Bug 1461324 - Log image changes on verify-image-signature without --save

[wozniakjan]

https://bugzilla.redhat.com/show_bug.cgi?id=1461324

[bparees]

@wozniakjan maybe it would be worth updating the image signature docs to warn people about this behavior?

https://docs.openshift.org/latest/admin_guide/image_signatures.html#verifying-image-signatures-using-openshift-cli

[wozniakjan]

@bparees it actually says it, roughly in the middle of that page

"Using the --save flag on already verified image together with invalid GPG key or invalid expected identity causes the saved verification status to be removed, and the image will become unverified."

which is similar to the information the oc command gives us

origin/pkg/oc/admin/image/verify-signature.go

Lines 45 to 47 in 5e0bfba

	Note that using the "--save" flag on already verified image together with invalid GPG
	key or invalid expected identity will cause the saved verification status to be removed
	and the image will become "unverified".

@bmcelvee do you think maybe a red exclamation mark would be appropriate here? https://github.com/openshift/openshift-docs/blob/master/admin_guide/image_signatures.adoc

[bparees]

"Using the --save flag on already verified image together with invalid GPG key or invalid expected identity causes the saved verification status to be removed, and the image will become unverified."

@wozniakjan that's not the same as removing the (unverified) signatures which is what happens, right?

[bmcelvee]

@wozniakjan I agree, it really couldn't hurt to call that line out in an "important" box. As is it's easy for a reader to gloss over it and run into trouble. I can open a docs PR now, or wait to see if additional docs updates are required for this PR.

[wozniakjan]

@wozniakjan that's not the same as removing the (unverified) signatures which is what happens, right?

That may very well be. I read the code first and then tried to see if I can find corresponding information in docs and probably made an assumption a little to early. I don't think the code discriminates between verified/unverified signature, it removes all signatures if expected-identity does not match.

origin/pkg/oc/admin/image/verify-signature.go

Lines 211 to 218 in 5e0bfba

	for i, s := range img.Signatures {
	// Verify the signature against the policy
	signedBy, err := o.verifySignature(pc, img, s.Content)
	if err != nil {
	fmt.Fprintf(o.ErrOut, "error verifying signature %s for image %s (verification status will be removed): %v\n", img.Signatures[i].Name, o.InputImage, err)
	img.Signatures[i] = imageapi.ImageSignature{}
	continue
	}

@wozniakjan I agree, it really couldn't hurt to call that line out in an "important" box. As is it's easy for a reader to gloss over it and run into trouble. I can open a docs PR now, or wait to see if additional docs updates are required for this PR.

@bmcelvee PR emphasizing the information in "important" box would be great I think, maybe also explicitly stating ...saved verified status with all previous signatures to be removed... instead of original ...saved verification status to be removed...

[bparees]

@wozniakjan is this still WIP?

[wozniakjan]

@bparees thanks for the reminder, removing the WIP. Wasn't entirely sure whether docs update or more verbose logging, and in the end, both might complement each other well

[bparees]

@bparees thanks for the reminder, removing the WIP. Wasn't entirely sure whether docs update or more verbose logging, and in the end, both might complement each other well

yeah i think both are good.

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bparees, wozniakjan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/oc/OWNERS [bparees]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bparees]

/retest

[openshift-bot]

/retest

Please review the full test history for this PR and help us cut down flakes.

[openshift-bot]

/retest

Please review the full test history for this PR and help us cut down flakes.

[openshift-bot]

/retest

Please review the full test history for this PR and help us cut down flakes.