deploy-from-self if skopeo < 1.22.2

pkg/daemon/rpm-ostree.go

@@ -296,27 +296,48 @@ func (r *RpmOstreeClient) patchPoliciesForContainerStorage(podmanImageInfo *Podm
 		return err
 	}
 
-	policy, err := signature.NewPolicyFromBytes(policyOriginalContent)
-	if err != nil {
-		return err
-	}
+	var policy *signature.Policy
+
+	// Skopeo (< 1.22.2) fails on multi-arch manifest-lists Sigstore verification , overrides
+	// policy to avoid "A signature was required, but no signature exists" errors during
+	// rpm-ostree rebase operations on older boot images.
+	// See https://issues.redhat.com/browse/OCPBUGS-81187 for details.
+	if !skopeoSupportsMultiArchSigstore() {
+		klog.Infof("skopeo does not support multi-arch Sigstore, using fully permissive policy for rpm-ostree")
+		policy = &signature.Policy{
+			Default: signature.PolicyRequirements{signature.NewPRInsecureAcceptAnything()},
+			Transports: map[string]signature.PolicyTransportScopes{
+				"docker": {
+					"": signature.PolicyRequirements{signature.NewPRInsecureAcceptAnything()},
+				},
+				imagePolicyTransportContainerStorage: {
+					"": signature.PolicyRequirements{signature.NewPRInsecureAcceptAnything()},
+				},
+			},
+		}
+	} else {
+		policy, err = signature.NewPolicyFromBytes(policyOriginalContent)
+		if err != nil {
+			return err
+		}
 
-	_, containerStoragePoliciesPresent := policy.Transports[imagePolicyTransportContainerStorage]
-	if (reflect.DeepEqual(policy.Default[0], signature.PolicyRequirements{signature.NewPRInsecureAcceptAnything()}) && !containerStoragePoliciesPresent) {
-		// Temporary patching the policies.json file can be skipped, with warranties, and without re-implementing the
-		// logic that evaluates the policies or importing it under the following circumstances (must match all):
-		//  1. The default policy should be "insecureAcceptAnything"
-		//  2. Transport-specific policies for containers-storage shouldn't be in place.
-		return nil
-	}
+		_, containerStoragePoliciesPresent := policy.Transports[imagePolicyTransportContainerStorage]
+		if (reflect.DeepEqual(policy.Default[0], signature.PolicyRequirements{signature.NewPRInsecureAcceptAnything()}) && !containerStoragePoliciesPresent) {
+			// Temporary patching the policies.json file can be skipped, with warranties, and without re-implementing the
+			// logic that evaluates the policies or importing it under the following circumstances (must match all):
+			//  1. The default policy should be "insecureAcceptAnything"
+			//  2. Transport-specific policies for containers-storage shouldn't be in place.
+			return nil
+		}
 
-	// At this point there's no warranty the policy will allow rpm-ostree to fetch the image
-	// from local storage -> Add a specific rule to allow the image
-	if !containerStoragePoliciesPresent {
-		policy.Transports[imagePolicyTransportContainerStorage] = make(map[string]signature.PolicyRequirements)
-	}
-	policy.Transports[imagePolicyTransportContainerStorage][url] = signature.PolicyRequirements{
-		signature.NewPRInsecureAcceptAnything(),
+		// At this point there's no warranty the policy will allow rpm-ostree to fetch the image
+		// from local storage -> Add a specific rule to allow the image
+		if !containerStoragePoliciesPresent {
+			policy.Transports[imagePolicyTransportContainerStorage] = make(map[string]signature.PolicyRequirements)
+		}
+		policy.Transports[imagePolicyTransportContainerStorage][url] = signature.PolicyRequirements{
+			signature.NewPRInsecureAcceptAnything(),
+		}
 	}
 
 	// Prepare the json patched content

pkg/daemon/update.go

@@ -2909,35 +2909,83 @@ func runCmdSync(cmdName string, args ...string) error {
 	return nil
 }
 
+const (
+	// minPodmanVersionForSigstore is the minimum podman version that supports Sigstore verification
+	// https://issues.redhat.com/browse/OCPBUGS-38809
+	minPodmanVersionForSigstore = "4.4.1"
+	// minSkopeoVersionForMultiArchSigstore is the minimum skopeo version that supports multi-arch Sigstore verification
+	// https://issues.redhat.com/browse/OCPBUGS-81187
+	minSkopeoVersionForMultiArchSigstore = "1.22.2"
+)
+
 var (
 	podmanSigstoreSupported      sync.Once
 	podmanSigstoreSupportedValue bool
 )
 
 func podmanSupportsSigstore() bool {
 	podmanSigstoreSupported.Do(func() {
-		// https://issues.redhat.com/browse/OCPBUGS-38809 failed for base image 4.11 or older, OCP 4.12 is with podman 4.4.1
-		// returns false if podman version is less than 4.4.1
 		cmd := exec.Command("podman", "version", "-f", "{{.APIVersion}}")
 		out, err := cmd.CombinedOutput()
 		if err != nil {
 			klog.Errorf("failed to run podman version: %v", err)
 			podmanSigstoreSupportedValue = false
 			return
 		}
-		sigstorePodman := "4.4.1"
-		// Example version format: 5.3.0-rc1
 		imgPodmanVersion, err := semver.NewVersion(strings.TrimSpace(string(out)))
 		if err != nil {
 			klog.Errorf("failed to parse podman version: %v", err)
 			podmanSigstoreSupportedValue = false
 			return
 		}
-		podmanSigstoreSupportedValue = imgPodmanVersion.Compare(*semver.New(sigstorePodman)) >= 0
+		podmanSigstoreSupportedValue = imgPodmanVersion.Compare(*semver.New(minPodmanVersionForSigstore)) >= 0
 	})
 	return podmanSigstoreSupportedValue
 }
 
+var (
+	skopeoMultiArchSigstoreSupported      sync.Once
+	skopeoMultiArchSigstoreSupportedValue bool
+)
+
+func skopeoSupportsMultiArchSigstore() bool {
+	skopeoMultiArchSigstoreSupported.Do(func() {
+		// Multi-arch Sigstore verification requires skopeo >= 1.22.2.
+		// Older boot images will fail with "A signature was required, but no signature exists"
+		// when rpm-ostree attempts to pull multi-arch images with Sigstore enforcement.
+		cmd := exec.Command("skopeo", "--version")
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			klog.Errorf("failed to run skopeo --version: %v", err)
+			skopeoMultiArchSigstoreSupportedValue = false
+			return
+		}
+		// Example output: "skopeo version 1.21.0-dev commit: d8be59c1ecc5c1860b7bab4f60721d55da2cda9a"
+		outStr := strings.TrimSpace(string(out))
+		fields := strings.Fields(outStr)
+		if len(fields) < 3 {
+			klog.Errorf("failed to parse skopeo version output: %s", outStr)
+			skopeoMultiArchSigstoreSupportedValue = false
+			return
+		}
+
+		versionStr := fields[2]
+		if dashIdx := strings.Index(versionStr, "-"); dashIdx != -1 {
+			versionStr = versionStr[:dashIdx]
+		}
+
+		skopeoVersion, err := semver.NewVersion(versionStr)
+		if err != nil {
+			klog.Errorf("failed to parse skopeo version %s: %v", versionStr, err)
+			skopeoMultiArchSigstoreSupportedValue = false
+			return
+		}
+		skopeoMultiArchSigstoreSupportedValue = skopeoVersion.Compare(*semver.New(minSkopeoVersionForMultiArchSigstore)) >= 0
+		klog.Infof("skopeo version %s, multi-arch Sigstore support: %v", versionStr, skopeoMultiArchSigstoreSupportedValue)
+	})
+	return skopeoMultiArchSigstoreSupportedValue
+}
+
 // Log a message to the systemd journal as well as our stdout
 func logSystem(format string, a ...interface{}) {
 	message := fmt.Sprintf(format, a...)