ROX-34488: discover cosign signatures via OCI 1.1 Referrers API by stehessel · Pull Request #21908 · stackrox/stackrox

stehessel · 2026-07-23T14:19:39Z

Description

Extract signature payload fetching into cosign_payload_fetcher.go and add referrer-based discovery alongside the existing tag-based method. FetchSignatures now queries both paths and merges results. Referrer errors are swallowed so registries without OCI 1.1 support keep working.

This enables discovery of signatures created by cosign v3+, which defaults to storing signatures as OCI referrers instead of legacy tags.

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

How I validated my change

Unit tests for tag-based and referrer-based payload fetching in cosign_payload_fetcher_test.go and cosign_sig_fetcher_test.go using an in-memory registry.

openshift-ci · 2026-07-23T14:19:43Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2026-07-23T14:29:37Z

🚀 Build Images Ready

Images are ready for commit fe56193. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.12.x-625-gfe56193b04

codecov · 2026-07-23T17:50:49Z

Codecov Report

❌ Patch coverage is 54.83871% with 70 lines in your changes missing coverage. Please review.
✅ Project coverage is 51.20%. Comparing base (7faa14b) to head (be1fb7c).
⚠️ Report is 4 commits behind head on master.

Files with missing lines	Patch %	Lines
pkg/signatures/cosign_sig_fetcher.go	58.94%	29 Missing and 10 partials ⚠️
pkg/signatures/cosign_payload_fetcher.go	50.87%	23 Missing and 5 partials ⚠️
pkg/signatures/factory.go	0.00%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #21908      +/-   ##
==========================================
- Coverage   51.23%   51.20%   -0.04%     
==========================================
  Files        2864     2865       +1     
  Lines      178713   178805      +92     
==========================================
- Hits        91558    91549       -9     
- Misses      79119    79194      +75     
- Partials     8036     8062      +26

Flag	Coverage Δ
go-unit-tests	`51.20% <54.83%> (-0.04%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

guzalv

Looks great! I left a couple comments/questions, nothing blocking.

Also AI mentioned that we should add a test that uploads a real sigstore bundle and fetches it via fetchSignaturesByReferrer, didn't verify that claim.

stehessel · 2026-07-29T11:07:06Z

Also AI mentioned that we should add a test that uploads a real sigstore bundle and fetches it via fetchSignaturesByReferrer, didn't verify that claim.

The fourth PR in the stack has explicit e2e tests that include fetching and verification of real certificates.

Extract signature payload fetching into cosign_payload_fetcher.go and add referrer-based discovery alongside the existing tag-based method. FetchSignatures now queries both paths and merges results. Referrer errors are swallowed so registries without OCI 1.1 support keep working. This enables discovery of signatures created by cosign v3+, which defaults to storing signatures as OCI referrers instead of legacy tags. Partially generated by AI.

- Pass imgSHA string instead of *storage.Image to fetchSignaturesByTag and newTagSignedEntity since only the SHA is used. - Filter referrer manifests by artifact type before clamping to the 50-manifest budget so non-sigstore referrers don't consume the limit. - Return single signaturePayload from fetchSigstoreBundle instead of a slice since it always produces exactly one payload. - Add comment explaining that 404 from Referrers API means the registry does not support OCI 1.1. - Consolidate TestConvertPayloadsToSignatures into one table-driven test. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Both Attestations() and Attachment() on tagSignedEntity are unused safe defaults for the oci.SignedEntity interface. Return nil, nil from both for consistency. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-07-29T19:51:38Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 4a611c8d-e83b-49cc-8008-6e74a1eb1605

📥 Commits

Reviewing files that changed from the base of the PR and between 4160635 and be1fb7c.

📒 Files selected for processing (2)

pkg/signatures/cosign_payload_fetcher.go
pkg/signatures/cosign_sig_fetcher.go

📝 Walkthrough

Summary by CodeRabbit

New Features
- Discover cosign signatures via both legacy tag lookup and OCI referrer manifests.
- Support sigstore bundles in addition to SimpleSigning payloads, with merged and deduplicated results.
Bug Fixes
- Improved behavior for missing signatures/unsupported referrers and more consistent handling of authorization failures.
- Fail-fast and context-cancellation handling during referrer bundle fetching; more accurate retry behavior.
Tests
- Added coverage for tag/referrer scenarios, bundle vs SimpleSigning conversion, missing V2 metadata, credential-based fetching, and empty-result cases.

Walkthrough

The signature fetcher now supports retry modifiers, concurrently discovers SimpleSigning tags and OCI 1.1 sigstore bundle referrers, converts both payload formats, handles partial failures, and returns deduplicated signatures.

Changes

Cosign signature fetching

Layer / File(s)	Summary
Fetch contract and retry propagation `pkg/signatures/factory.go`, `pkg/images/enricher/testing_test.go`	The fetcher interface accepts retry modifiers, retry configuration is delegated to implementations, and the test double matches the updated method signature.
Tag and referrer payload discovery `pkg/signatures/cosign_payload_fetcher.go`, `pkg/signatures/cosign_payload_fetcher_test.go`	SimpleSigning tag payloads and OCI 1.1 sigstore bundle referrers are discovered, filtered, bounded, serialized, and tested.
Concurrent fetching and signature conversion `pkg/signatures/cosign_sig_fetcher.go`, `pkg/signatures/cosign_sig_fetcher_test.go`	Tag and referrer paths run with retries and timeouts, results are merged and deduplicated, errors are classified, and payloads are converted into storage signatures with coverage for both formats.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant SignatureFetcher
  participant fetchWithRetry
  participant OCIRegistry
  participant convertPayloadsToSignatures
  SignatureFetcher->>fetchWithRetry: run tag and referrer discovery
  fetchWithRetry->>OCIRegistry: issue retryable requests with attempt timeout
  OCIRegistry-->>fetchWithRetry: return payloads or errors
  fetchWithRetry-->>SignatureFetcher: merge and deduplicate payloads
  SignatureFetcher->>convertPayloadsToSignatures: convert signature payloads
  convertPayloadsToSignatures-->>SignatureFetcher: return storage signatures

Suggested reviewers: guzalv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding OCI 1.1 Referrers API support for discovering cosign signatures.
Description check	✅ Passed	The description covers the change, user-facing docs, testing, and validation, with only some optional checklist items left unchecked.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ROX-34488/2-referrer-discovery

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/signatures/cosign_payload_fetcher.go`:
- Around line 127-139: Update the referrer-fetch loop around fetchSigstoreBundle
to propagate bundle-fetch failures instead of logging and continuing, allowing
fetchWithRetry to retry incomplete scans. Also return the context cancellation
error when cancellation stops the scan, while preserving successful payload
accumulation and returning normally only after all descriptors are processed
successfully.

In `@pkg/signatures/cosign_sig_fetcher.go`:
- Around line 57-65: Update FetchSignatures so referrer discovery errors are
ignored whenever legacy tag discovery completes successfully, including when it
returns zero signatures. Determine path success from the absence of an error
rather than the number of signatures, and return an error only when both
discovery paths fail; preserve merging, deduplication, and unauthorized-error
handling.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 11172bbd-9fab-40ff-9c9c-6418b1d94061

📥 Commits

Reviewing files that changed from the base of the PR and between 7faa14b and 4160635.

📒 Files selected for processing (6)

pkg/images/enricher/testing_test.go
pkg/signatures/cosign_payload_fetcher.go
pkg/signatures/cosign_payload_fetcher_test.go
pkg/signatures/cosign_sig_fetcher.go
pkg/signatures/cosign_sig_fetcher_test.go
pkg/signatures/factory.go

Propagate bundle-fetch and context-cancellation errors from the referrer loop so fetchWithRetry can retry incomplete scans. Fix FetchSignatures merge logic to determine path success from absence of error rather than signature count, so referrer errors are ignored when tag discovery succeeds. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-ci · 2026-07-30T10:24:19Z

@stehessel: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp-4-22-nongroovy-e2e-tests	`be1fb7c`	link	false	`/test ocp-4-22-nongroovy-e2e-tests`
ci/prow/ocp-4-12-nongroovy-e2e-tests	`be1fb7c`	link	false	`/test ocp-4-12-nongroovy-e2e-tests`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci Bot added the do-not-merge/work-in-progress label Jul 23, 2026

stehessel added the ai-assisted label Jul 23, 2026

stehessel force-pushed the ROX-34488/2-referrer-discovery branch 2 times, most recently from 4fecac8 to ea85a49 Compare July 23, 2026 14:49

stehessel force-pushed the ROX-34488/2-referrer-discovery branch 3 times, most recently from 17ac497 to cebd12e Compare July 23, 2026 17:19

stehessel force-pushed the ROX-34488/2-referrer-discovery branch 2 times, most recently from fa3f8b2 to bd0f325 Compare July 24, 2026 08:56

stehessel marked this pull request as ready for review July 24, 2026 08:56

stehessel requested review from a team as code owners July 24, 2026 08:57

openshift-ci Bot removed the do-not-merge/work-in-progress label Jul 24, 2026

stehessel force-pushed the ROX-34488/2-referrer-discovery branch from bd0f325 to aa2e65b Compare July 24, 2026 10:00

guzalv approved these changes Jul 28, 2026

View reviewed changes

stehessel requested a review from a team as a code owner July 28, 2026 17:26

stehessel force-pushed the ROX-34488/2-referrer-discovery branch from 9492b3b to 61ae691 Compare July 28, 2026 17:26

stehessel force-pushed the ROX-34488/2-referrer-discovery branch 2 times, most recently from 563306b to 71fbcee Compare July 29, 2026 10:12

Base automatically changed from ROX-34488/1-proto-schema to master July 29, 2026 19:43

stehessel and others added 3 commits July 29, 2026 21:44

stehessel force-pushed the ROX-34488/2-referrer-discovery branch from 71fbcee to 4160635 Compare July 29, 2026 19:44

coderabbitai Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread pkg/signatures/cosign_payload_fetcher.go

Comment thread pkg/signatures/cosign_sig_fetcher.go

stehessel merged commit fe56193 into master Jul 30, 2026
103 of 107 checks passed

stehessel deleted the ROX-34488/2-referrer-discovery branch July 30, 2026 11:02

Conversation

stehessel commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Build Images Ready

Uh oh!

codecov Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

guzalv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stehessel commented Jul 29, 2026

Uh oh!

coderabbitai Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

stehessel commented Jul 23, 2026 •

edited

Loading

github-actions Bot commented Jul 23, 2026 •

edited

Loading

codecov Bot commented Jul 23, 2026 •

edited

Loading

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading