Hi @mtrmac , I’ve created this draft PR for the policy.json API change, could you take a look and provide your initial thoughts on the structure of the API update?
I just want to make sure I’m on the right path before proceeding further. My plan is to merge both the API and code support in a single PR. What do you think?

@mtrmac Could you please take a look? It's ready for review. I am unsure about how I’m handling the intermediate certificates.

Cc: @Honny1 as well — c/image/signature is a somewhat separate part of the codebase, and as security-critical with a lot of paranoia. Worth understanding the structure and idioms.

@mtrmac Do you think the PKI code needs a file like fulcio_cert_stub.go and should include build tags? I'm not fully clear on the purpose of this compile configuration.

The signature/*_stub.go files were added in #2180 , to avoid dependencies on sigstore Go modules not packaged (at the time??) in Debian.

Here, the only similar dependency seems to be github.com/sigstore/sigstore/pkg/cryptoutils, which is also required by no-stubbed policy_eval_sigstore.go; so this shouldn’t need a stub.

Combining the policy-provided and signature-provided intermediate certificates makes sense to me, but I’ll at least check what Cosign does.

I checked some cosign code, maybe I got lost in the code path, I did see it process the signature-provided intermediate certificates 🤔

• https://github.com/sigstore/cosign/blob/ad478088320a3c04a96b3c183bbde2205fff7bbb/cmd/cosign/cli/verify/verify.go#L248
• https://github.com/sigstore/cosign/blob/main/pkg/cosign/verify.go#L223
• https://github.com/sigstore/cosign/blob/ad478088320a3c04a96b3c183bbde2205fff7bbb/pkg/cosign/verify.go#L1332

@mtrmac could you review?

@containers/image-maintainers can we get this merged?

@mtrmac Could you review this PR?

Rebased with the base branch.

OCPNODE-2338

now tracked in RUN-2436

Rebased with the base branch.

@QiWang19 could you rebase it again? (Maybe this would help to get this merged 😄 )

@mtrmac PTAL

As noted elsewhere, this is approved for RHEL 9.6/10.0 if this is merged and then backported into the c/image release-5.34 branch on or before Friday, February 28, 2024.

The Jira cards for this work are:
https://issues.redhat.com/browse/RHEL-79695 - RHEL 10
https://issues.redhat.com/browse/RHEL-79694 - RHEL 9.6

rebased with the latest branch

OCPNODE-2338

^^ replaced with RUN-2436

@mtrmac @QiWang19 really great that this is going to be released - thanks so much for pushing this on!

Have a question regarding the support for timestamping authority CA Roots but will add it to containers/container-libs#214.

if this is merged and then backported into the c/image release-5.34 branch on or before Friday, February 28, 2024.

@TomSweeneyRedHat I have filed #2725 for the backport.

Also, containers/container-libs#190 can track adding the corresponding signing code. After that, no new options should be necessary in Skopeo/Podman, just updating c/image.

@QiWang19 v5.34.1 release just dropped on c/image, FYI, and Happy Fri-YAY!

@TomSweeneyRedHat @mtrmac Thanks!