Skip to content

Commit c0a68f0

Browse files
QiWang19QiWang19
committed
Migrate (Cluster)ImagePolicy to v1
Signed-off-by: Qi Wang <qiwan@redhat.com>
1 parent 37f65db commit c0a68f0

File tree

5 files changed

+148
-147
lines changed

5 files changed

+148
-147
lines changed

‎pkg/controller/bootstrap/bootstrap.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,8 @@ func (b *Bootstrap) Run(destDir string) error {
8787
icspRules []*apioperatorsv1alpha1.ImageContentSourcePolicy
8888
idmsRules []*apicfgv1.ImageDigestMirrorSet
8989
itmsRules []*apicfgv1.ImageTagMirrorSet
90-
clusterImagePolicies []*apicfgv1alpha1.ClusterImagePolicy
91-
imagePolicies []*apicfgv1alpha1.ImagePolicy
90+
clusterImagePolicies []*apicfgv1.ClusterImagePolicy
91+
imagePolicies []*apicfgv1.ImagePolicy
9292
imgCfg *apicfgv1.Image
9393
apiServer *apicfgv1.APIServer
9494
)
@@ -138,9 +138,9 @@ func (b *Bootstrap) Run(destDir string) error {
138138
itmsRules = append(itmsRules, obj)
139139
case *apicfgv1.Image:
140140
imgCfg = obj
141-
case *apicfgv1alpha1.ClusterImagePolicy:
141+
case *apicfgv1.ClusterImagePolicy:
142142
clusterImagePolicies = append(clusterImagePolicies, obj)
143-
case *apicfgv1alpha1.ImagePolicy:
143+
case *apicfgv1.ImagePolicy:
144144
imagePolicies = append(imagePolicies, obj)
145145
case *apicfgv1.FeatureGate:
146146
if obj.GetName() == ctrlcommon.ClusterFeatureInstanceName {

‎pkg/controller/container-runtime-config/container_runtime_config_controller.go‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ import (
1919
configinformers "github.com/openshift/client-go/config/informers/externalversions"
2020
cligoinformersv1 "github.com/openshift/client-go/config/informers/externalversions/config/v1"
2121
cligolistersv1 "github.com/openshift/client-go/config/listers/config/v1"
22-
cligolistersv1alpha1 "github.com/openshift/client-go/config/listers/config/v1alpha1"
2322
runtimeutils "github.com/openshift/runtime-utils/pkg/registries"
2423

2524
operatorinformersv1alpha1 "github.com/openshift/client-go/operator/informers/externalversions/operator/v1alpha1"
@@ -107,10 +106,10 @@ type Controller struct {
107106
itmsListerSynced cache.InformerSynced
108107

109108
configInformerFactory configinformers.SharedInformerFactory
110-
clusterImagePolicyLister cligolistersv1alpha1.ClusterImagePolicyLister
109+
clusterImagePolicyLister cligolistersv1.ClusterImagePolicyLister
111110
clusterImagePolicyListerSynced cache.InformerSynced
112111

113-
imagePolicyLister cligolistersv1alpha1.ImagePolicyLister
112+
imagePolicyLister cligolistersv1.ImagePolicyLister
114113
imagePolicyListerSynced cache.InformerSynced
115114
addedPolicyObservers bool
116115

@@ -320,15 +319,15 @@ func (ctrl *Controller) addImagePolicyObservers() {
320319
UpdateFunc: ctrl.clusterImagePolicyUpdated,
321320
DeleteFunc: ctrl.clusterImagePolicyDeleted,
322321
})
323-
ctrl.clusterImagePolicyLister = ctrl.configInformerFactory.Config().V1alpha1().ClusterImagePolicies().Lister()
322+
ctrl.clusterImagePolicyLister = ctrl.configInformerFactory.Config().V1().ClusterImagePolicies().Lister()
324323
ctrl.clusterImagePolicyListerSynced = ctrl.configInformerFactory.Config().V1alpha1().ClusterImagePolicies().Informer().HasSynced
325324

326325
ctrl.configInformerFactory.Config().V1alpha1().ImagePolicies().Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
327326
AddFunc: ctrl.imagePolicyAdded,
328327
UpdateFunc: ctrl.imagePolicyUpdated,
329328
DeleteFunc: ctrl.imagePolicyDeleted,
330329
})
331-
ctrl.imagePolicyLister = ctrl.configInformerFactory.Config().V1alpha1().ImagePolicies().Lister()
330+
ctrl.imagePolicyLister = ctrl.configInformerFactory.Config().V1().ImagePolicies().Lister()
332331
ctrl.imagePolicyListerSynced = ctrl.configInformerFactory.Config().V1alpha1().ImagePolicies().Informer().HasSynced
333332
}
334333

@@ -866,24 +865,24 @@ func (ctrl *Controller) syncImageConfig(key string) error {
866865
var (
867866
registriesBlocked, policyBlocked, allowedRegs []string
868867
releaseImage string
869-
clusterImagePolicies []*apicfgv1alpha1.ClusterImagePolicy
868+
clusterImagePolicies []*apicfgv1.ClusterImagePolicy
870869
clusterScopePolicies map[string]signature.PolicyRequirements
871-
imagePolicies []*apicfgv1alpha1.ImagePolicy
870+
imagePolicies []*apicfgv1.ImagePolicy
872871
scopeNamespacePolicies map[string]map[string]signature.PolicyRequirements
873872
)
874873

875874
if ctrl.sigstoreAPIEnabled() && ctrl.addedPolicyObservers {
876875
// Find all ClusterImagePolicy objects
877876
clusterImagePolicies, err = ctrl.clusterImagePolicyLister.List(labels.Everything())
878877
if err != nil && errors.IsNotFound(err) {
879-
clusterImagePolicies = []*apicfgv1alpha1.ClusterImagePolicy{}
878+
clusterImagePolicies = []*apicfgv1.ClusterImagePolicy{}
880879
} else if err != nil {
881880
return nil
882881
}
883882
// Find all ImagePolicy objects
884883
imagePolicies, err = ctrl.imagePolicyLister.List(labels.Everything())
885884
if err != nil && errors.IsNotFound(err) {
886-
imagePolicies = []*apicfgv1alpha1.ImagePolicy{}
885+
imagePolicies = []*apicfgv1.ImagePolicy{}
887886
} else if err != nil {
888887
return nil
889888
}
@@ -1068,7 +1067,7 @@ func registriesConfigIgnition(templateDir string, controllerConfig *mcfgv1.Contr
10681067

10691068
// getValidScopePolicies returns a map[scope]policyRequirement from ClusterImagePolicy, a map[scope][namespace]policyRequirement from ImagePolicy CRs.
10701069
// It skips ImagePolicy scopes that conflict with ClusterImagePolicy scopes and logs the conflicting scopes in the ImagePolicy Status.
1071-
func getValidScopePolicies(clusterImagePolicies []*apicfgv1alpha1.ClusterImagePolicy, imagePolicies []*apicfgv1alpha1.ImagePolicy, ctrl *Controller) (map[string]signature.PolicyRequirements, map[string]map[string]signature.PolicyRequirements, error) {
1070+
func getValidScopePolicies(clusterImagePolicies []*apicfgv1.ClusterImagePolicy, imagePolicies []*apicfgv1.ImagePolicy, ctrl *Controller) (map[string]signature.PolicyRequirements, map[string]map[string]signature.PolicyRequirements, error) {
10721071
clusterScopePolicies := make(map[string]signature.PolicyRequirements)
10731072
namespacePolicies := make(map[string]map[string]signature.PolicyRequirements)
10741073

@@ -1141,7 +1140,7 @@ func (ctrl *Controller) syncImagePolicyStatusOnly(namespace, imagepolicy, condit
11411140
// RunImageBootstrap generates MachineConfig objects for mcpPools that would have been generated by syncImageConfig,
11421141
// except that mcfgv1.Image is not available.
11431142
func RunImageBootstrap(templateDir string, controllerConfig *mcfgv1.ControllerConfig, mcpPools []*mcfgv1.MachineConfigPool, icspRules []*apioperatorsv1alpha1.ImageContentSourcePolicy,
1144-
idmsRules []*apicfgv1.ImageDigestMirrorSet, itmsRules []*apicfgv1.ImageTagMirrorSet, imgCfg *apicfgv1.Image, clusterImagePolicies []*apicfgv1alpha1.ClusterImagePolicy, imagePolicies []*apicfgv1alpha1.ImagePolicy,
1143+
idmsRules []*apicfgv1.ImageDigestMirrorSet, itmsRules []*apicfgv1.ImageTagMirrorSet, imgCfg *apicfgv1.Image, clusterImagePolicies []*apicfgv1.ClusterImagePolicy, imagePolicies []*apicfgv1.ImagePolicy,
11451144
fgHandler ctrlcommon.FeatureGatesHandler) ([]*mcfgv1.MachineConfig, error) {
11461145

11471146
var (

‎pkg/controller/container-runtime-config/container_runtime_config_controller_test.go‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,8 @@ type fixture struct {
7474
icspLister []*apioperatorsv1alpha1.ImageContentSourcePolicy
7575
idmsLister []*apicfgv1.ImageDigestMirrorSet
7676
itmsLister []*apicfgv1.ImageTagMirrorSet
77-
clusterImagePolicyLister []*apicfgv1alpha1.ClusterImagePolicy
78-
imagePolicyLister []*apicfgv1alpha1.ImagePolicy
77+
clusterImagePolicyLister []*apicfgv1.ClusterImagePolicy
78+
imagePolicyLister []*apicfgv1.ImagePolicy
7979

8080
actions []core.Action
8181
skipActionsValidation bool
@@ -211,20 +211,20 @@ func newClusterVersionConfig(name, desiredImage string) *apicfgv1.ClusterVersion
211211
}
212212
}
213213

214-
func newClusterImagePolicyWithPublicKey(name string, scopes []string, keyData []byte) *apicfgv1alpha1.ClusterImagePolicy {
215-
imgScopes := []apicfgv1alpha1.ImageScope{}
214+
func newClusterImagePolicyWithPublicKey(name string, scopes []string, keyData []byte) *apicfgv1.ClusterImagePolicy {
215+
imgScopes := []apicfgv1.ImageScope{}
216216
for _, scope := range scopes {
217-
imgScopes = append(imgScopes, apicfgv1alpha1.ImageScope(scope))
217+
imgScopes = append(imgScopes, apicfgv1.ImageScope(scope))
218218
}
219-
return &apicfgv1alpha1.ClusterImagePolicy{
219+
return &apicfgv1.ClusterImagePolicy{
220220
TypeMeta: metav1.TypeMeta{APIVersion: apicfgv1alpha1.SchemeGroupVersion.String()},
221221
ObjectMeta: metav1.ObjectMeta{Name: name, UID: types.UID(utilrand.String(5)), Generation: 1},
222-
Spec: apicfgv1alpha1.ClusterImagePolicySpec{
222+
Spec: apicfgv1.ClusterImagePolicySpec{
223223
Scopes: imgScopes,
224-
Policy: apicfgv1alpha1.Policy{
225-
RootOfTrust: apicfgv1alpha1.PolicyRootOfTrust{
226-
PolicyType: apicfgv1alpha1.PublicKeyRootOfTrust,
227-
PublicKey: &apicfgv1alpha1.PublicKey{
224+
Policy: apicfgv1.Policy{
225+
RootOfTrust: apicfgv1.PolicyRootOfTrust{
226+
PolicyType: apicfgv1.PublicKeyRootOfTrust,
227+
PublicKey: &apicfgv1.PublicKey{
228228
KeyData: keyData,
229229
},
230230
},
@@ -233,20 +233,20 @@ func newClusterImagePolicyWithPublicKey(name string, scopes []string, keyData []
233233
}
234234
}
235235

236-
func newImagePolicyWithPublicKey(name, namespace string, scopes []string, keyData []byte) *apicfgv1alpha1.ImagePolicy {
237-
imgScopes := []apicfgv1alpha1.ImageScope{}
236+
func newImagePolicyWithPublicKey(name, namespace string, scopes []string, keyData []byte) *apicfgv1.ImagePolicy {
237+
imgScopes := []apicfgv1.ImageScope{}
238238
for _, scope := range scopes {
239-
imgScopes = append(imgScopes, apicfgv1alpha1.ImageScope(scope))
239+
imgScopes = append(imgScopes, apicfgv1.ImageScope(scope))
240240
}
241-
return &apicfgv1alpha1.ImagePolicy{
241+
return &apicfgv1.ImagePolicy{
242242
TypeMeta: metav1.TypeMeta{APIVersion: apicfgv1alpha1.SchemeGroupVersion.String()},
243243
ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace, UID: types.UID(utilrand.String(5)), Generation: 1},
244-
Spec: apicfgv1alpha1.ImagePolicySpec{
244+
Spec: apicfgv1.ImagePolicySpec{
245245
Scopes: imgScopes,
246-
Policy: apicfgv1alpha1.Policy{
247-
RootOfTrust: apicfgv1alpha1.PolicyRootOfTrust{
248-
PolicyType: apicfgv1alpha1.PublicKeyRootOfTrust,
249-
PublicKey: &apicfgv1alpha1.PublicKey{
246+
Policy: apicfgv1.Policy{
247+
RootOfTrust: apicfgv1.PolicyRootOfTrust{
248+
PolicyType: apicfgv1.PublicKeyRootOfTrust,
249+
PublicKey: &apicfgv1.PublicKey{
250250
KeyData: keyData,
251251
},
252252
},
@@ -323,10 +323,10 @@ func (f *fixture) newController() *Controller {
323323
ci.Config().V1().ImageTagMirrorSets().Informer().GetIndexer().Add(c)
324324
}
325325
for _, c := range f.clusterImagePolicyLister {
326-
ci.Config().V1alpha1().ClusterImagePolicies().Informer().GetIndexer().Add(c)
326+
ci.Config().V1().ClusterImagePolicies().Informer().GetIndexer().Add(c)
327327
}
328328
for _, c := range f.imagePolicyLister {
329-
ci.Config().V1alpha1().ImagePolicies().Informer().GetIndexer().Add(c)
329+
ci.Config().V1().ImagePolicies().Informer().GetIndexer().Add(c)
330330
}
331331

332332
return c
@@ -473,7 +473,7 @@ type registriesConfigAndPolicyVerifyOptions struct {
473473
numberOfImagePolicyNamespaces int
474474
}
475475

476-
func (f *fixture) verifyRegistriesConfigAndPolicyJSONContents(t *testing.T, mcName string, imgcfg *apicfgv1.Image, icsp *apioperatorsv1alpha1.ImageContentSourcePolicy, idms *apicfgv1.ImageDigestMirrorSet, itms *apicfgv1.ImageTagMirrorSet, clusterImagePolicy *apicfgv1alpha1.ClusterImagePolicy, imagePolicy *apicfgv1alpha1.ImagePolicy, releaseImageReg string, opts registriesConfigAndPolicyVerifyOptions) {
476+
func (f *fixture) verifyRegistriesConfigAndPolicyJSONContents(t *testing.T, mcName string, imgcfg *apicfgv1.Image, icsp *apioperatorsv1alpha1.ImageContentSourcePolicy, idms *apicfgv1.ImageDigestMirrorSet, itms *apicfgv1.ImageTagMirrorSet, clusterImagePolicy *apicfgv1.ClusterImagePolicy, imagePolicy *apicfgv1.ImagePolicy, releaseImageReg string, opts registriesConfigAndPolicyVerifyOptions) {
477477
icsps := []*apioperatorsv1alpha1.ImageContentSourcePolicy{}
478478
if icsp != nil {
479479
icsps = append(icsps, icsp)
@@ -486,11 +486,11 @@ func (f *fixture) verifyRegistriesConfigAndPolicyJSONContents(t *testing.T, mcNa
486486
if itms != nil {
487487
itmss = append(itmss, itms)
488488
}
489-
clusterImagePolicies := []*apicfgv1alpha1.ClusterImagePolicy{}
489+
clusterImagePolicies := []*apicfgv1.ClusterImagePolicy{}
490490
if clusterImagePolicy != nil {
491491
clusterImagePolicies = append(clusterImagePolicies, clusterImagePolicy)
492492
}
493-
imagePolicies := []*apicfgv1alpha1.ImagePolicy{}
493+
imagePolicies := []*apicfgv1.ImagePolicy{}
494494
if imagePolicy != nil {
495495
imagePolicies = append(imagePolicies, imagePolicy)
496496
}
@@ -499,7 +499,7 @@ func (f *fixture) verifyRegistriesConfigAndPolicyJSONContents(t *testing.T, mcNa
499499
verifyRegistriesConfigAndPolicyJSONContents(t, updatedMC, mcName, imgcfg, icsps, idmss, itmss, clusterImagePolicies, imagePolicies, releaseImageReg, opts)
500500
}
501501

502-
func verifyRegistriesConfigAndPolicyJSONContents(t *testing.T, mc *mcfgv1.MachineConfig, mcName string, imgcfg *apicfgv1.Image, icsps []*apioperatorsv1alpha1.ImageContentSourcePolicy, idmss []*apicfgv1.ImageDigestMirrorSet, itmss []*apicfgv1.ImageTagMirrorSet, clusterImagePolicies []*apicfgv1alpha1.ClusterImagePolicy, imagePolicies []*apicfgv1alpha1.ImagePolicy, releaseImageReg string, opts registriesConfigAndPolicyVerifyOptions) {
502+
func verifyRegistriesConfigAndPolicyJSONContents(t *testing.T, mc *mcfgv1.MachineConfig, mcName string, imgcfg *apicfgv1.Image, icsps []*apioperatorsv1alpha1.ImageContentSourcePolicy, idmss []*apicfgv1.ImageDigestMirrorSet, itmss []*apicfgv1.ImageTagMirrorSet, clusterImagePolicies []*apicfgv1.ClusterImagePolicy, imagePolicies []*apicfgv1.ImagePolicy, releaseImageReg string, opts registriesConfigAndPolicyVerifyOptions) {
503503
// This is not testing updateRegistriesConfig, which has its own tests; this verifies the created object contains the expected
504504
// configuration file.
505505
// First get the valid blocked registries to ensure we don't block the registry where the release image is from
@@ -1237,8 +1237,8 @@ func TestRunImageBootstrap(t *testing.T) {
12371237
icspRules []*apioperatorsv1alpha1.ImageContentSourcePolicy
12381238
idmsRules []*apicfgv1.ImageDigestMirrorSet
12391239
itmsRules []*apicfgv1.ImageTagMirrorSet
1240-
clusterImagePolicies []*apicfgv1alpha1.ClusterImagePolicy
1241-
imagePolicies []*apicfgv1alpha1.ImagePolicy
1240+
clusterImagePolicies []*apicfgv1.ClusterImagePolicy
1241+
imagePolicies []*apicfgv1.ImagePolicy
12421242
imagePolicyNamespaces int
12431243
}{
12441244
{
@@ -1267,10 +1267,10 @@ func TestRunImageBootstrap(t *testing.T) {
12671267
},
12681268
},
12691269
{
1270-
clusterImagePolicies: []*apicfgv1alpha1.ClusterImagePolicy{
1270+
clusterImagePolicies: []*apicfgv1.ClusterImagePolicy{
12711271
&testClusterImagePolicy,
12721272
},
1273-
imagePolicies: []*apicfgv1alpha1.ImagePolicy{
1273+
imagePolicies: []*apicfgv1.ImagePolicy{
12741274
&testImagePolicy,
12751275
},
12761276
imagePolicyNamespaces: 1,

‎pkg/controller/container-runtime-config/helpers.go‎

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -852,20 +852,20 @@ func ownerReferenceImageConfig(imageConfig *apicfgv1.Image) metav1.OwnerReferenc
852852
}
853853
}
854854

855-
func policyItemFromSpec(policy apicfgv1alpha1.Policy) (signature.PolicyRequirement, error) {
855+
func policyItemFromSpec(policy apicfgv1.Policy) (signature.PolicyRequirement, error) {
856856
var (
857857
sigstorePolicyRequirement signature.PolicyRequirement
858858
signedIdentity signature.PolicyReferenceMatch
859859
signedOptions []signature.PRSigstoreSignedOption
860860
err error
861861
)
862862
switch policy.RootOfTrust.PolicyType {
863-
case apicfgv1alpha1.PublicKeyRootOfTrust:
863+
case apicfgv1.PublicKeyRootOfTrust:
864864
signedOptions = append(signedOptions, signature.PRSigstoreSignedWithKeyData(policy.RootOfTrust.PublicKey.KeyData))
865865
if len(policy.RootOfTrust.PublicKey.RekorKeyData) > 0 {
866866
signedOptions = append(signedOptions, signature.PRSigstoreSignedWithRekorPublicKeyData(policy.RootOfTrust.PublicKey.RekorKeyData))
867867
}
868-
case apicfgv1alpha1.FulcioCAWithRekorRootOfTrust:
868+
case apicfgv1.FulcioCAWithRekorRootOfTrust:
869869
fulcioOptions := []signature.PRSigstoreSignedFulcioOption{}
870870
fulcioOptions = append(fulcioOptions, signature.PRSigstoreSignedFulcioWithCAData(policy.RootOfTrust.FulcioCAWithRekor.FulcioCAData),
871871
signature.PRSigstoreSignedFulcioWithOIDCIssuer(policy.RootOfTrust.FulcioCAWithRekor.FulcioSubject.OIDCIssuer),
@@ -876,7 +876,7 @@ func policyItemFromSpec(policy apicfgv1alpha1.Policy) (signature.PolicyRequireme
876876
return nil, err
877877
}
878878
signedOptions = append(signedOptions, signature.PRSigstoreSignedWithFulcio(prSigstoreSignedFulcio), signature.PRSigstoreSignedWithRekorPublicKeyData(policy.RootOfTrust.FulcioCAWithRekor.RekorKeyData))
879-
case apicfgv1alpha1.PKIRootOfTrust:
879+
case apicfgv1.PKIRootOfTrust:
880880
pkiOptions := []signature.PRSigstoreSignedPKIOption{}
881881
pkiOptions = append(pkiOptions, signature.PRSigstoreSignedPKIWithCARootsData(policy.RootOfTrust.PKI.CertificateAuthorityRootsData))
882882
if len(policy.RootOfTrust.PKI.CertificateAuthorityIntermediatesData) > 0 {
@@ -895,27 +895,30 @@ func policyItemFromSpec(policy apicfgv1alpha1.Policy) (signature.PolicyRequireme
895895
signedOptions = append(signedOptions, signature.PRSigstoreSignedWithPKI(prSigstoreSignedPKI))
896896
}
897897

898-
switch policy.SignedIdentity.MatchPolicy {
899-
case apicfgv1alpha1.IdentityMatchPolicyRemapIdentity:
900-
identity, err := signature.NewPRMRemapIdentity(string(policy.SignedIdentity.PolicyMatchRemapIdentity.Prefix), string(policy.SignedIdentity.PolicyMatchRemapIdentity.SignedPrefix))
901-
if err != nil {
902-
return nil, fmt.Errorf("error getting signedIdentity for %s: %v", apicfgv1alpha1.IdentityMatchPolicyRemapIdentity, err)
903-
}
904-
signedIdentity = identity
905-
case apicfgv1alpha1.IdentityMatchPolicyExactRepository:
906-
identity, err := signature.NewPRMExactRepository(string(policy.SignedIdentity.PolicyMatchExactRepository.Repository))
907-
if err != nil {
908-
return nil, fmt.Errorf("error getting signedIdentity for %s: %v", apicfgv1alpha1.IdentityMatchPolicyExactRepository, err)
898+
if policy.SignedIdentity != nil {
899+
switch policy.SignedIdentity.MatchPolicy {
900+
case apicfgv1.IdentityMatchPolicyRemapIdentity:
901+
identity, err := signature.NewPRMRemapIdentity(string(policy.SignedIdentity.PolicyMatchRemapIdentity.Prefix), string(policy.SignedIdentity.PolicyMatchRemapIdentity.SignedPrefix))
902+
if err != nil {
903+
return nil, fmt.Errorf("error getting signedIdentity for %s: %v", apicfgv1alpha1.IdentityMatchPolicyRemapIdentity, err)
904+
}
905+
signedIdentity = identity
906+
case apicfgv1.IdentityMatchPolicyExactRepository:
907+
identity, err := signature.NewPRMExactRepository(string(policy.SignedIdentity.PolicyMatchExactRepository.Repository))
908+
if err != nil {
909+
return nil, fmt.Errorf("error getting signedIdentity for %s: %v", apicfgv1alpha1.IdentityMatchPolicyExactRepository, err)
910+
}
911+
signedIdentity = identity
912+
case apicfgv1.IdentityMatchPolicyMatchRepository:
913+
signedIdentity = signature.NewPRMMatchRepository()
914+
case apicfgv1.IdentityMatchPolicyMatchRepoDigestOrExact:
915+
signedIdentity = signature.NewPRMMatchRepoDigestOrExact()
916+
default:
917+
return nil, fmt.Errorf("unknown signedIdentity match policy: %s", policy.SignedIdentity.MatchPolicy)
909918
}
910-
signedIdentity = identity
911-
case apicfgv1alpha1.IdentityMatchPolicyMatchRepository:
912-
signedIdentity = signature.NewPRMMatchRepository()
913-
case apicfgv1alpha1.IdentityMatchPolicyMatchRepoDigestOrExact, "":
919+
} else {
914920
signedIdentity = signature.NewPRMMatchRepoDigestOrExact()
915-
default:
916-
return nil, fmt.Errorf("unknown signedIdentity match policy: %s", policy.SignedIdentity.MatchPolicy)
917921
}
918-
919922
signedOptions = append(signedOptions, signature.PRSigstoreSignedWithSignedIdentity(signedIdentity))
920923

921924
if sigstorePolicyRequirement, err = signature.NewPRSigstoreSigned(signedOptions...); err != nil {

0 commit comments

Comments
 (0)