Cosigned validate against remote sig src

[DennyHoang]

Signed-off-by: Denny Hoang dhoang@vmware.com

Summary

• Implementing Authority.Sources to allow verification against signatures in different registry locations
• Also noticed a bug where we are not creating remoteOptions with the keychain and therefore could not verify against private repositories
• RemoteOpts follow the same unmarshalJSON override as publicKeys. This is due to the remoteOption type not being supported by json [un]marshal
• RemoteOpts are parsed and stored as a part of the CIP config to reduce parsing within the validation loop

Ticket Link

Fixes #1651

Release Note

* Specifying remote source for signatures in cosigned

cc: @coyote240 @hectorj2f @vaikas

[codecov-commenter]

Codecov Report

Merging #1754 (d6021d6) into main (0c232da) will increase coverage by 0.08%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #1754      +/-   ##
==========================================
+ Coverage   30.55%   30.63%   +0.08%     
==========================================
  Files         143      143              
  Lines        8651     8661      +10     
==========================================
+ Hits         2643     2653      +10     
  Misses       5709     5709              
  Partials      299      299              

Impacted Files	Coverage Δ
...cosigned/v1alpha1/clusterimagepolicy_validation.go	92.17% <100.00%> (+0.74%)	⬆️
pkg/cosign/kubernetes/webhook/validator.go	82.56% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0c232da...d6021d6. Read the comment docs.

[vaikas]

If we can't marshal it, how is it going to be used? I know this is draft, but just noticed this and just curious how we envision the flow from Reconciler->CIP-Resolved->Webhook to behave.

[DennyHoang]

We keep the sources as a string in authority.source[].oci
RemoteOpts are populated during the unmarshal that occurs when store.go creates the clusterImagePolicy object from the configmap. We use an overridden func (a *Authority) UnmarshalJSON(data []byte) error to then populate the RemoteOpts at that time.

So summary

• Reconciler->CIP-resolved->webhook->configmap will store source[].oci as string
• configmap->webhook in store.go is where we do the pre-processing for remoteOpts where the string gets converted during unmarshal

[vaikas]

Awesomesauce! Thanks for doing!