Skip to content

Make the trust-store sidecar guard reachable, format-aware and testable - #160

Open
stevebeattie wants to merge 3 commits into
chainguard-dev:mainfrom
stevebeattie:fix-stamp-guard
Open

Make the trust-store sidecar guard reachable, format-aware and testable#160
stevebeattie wants to merge 3 commits into
chainguard-dev:mainfrom
stevebeattie:fix-stamp-guard

Document covering the /kaniko criteria locally

207e834
Select commit
Loading
Failed to load commit list.
Chainguard Guardener / Enforce - Commit Signing succeeded Aug 21, 2026 in 0s

Successfully verified commit signature.

CLAIM DESCRIPTION
Found Git signature
Validated Git signature
Validated Rekor entry
Allowed by policy

Details

Certificate

Details
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 391956926136762379264185968154844464731214156118 (0x44a7f4d9193cab02a58ba2bb21e7e010c1859156)
    Signature Algorithm: ECDSA-SHA384
        Issuer: O=sigstore.dev,CN=sigstore-intermediate
        Validity
            Not Before: Aug 21 21:27:19 2026 UTC
            Not After : Aug 21 21:37:19 2026 UTC
        Subject:         Subject Public Key Info:
            Public Key Algorithm: ECDSA
                Public-Key: (256 bit)
                X:
                    62:4b:3a:23:ad:35:ef:f8:df:07:c8:10:47:7a:32:
                    87:79:ff:f0:3a:7e:63:d0:49:91:08:04:4c:3e:ef:
                    87:fe
                Y:
                    64:4f:b2:8e:89:7f:1e:41:c0:ad:08:08:01:f8:23:
                    58:36:65:1d:62:e6:29:44:06:74:e9:b8:b3:12:b9:
                    aa:89
                Curve: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Subject Key Identifier:
                DF:DF:8F:55:7B:A0:47:41:13:BF:81:0A:B0:AE:92:D1:6F:A1:0B:94
            X509v3 Authority Key Identifier:
                keyid:DF:D3:E9:CF:56:24:11:96:F9:A8:D8:E9:28:55:A2:C6:2E:18:64:3F
            X509v3 Subject Alternative Name: critical
                email:steve.beattie@chainguard.dev
            oidcIssuer:
                https://accounts.google.com
            Unknown extension 1.3.6.1.4.1.57264.1.8
            Unknown extension 1.3.6.1.4.1.57264.1.24
            Signed Certificate Timestamp:
                BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoCY4nCoAAAQDAEYwRAIgRdxXMcj6V3P0bxcd95yYkYOd+OksEpf5QFPXdCsz83UCIGPp1uefOCdoXoKZWXbUsW5Uf3MBIYulDSooQqGsRpsS

    Signature Algorithm: ECDSA-SHA384
         30:65:02:31:00:bd:f5:36:d3:5c:40:d4:95:3d:cb:96:1d:06:
         d7:4b:41:9b:76:13:71:2e:e0:98:2e:bb:bd:54:63:ad:f4:8f:
         8e:88:3b:71:49:3f:ee:b4:94:3a:ab:40:f9:62:57:0c:fd:02:
         30:42:c7:ac:85:bc:aa:7d:9d:88:9e:63:3b:6a:e7:25:f8:86:
         85:6e:76:cc:62:35:bc:91:1a:d9:37:be:3a:b3:b3:81:b6:4c:
         e6:44:f4:35:31:76:69:83:e5:d0:81:8f:7c

Rekor Entry

Details
{
  "body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIwYzZjYWEyZjM0NmQzMTljYzc2NjJkYmVhMTAxOWU1MmIzYWIyZDE5NDJmMzVlZDYxMzcwY2U5MTM4ZmE3YzhjIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUNiSXprTG5EeTRId2Evb1VOVlJQOW56bXhKbnJtcHpUckdKVTV1QmlxUEx3SWhBSkVjc1BxeFRBdGEyYUpmV296clNIcXNzQldMNmIwbkhubVJCdzdpUUhvRiIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUk5WRU5EUVhKbFowRjNTVUpCWjBsVlVrdG1NREpTYXpoeGQwdHNhVFpMTjBsbFptZEZUVWRHYTFaWmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlFU1hoTmFrVjVUbnBGTlZkb1kwNU5hbGwzVDBSSmVFMXFSWHBPZWtVMVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZaYTNNMlNUWXdNVGN2YW1aQ09HZFJVak52ZVdnemJpODRSSEFyV1RsQ1NtdFJaMFVLVkVRM2RtZ3ZOV3RVTjB0UGFWZzRaVkZqUTNSRFFXZENLME5PV1U1dFZXUlpkVmx3VWtGYU1EWmlhWHBGY20xeGFXRlBRMEZrV1hkblowaFRUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlV6T1N0UUNsWllkV2RTTUVWVWRqUkZTM05MTmxNd1Z5dG9RelZSZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDB0bldVUldVakJTUVZGSUwwSkRRWGRJYjBWall6TlNiR1J0VlhWWmJWWm9aRWhTY0ZwVlFtcGhSMFp3WW0xa01WbFlTbXRNYlZKc1pHcEJjQXBDWjI5eVFtZEZSVUZaVHk5TlFVVkNRa0owYjJSSVVuZGplbTkyVERKR2Fsa3lPVEZpYmxKNlRHMWtkbUl5WkhOYVV6VnFZakl3ZDB0M1dVdExkMWxDQ2tKQlIwUjJla0ZDUTBGUlpFUkNkRzlrU0ZKM1kzcHZka3d5Um1wWk1qa3hZbTVTZWt4dFpIWmlNbVJ6V2xNMWFtSXlNSGRYZDFsTFMzZFpRa0pCUjBRS2RucEJRa2RCVWs1RVJYUkVZVVpXTkZSVlVuSmxhemxWVTFod1VGWkdhM2hVYm5CR1RrVTFWVlZVUWs1V1IwMTVWRlpTUmxVd1ozbGhSRUpyVTBWS05ncFVNbXhXWlZaS2NGWlliRk5pVlZweFYxUkpOVTFYU25WVmJuQk5ZbGRTTWxscVNtdGpNWEJVVGxkd2FVMXFRWGRuV1d0SFEybHpSMEZSVVVJeGJtdERDa0pCU1VWbGQxSTFRVWhqUVdSUlJHUlFWRUp4ZUhOalVrMXRUVnBJYUhsYVducGpRMjlyY0dWMVRqUTRjbVlyU0dsdVMwRk1lVzUxYW1kQlFVRmhRVzBLVDBwM2NVRkJRVVZCZDBKSFRVVlJRMGxGV0dOV2VraEpLMnhrZWpsSE9GaElabVZqYlVwSFJHNW1hbkJNUWt0WUsxVkNWREV6VVhKTkwwNHhRV2xDYWdvMlpHSnVibnBuYm1GR05rTnRWbXd5TVV4R2RWWklPWHBCVTBkTWNGRXdjVXRGUzJoeVJXRmlSV3BCUzBKblozRm9hMnBQVUZGUlJFRjNUbTlCUkVKc0NrRnFSVUYyWmxVeU1ERjRRVEZLVlRsNU5WbGtRblJrVEZGYWRESkZNMFYxTkVwbmRYVTNNVlZaTmpNd2FqUTJTVTh6UmtwUUt6WXdiRVJ4Y2xGUWJHa0tWbmQ2T1VGcVFrTjRObmxHZGt0d09XNVphV1ZaZW5SeE5YbFlOR2h2Vm5Wa2MzaHBUbUo1VWtkMGF6TjJhbkY2Y3pSSE1sUlBXa1U1UkZWNFpHMXRSQW8xWkVOQ2FqTjNQUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In19fX0=",
  "integratedTime": 1787347639,
  "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",
  "logIndex": 2553814289,
  "verification": {
    "inclusionProof": {
      "checkpoint": "rekor.sigstore.dev - 1193050959916656506\n2433648194\nte22oMujhGAhm5h//6RSYTr2sWpqHpZIbTY9yqMe7qU=\n\n— rekor.sigstore.dev wNI9ajBFAiAR/Eikp4Cm+99VwYH+3KFx10J7Sg1PSASy+TAmkg3mzQIhANKkfnbTYwqxWzML4gsFihxsLT9DP4JtCnJabYa7R1KL\n",
      "hashes": [
        "ed43bfa23de910c615ab3bea39d3380377501cb4a56d5417aa5539d51b7fa114",
        "f2b777ef5126f42656d60cf4f46bba57d290ba3a7437b20d7333012929db58e3",
        "1d38433708a0c2174193d323eeb7c2e0b79f1812cbf810916ff218167b1b51a6",
        "b7c8c1b51211cf6feecdd131e0567b95fdf75957c817d403f37164dc1179b41a",
        "b2573fa3ce6c4e7384fe4193aa72d921a1d9c472ecee290add42c9f5a9935252",
        "faf277db98ad982e50783066679d216106625dadbb993320e2aa601ed045e401",
        "e379b9e380f049ce8777b88256dcf893af3bf2a64d5fd72b35a094d56f2c21df",
        "aefd4aa27162a6a58d92527f2fdf3095a12ca74c33b9d0cf5e502dbbbadf7959",
        "9670a2256c147940dc12e48c39ff62d719bd76da9c00dbd240c416ae7f055b2c",
        "9bff25138a673d8899e4322af5ac5a781c02c5e336ac98d481c5f343974e4931",
        "4fa6b0084594201c20390531248a1a405ffb6667ac390cf9bca481f89d6faf7c",
        "166d056a0e364745a37aa1de38881e3557ea6697ef399b693054596b15d70989",
        "60b75655d796dbc033425a756e6138c757ffdb0c635e307a44104cc2719ebcef",
        "84bf3db6986ccddaee5a91e3a767ff73361742d89c403b0cef1a128d16f2cc68",
        "8f4c25733d94a52c7c050467dd5dd0ba99ef1b8dbe6fa8ace56cf3dbc5456e2e",
        "9ebfbaa8e6d578f8c1881b2c5501a45f7336e5ae941d122c7a99f40b3dacf628",
        "9a11d79f556b43cebfffb26bf64c73112574868c37216c5c589924465afe758f",
        "5d7c5439905d34b1f583196c16c0862cda84fcfff933f8c72b533efcc1c34ccd",
        "eec41d96d971e63690b71641cd353ca6129c6f758ff78e2e009e41545b271660",
        "5cb7ff816b2ded08f3f5ad1700e08a7adc9348a689c05ae0efaa656c3c3f516d",
        "ea9a24def72efc9dfab9a9fe9a356362078317c6a877de28fe1e9f8ea42f94c0",
        "576e82fd96e0441d37ee4e08ca998d5da4b600a100abe998741a4263350765a2",
        "f79ef73d90cda155676a5546fb8069255aca1059de030a872e955d3847db1346",
        "461450244f20abd5e357e14963f38787a6610a74ba20dbea3712fd332a1b5f9e",
        "d30720fdc7d164d0e5b10ea1b69c1963ff40cdcabea8e05f1e9ad2739a900f14",
        "4a775b30a56d7137a7024c22d8905f1b30fe9a17b1a75a896d1218f80d494485",
        "c47fc30ac78b1ebf5e2a8613f2ab0e4592bbcd5744198587b95b6c56b0fde706"
      ],
      "logIndex": 2431910027,
      "rootHash": "b5edb6a0cba38460219b987fffa452613af6b16a6a1e96486d363dcaa31eeea5",
      "treeSize": 2433648194
    },
    "signedEntryTimestamp": "MEUCIQCVh6Pmo5FkFq2FUsKNdnCFfVy4AXF5/I87L8vW9S8/AgIgKDTm80P+dVMPFxQH9fUFKuK0EhvyFilB1dbVKHPYIds="
  }
}