When using cosign for keyless signing, the flow that happens is as such:

  1. The user runs cosign sign to sign an artifact
  2. Cosign redirects the user for a OpenID Connect flow to log in via a OIDC provider and bring a code
  3. The user enters the code to cosign
  4. Cosign retrieves a JWT from the OIDC provider.
  5. Cosign generates a private/public key-pair in memory
  6. Cosign requests a short-lived certificate from Fulcio, passing: The public key and the JWT.
  7. Fulcio generates and signs a short-lived certificate with the email of the user as the Subject Alternative Name
  8. Cosign records the signing event in Rekor.

Now when a verifier comes to verify the signature, it goes through the following process: The verifier has the following inputs:

  1. The artifact
  2. The certificate
  3. The signature

Now the verifier does the following process

  1. Run the digest algorithm on the artifact. (sha1, sha-256, etc.)
  2. Take the public key from the certificate and verify the signature
  3. Verify the certificate

Now, the "problem" is that by the time of verification, the certificate is no longer valid. That's where Rekor comes into play. The last step in the verification process is:

  1. Head to Rekor to verify that the signing event took place in a time that the certificate was valid (Before the Valid Before and after the Valid After).

The question

I can understand why recording in Rekor is important with keyless signing (and hence - using a certificate). We want to make sure that the signing was made when the certificate was valid.

But when signing with only a key pair - no certificate - cosign still wants to record the event in Rekor. And my question is - what is the point in that?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.