rpms/containers-common
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Update to 0.60.2

Browse Source 
- Related: RHEL-39410
Signed-off-by: Jindrich Novy <jnovy@redhat.com>
This commit is contained in:
Jindrich Novy 2024-08-26 14:31:42 +02:00
parent 3bcf7d269e
commit 6aa2fd09db
3 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
containers-common.spec
View File

@ -6,8 +6,8 @@
# Packit will automatically update the image and storage versions on Fedora and # Packit will automatically update the image and storage versions on Fedora and
# CentOS Stream dist-git PRs. # CentOS Stream dist-git PRs.
%global image_branch v5.30.2 %global image_branch v5.32.2
%global storage_branch v1.53.0 %global storage_branch v1.55.0
%global shortnames_branch main %global shortnames_branch main
%global project containers %global project containers
@ -39,7 +39,7 @@ Epoch: 2
# If that's what you're reading, Version must be 0, and will be updated by Packit for # If that's what you're reading, Version must be 0, and will be updated by Packit for
# copr and koji builds. # copr and koji builds.
# If you're reading this on dist-git, the version is automatically filled in by Packit. # If you're reading this on dist-git, the version is automatically filled in by Packit.
Version: 0.60.0 Version: 0.60.2
Release: %autorelease Release: %autorelease
License: Apache-2.0 License: Apache-2.0
BuildArch: noarch BuildArch: noarch

13
containers-policy.json.5.md
View File

@ -320,7 +320,9 @@ This requirement requires an image to be signed using a sigstore signature with
{ {
"type": "sigstoreSigned", "type": "sigstoreSigned",
"keyPath": "/path/to/local/public/key/file", "keyPath": "/path/to/local/public/key/file",
"keyPaths": ["/path/to/first/public/key/one", "/path/to/first/public/key/two"],
"keyData": "base64-encoded-public-key-data", "keyData": "base64-encoded-public-key-data",
"keyDatas": ["base64-encoded-public-key-one-data", "base64-encoded-public-key-two-data"]
"fulcio": { "fulcio": {
"caPath": "/path/to/local/CA/file", "caPath": "/path/to/local/CA/file",
"caData": "base64-encoded-CA-data", "caData": "base64-encoded-CA-data",
@ -328,28 +330,33 @@ This requirement requires an image to be signed using a sigstore signature with
"subjectEmail", "expected-signing-user@example.com", "subjectEmail", "expected-signing-user@example.com",
}, },
"rekorPublicKeyPath": "/path/to/local/public/key/file", "rekorPublicKeyPath": "/path/to/local/public/key/file",
"rekorPublicKeyPaths": ["/path/to/local/public/key/one","/path/to/local/public/key/two"],
"rekorPublicKeyData": "base64-encoded-public-key-data", "rekorPublicKeyData": "base64-encoded-public-key-data",
"rekorPublicKeyDatas": ["base64-encoded-public-key-one-data","base64-encoded-public-key-two-data"],
"signedIdentity": identity_requirement "signedIdentity": identity_requirement
} }
``` ```
Exactly one of `keyPath`, `keyData` and `fulcio` must be present. Exactly one of `keyPath`, `keyPaths`, `keyData`, `keyDatas` and `fulcio` must be present.
If `keyPath` or `keyData` is present, it contains a sigstore public key. If `keyPath` or `keyData` is present, it contains a sigstore public key.
Only signatures made by this key are accepted. Only signatures made by this key are accepted.
If `keyPaths` or `keyDatas` is present, it contains sigstore public keys.
Only signatures made by any key in the list are accepted.
If `fulcio` is present, the signature must be based on a Fulcio-issued certificate. If `fulcio` is present, the signature must be based on a Fulcio-issued certificate.
One of `caPath` and `caData` must be specified, containing the public key of the Fulcio instance. One of `caPath` and `caData` must be specified, containing the public key of the Fulcio instance.
Both `oidcIssuer` and `subjectEmail` are mandatory, Both `oidcIssuer` and `subjectEmail` are mandatory,
exactly specifying the expected identity provider, exactly specifying the expected identity provider,
and the identity of the user obtaining the Fulcio certificate. and the identity of the user obtaining the Fulcio certificate.
At most one of `rekorPublicKeyPath` and `rekorPublicKeyData` can be present; At most one of `rekorPublicKeyPath`, `rekorPublicKeyPaths`, `rekorPublicKeyData` and `rekorPublicKeyDatas` can be present;
it is mandatory if `fulcio` is specified. it is mandatory if `fulcio` is specified.
If a Rekor public key is specified, If a Rekor public key is specified,
the signature must have been uploaded to a Rekor server the signature must have been uploaded to a Rekor server
and the signature must contain an (offline-verifiable) “signed entry timestamp” and the signature must contain an (offline-verifiable) “signed entry timestamp”
proving the existence of the Rekor log record, proving the existence of the Rekor log record,
signed by the provided public key. signed by one of the provided public keys.
The `signedIdentity` field has the same semantics as in the `signedBy` requirement described above. The `signedIdentity` field has the same semantics as in the `signedBy` requirement described above.
Note that `cosign`-created signatures only contain a repository, so only `matchRepository` and `exactRepository` can be used to accept them (and that does not protect against substitution of a signed image with an unexpected tag). Note that `cosign`-created signatures only contain a repository, so only `matchRepository` and `exactRepository` can be used to accept them (and that does not protect against substitution of a signed image with an unexpected tag).

2
sources
View File

@ -1 +1 @@
SHA512 (v0.60.0.tar.gz) = 9eae809f6834472172fb997dedf828a11c7617b19374f46086394be3eeeb7f8fa9a1245a020af3a611142d6edda6670ee1d080229048fd0886313c7f698c21af SHA512 (v0.60.2.tar.gz) = 0f0495adfbac1c1cea3a209d506495617e727523b4edf436225df79c7378bad1ea5504a94e0e54322601585a5740f67cef81b971a0825d5180c2c29da703fc82