opendefensecloud / solution-arsenal / 34128072801

80%

Build Type

push

github

Committed by web-flow

Commit Message

feat(renderer): sign rendered artifacts with cosign (#779)

## What
<!-- One sentence summary -->
Closes #687 

`solar-renderer` now signs the OCI artifact it just pushed, using cosign

## Why
To verify rendered artifacts on the target cluster. (this is part of
that effort, not the complete implementation)

## Testing
- `make test`: new tests in pkg/renderer and cmd/solar-renderer
- `make test-e2e`: five new specs, signature verification via cosign cli
tool

## Notes for reviewers
- **API change**: `RendererConfig.signing` (optional pointer,
`keyPath`). Backwards compatible and optional — `nil` is exactly today's
behaviour.

## Checklist
- [x] Tests added/updated
- [x] No breaking changes (or upgrade path documented above)
- [x] Readable commit history (squashed and cleaned up as desired)
- [x] AI code review considered and comments resolved


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Added optional Cosign signing for rendered and pushed artifacts.
* Added private-key configuration with password support through
`COSIGN_PASSWORD`.
* Existing artifacts are skipped only when a matching valid signature is
present.
* Invalid, missing, or mismatched signatures are detected and reported.

* **Documentation**
* Documented signing configuration and key requirements in the API
reference.

* **Tests**
* Added coverage for signing, verification, key errors, duplicate
signatures, and unsigned artifacts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Coverage Stats

123 of 168 new or added lines in 2 files covered. (73.21%)

4 existing lines in 2 files now uncovered.

5644 of 7047 relevant lines covered (80.09%)

48.6 hits per line