feat(notation): Add TSA truststore support to notation policy (#4168)

* feat(notation): Add TSA truststore support to notation policy

Signed-off-by: Felix Rubio <felix@kngnt.org>

* fix(notation): Fixed readme to reflect implementation for TSA config.

Signed-off-by: Felix Rubio <felix@kngnt.org>

* fix(notation): Restored verityTimestamp value to prevent failing for non-timestamped but valid certificates.

Signed-off-by: Felix Rubio <felix@kngnt.org>

* fix(notation): Fixed indentation.

Signed-off-by: Felix Rubio <felix@kngnt.org>

* fix(notation): Rebased and actioned review comments.

Signed-off-by: Felix Rubio <felix@kngnt.org>

---------

Signed-off-by: Felix Rubio <felix@kngnt.org>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: flixman

pkg/extensions/README_imagetrust.md

@@ -149,13 +149,16 @@ The information above will be included in the ManifestSummary objects returned b
                     "name": "default-config",
                     "registryScopes": [ "*" ],
                     "signatureVerification": {
-                        "level" : "strict" 
+                        "level": "strict",
+                        "verifyTimestamp": "afterCertExpiry"
                     },
-                    "trustStores": ["ca:default","signingAuthority:default"],
+                    "trustStores": ["ca:default","signingAuthority:default","tsa:default"],
                     "trustedIdentities": [
                         "*"
                     ]
                 }
             ]
         }
         ```
+
+        The default trust policy includes all supported notation truststore types, including CA, signing authority, and TSA stores.

pkg/extensions/imagetrust/image_trust_test.go

@@ -102,6 +102,39 @@ func TestInitCosignAndNotationDirs(t *testing.T) {
 		So(err, ShouldEqual, zerr.ErrSignConfigDirNotSet)
 	})
 
+	Convey("InitTrustpolicy includes TSA store", t, func() {
+		dir := t.TempDir()
+
+		certStorage, err := imagetrust.NewCertificateLocalStorage(dir)
+		So(err, ShouldBeNil)
+
+		notationDir, err := certStorage.GetNotationDirPath()
+		So(err, ShouldBeNil)
+
+		_, err = os.Stat(path.Join(notationDir, "truststore/x509/tsa/default"))
+		So(err, ShouldBeNil)
+
+		trustPolicyBytes, err := os.ReadFile(path.Join(notationDir, "trustpolicy.json"))
+		So(err, ShouldBeNil)
+
+		trustPolicyDoc := struct {
+			TrustPolicies []struct {
+				TrustStores           []string `json:"trustStores"`
+				SignatureVerification struct {
+					VerifyTimestamp string `json:"verifyTimestamp"`
+				} `json:"signatureVerification"`
+			} `json:"trustPolicies"`
+		}{}
+
+		err = json.Unmarshal(trustPolicyBytes, &trustPolicyDoc)
+		So(err, ShouldBeNil)
+		So(trustPolicyDoc.TrustPolicies, ShouldNotBeEmpty)
+		So(trustPolicyDoc.TrustPolicies[0].TrustStores, ShouldContain, "ca:default")
+		So(trustPolicyDoc.TrustPolicies[0].TrustStores, ShouldContain, "signingAuthority:default")
+		So(trustPolicyDoc.TrustPolicies[0].TrustStores, ShouldContain, "tsa:default")
+		So(trustPolicyDoc.TrustPolicies[0].SignatureVerification.VerifyTimestamp, ShouldEqual, "afterCertExpiry")
+	})
+
 	Convey("UploadCertificate - notationDir is not set", t, func() {
 		rootDir := t.TempDir()
 

pkg/extensions/imagetrust/notation.go

@@ -78,20 +78,11 @@ func NewCertificateLocalStorage(rootDir string) (*CertificateLocalStorage, error
 	}
 
 	for _, truststoreType := range truststore.Types {
-		if truststoreType != truststore.TypeTSA {
-			defaultTruststore := path.Join(dir, "truststore", "x509", string(truststoreType), truststoreName)
-
-			_, err = os.Stat(defaultTruststore)
-			if os.IsNotExist(err) {
-				err = os.MkdirAll(defaultTruststore, defaultDirPerms)
-				if err != nil {
-					return nil, err
-				}
-			}
+		defaultTruststore := path.Join(dir, "truststore", "x509", string(truststoreType), truststoreName)
 
-			if err != nil {
-				return nil, err
-			}
+		err = os.MkdirAll(defaultTruststore, defaultDirPerms)
+		if err != nil {
+			return nil, err
 		}
 	}
 
@@ -118,9 +109,7 @@ func InitTrustpolicyFile(notationStorage certificateStorage) error {
 	truststores := []string{}
 
 	for _, truststoreType := range truststore.Types {
-		if truststoreType != truststore.TypeTSA {
-			truststores = append(truststores, fmt.Sprintf("\"%s:%s\"", string(truststoreType), truststoreName))
-		}
+		truststores = append(truststores, fmt.Sprintf("\"%s:%s\"", string(truststoreType), truststoreName))
 	}
 
 	defaultTruststores := strings.Join(truststores, ",")
@@ -140,7 +129,8 @@ func InitTrustpolicyFile(notationStorage certificateStorage) error {
 			"name": "default-config",
 			"registryScopes": [ "*" ],
 			"signatureVerification": {
-				"level" : "strict" 
+				"level": "strict",
+				"verifyTimestamp": "afterCertExpiry"
 			},
 			"trustStores": [` + defaultTruststores + `],
 			"trustedIdentities": [