trusted_task_rules: Add per-allow-rule signature verification#1680
Open
arewm wants to merge 1 commit intoconforma:mainfrom
Open
trusted_task_rules: Add per-allow-rule signature verification#1680arewm wants to merge 1 commit intoconforma:mainfrom
arewm wants to merge 1 commit intoconforma:mainfrom
Conversation
Add optional `signature_verification` configuration to allow rules in trusted_task_rules, enabling sigstore-based signature verification as an additional trust dimension for task bundles. When an allow rule includes `signature_verification`, matching bundles must also pass sigstore verification with the configured identity/key. Rules without the field continue to work as before (pattern-only trust). Git-resolved tasks are exempt since ec.sigstore.verify_image only works on OCI refs. A new denial reason type `signature_verification_failed` is surfaced when a task matches an allow rule's pattern/version constraints but fails signature verification. Ref: EC-1545 Assisted-by: Claude Code (Opus 4.6)
Codecov Report✅ All modified and coverable lines are covered by tests.
🚀 New features to boost your workflow:
|
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
signature_verificationconfig to allow rules intrusted_task_rulesfor sigstore-based bundle signature verificationsignature_verification_faileddenial reason type with proper error formattingTest plan
make cipasses (749/749 tests, 100% coverage)Ref: EC-1545
🤖 Generated with Claude Code