Sigstore not working properly with `transparency.enabled: manual`
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 277
- Forks
- 164
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 61
Description
Expected Behavior
With Pipeline version >= 0.49.0, and transparency.enabled: "manual" configured in Chains, when submitting a TaskRun/PipelineRun that has the chains.tekton.dev/transparency-upload: "true" annotation, Chains should upload the generated data to Rekor and populate the chains.tekton.dev/transparency annotation with the URL where the info is.
Actual Behavior
The chains.tekton.dev/transparency annotation is not added to the TaskRun/PipelineRun.
Steps to Reproduce the Problem
- Install a Pipeline version >= v0.49.0 (e.g,
kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.55.0/release.yaml) - Install Chains, and configure the feature flag
transparency.enabledtomanual - Apply the following TaskRun:
apiVersion: tekton.dev/v1
kind: TaskRun
metadata:
annotations:
chains.tekton.dev/transparency-upload: "true"
name: image-task
spec:
taskSpec:
steps:
- image: busybox
name: "step1"
script: |
echo Hello test
- After it completes, inspect it, you won't find the
chains.tekton.dev/transparencyannotation with the URL
Additional Info
- Kubernetes version: any
- Tekton Pipeline version: >= v0.49.0
This issue is blocking the upgrade of the Tekton Pipeline version used for the e2e tests.
Related issue in Pipelines: https://github.com/tektoncd/pipeline/issues/7291
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with the provided TaskRun manifest, Pipeline version v0.49.0 or later, and Chains configured with transparency.enabled: manual. Trace how the transparency-upload annotation is handled for completed TaskRuns and PipelineRuns, using the related Pipelines issue for context; done means the transparency annotation contains the Rekor URL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 43/100