[TEP-0089] - Phase 2 Signed TaskRun Status

[pxp928]

Signed-off-by: pxp928 parth.psu@gmail.com

Changes

Authors - @pxp928 and @lumjjb

In association with TEP-0089: Non-falsifiable provenance support

This PR is the implementation of Phase 2 of the TEP-0089: Non-falsifiable provenance support

This PR builds on Phase 1 [TEP-0089] - Phase 1 Signed TaskRun Results - #4759 so that must be merged first.

Phase 2

• Implement Signed TaskRuns with SPIRE
• Add support for Chains verifying Signed TaskRuns

Continuation of phase 1 of TEP-0089. This PR adds signed TaskRuns by adding an annotation to that TaskRun Status. This only allows for changes from the pipeline controller to be valid. All others interactions will be marked as not valid and fail the spire verification.

Once Tekton Pipeline completes, Chains will run to verify both the TaskRun Results and the TaskRun are validated by Spire. If they do not pass the check, Chains will not sign the TaskRun.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Docs included if any changes are user facing
• Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been filled in or deleted (only if no user facing changes)

Release Notes

• Added TaskRun Status annotations to track the validity of the signed TaskRun
• Utilizes pipeline controller spire SVID, status hash and signature
• Pipeline controller continuously validates the TaskRun Status for any modifications
• Tekton Chains will validate the results and status of the TaskRun after completion

Please provide feedback and improvements!

[tekton-robot]

Hi @pxp928. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dibyom]

Clearing the milestone for now since we need to merge the Phase I implementation first.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign jerop after the PR has been reviewed.
You can assign the PR to them by writing /assign @jerop in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tekton-robot]

@pxp928: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[tekton-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

[tekton-robot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

[tekton-robot]

@tekton-robot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.