fix: fix typo that caused attestation verification failure

[asraa]

Signed-off-by: Asra Ali asraa@google.com

Summary

Release Note

• bug: fixes a bug in container attestation verification with experimental mode in version 1.11.0

Documentation

Fixes #2197
See #2118

[asraa]

@cpanato this is a pretty bug behavior bug in cosign 1.11. May be worth a patch release.

@nkreiger @bobcallaway PTAL

[codecov-commenter]

Codecov Report

Merging #2199 (4fbc59a) into main (13b84a2) will not change coverage.
The diff coverage is 0.00%.

@@           Coverage Diff           @@
##             main    #2199   +/-   ##
=======================================
  Coverage   26.69%   26.69%           
=======================================
  Files         131      131           
  Lines        7690     7690           
=======================================
  Hits         2053     2053           
  Misses       5376     5376           
  Partials      261      261           

Impacted Files	Coverage Δ
pkg/cosign/tlog.go	38.55% <0.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[bobcallaway]

agreed, we should update and release this ASAP

[lcarva]

I have verified that this fixes the reproducer from #2197

[nkreiger]

looks good, my bad I'll never live that one down...

any reason why the e2e tests didn't catch it?

[cpanato]

ok, will prepare the 1.11.1 for today

[asraa]

No worries @nkreiger, it was on all of us :)

I just checked the e2e tests and it seems like there's just a SignCmd tlog test. I'll try to do a follow-up e2e test with an attestation.

[dlorenc]

Looks like there's an attestation test here:

cosign/test/e2e_test.go

Line 295 in c61504d

must(attest.AttestCmd(ctx, ko, options.RegistryOptions{}, imgName, "", "", false, attestationPath, false,

Not sure why it didn't catch this... Is it only for tlog cases?

[dlorenc]

Ah - I get it now. That used to be the same code path (same HashedRekord type stored in rekor for both versions), now it's separate so we're missing the verification test for the new code path.

[asraa]

Looks like there's an attestation test here:

Hmm I think attestverify is never called with tlog explicit enabled in the tests.

[dlorenc]

Hmm I think attestverify is never called with tlog explicit enabled in the tests.

Yep - we have sign/verify with and without tlog, and attest/verify without tlog. The tlog part used to be shared code, but is separated now.