactMatch]
or it allows for a regular expression [StringVerifier::Regex]
This supports the use case of trusting signatures from a
collection of email addresses e.g .*@redhat.com and or from a
collection of issuers.
Fixes: #299
Release Note
CertSubjectEmailVerifieris now constructed using either aStringVeriferenum. This supports exact string matches or regular expressions.Documentation
Docstrings and examples are updated to show how this is used.