code-sandboxes 1.9.10__tar.gz → 1.9.11__tar.gz

{code_sandboxes-1.9.10 → code_sandboxes-1.9.11}/CHANGELOG.md

@@ -8,6 +8,24 @@
 
 ## Unreleased
 
+## 1.9.11
+
+- **1.9.10's own fix did not work: `--registry-referrers-mode` only ever
+  governs *reading* referrers, never where `sign` writes one** —
+  `sign --help` says so outright ("mode for fetching references"), and a
+  second live sign on r1, 2026-09-14, confirmed it: the signature still
+  landed as an OCI 1.1 referrer, no legacy tag. `Attestor` no longer tries
+  to force cosign's own storage choice. Its replay check and its own
+  `signature_ref` now ask cosign directly, the same way the Operator's own
+  verify will: `can_verify(reference)` runs `cosign verify --key <key>
+  --insecure-ignore-tlog=true <reference>` and answers its exit code, and
+  `signature_ref` is the digest reference itself — what `cosign verify`
+  takes, not a tag it may or may not have written. Signing the same digest
+  twice no longer errors the way a second push under the old immutable tag
+  once would have, but `can_verify` still avoids it, since two valid
+  signatures claiming to be Datalayer's own word on one artifact is not
+  the design either.
+
 ## 1.9.10
 
 - **cosign signs the legacy tag again, not just an OCI referrer**

{code_sandboxes-1.9.10 → code_sandboxes-1.9.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.10
+Version: 1.9.11
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.10 → code_sandboxes-1.9.11}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.10"
+__version__ = "1.9.11"

{code_sandboxes-1.9.10 → code_sandboxes-1.9.11}/code_sandboxes/environments/attest.py

@@ -403,17 +403,28 @@ class Attestor:
     def sign(self, *, registry: str, repository: str, digest: str) -> tuple[str, bool]:
         """Sign the digest with the KMS key, unless it is signed already (E1-09).
 
-        Answers the signature's reference and whether this call made it. A
-        replay finds the existing signature: pushing a second one under the
-        same tag is what immutable tags refuse, and it would be a second thing
-        claiming to be Datalayer's word on the same artifact.
+        Answers the signature's own reference — the digest itself, which is
+        what `cosign verify --key <key>` takes, resolving the signature's
+        real location on its own — and whether this call made it.
+
+        A replay finds the existing signature by asking cosign whether *this*
+        key has already signed it, the same check the Operator itself will
+        make before starting a pod (`can_verify`): cosign 3.1.3 stores a
+        signature as an OCI 1.1 referrer, not the classic `sha256-<hex>.sig`
+        sidecar tag a first version of this method assumed (found live,
+        2026-09-14, twice — `--registry-referrers-mode` only ever governed
+        *reading* referrers, never where `sign` writes one, so it changed
+        nothing the first time either). Signing twice would not error the way
+        it would have under the old tag (an OCI referrer is not an immutable
+        tag to collide with), but it would leave two things claiming to be
+        Datalayer's word on the same artifact, which `can_verify` first
+        avoids.
         """
         self.can_sign()
-        tag = signature_tag(digest)
         reference = f"{registry}/{repository}@{digest}"
-        if self._signature_exists(repository=repository, tag=tag):
-            self._log(f"{digest} is signed already, under {tag}")
-            return f"{registry}/{repository}:{tag}", False
+        if self.can_verify(reference):
+            self._log(f"{digest} is signed already")
+            return reference, False
         command = [
             self._cosign,
             "sign",
@@ -440,13 +451,6 @@ class Attestor:
             # `--tlog-upload=false` already asks for, and needs no network
             # call of its own to fetch one.
             "--use-signing-config=false",
-            # cosign 3.1.3 defaults to the OCI 1.1 referrers API instead of
-            # the classic `sha256-<hex>.sig` sidecar tag — found live,
-            # 2026-09-14: `cosign sign` reported success, but no such tag
-            # ever existed, so `_signature_exists`'s own replay check (below)
-            # never found it and `signature_ref` named a tag nothing could
-            # pull. `legacy` restores the tag both of those already assume.
-            "--registry-referrers-mode=legacy",
             "--key",
             self._key,
             reference,
@@ -459,22 +463,21 @@ class Attestor:
                 "cosign did not sign the artifact; its output says why",
                 detail={"digest": digest, "exit": finished.returncode},
             )
-        return f"{registry}/{repository}:{tag}", True
+        return reference, True
 
-    def _signature_exists(self, *, repository: str, tag: str) -> bool:
-        try:
-            answer = self._client().describe_images(
-                repositoryName=repository, imageIds=[{"imageTag": tag}]
-            )
-        except Exception as error:
-            if _is_missing(error):
-                return False
-            raise EnvironmentsError(
-                PROVIDER_ERROR,
-                f"Whether {tag} is already signed could not be read: {error}",
-                detail={"repository": repository, "tag": tag},
-            ) from error
-        return bool(answer.get("imageDetails"))
+    def can_verify(self, reference: str) -> bool:
+        """Whether cosign already finds a signature by this key on `reference`.
+
+        Wherever cosign itself keeps a signature — the OCI 1.1 referrer it
+        defaults to, or the legacy sidecar tag an older registry might still
+        need — is cosign's own business to resolve; asking it directly, the
+        same check the Operator makes before starting a pod, is simpler and
+        more honest than tracking cosign's own storage choices here too.
+        """
+        finished = self._invoke(
+            [self._cosign, "verify", "--insecure-ignore-tlog=true", "--key", self._key, reference]
+        )
+        return finished.returncode == 0
 
     def _invoke(self, command: Sequence[str]) -> subprocess.CompletedProcess[str]:
         # `registry_auth` — same shape as the resolver's own — puts cosign's

{code_sandboxes-1.9.10 → code_sandboxes-1.9.11}/tests/test_environment_attest.py

@@ -88,7 +88,6 @@ class FakeEcr:
         statuses=("ACTIVE",),
         findings=(),
         enhanced_findings=True,
-        signed: set[str] | None = None,
         manifest: dict | None = None,
         pages: list[list[dict]] | None = None,
     ) -> None:
@@ -99,11 +98,9 @@ class FakeEcr:
         #: `findings` when given, to test reading more than one page.
         self.pages = pages
         self.enhanced_findings = enhanced_findings
-        self.signed = set(signed or set())
         self.manifest = manifest
         self.asked = 0
         self.scanned: list[str] = []
-        self.described_tags: list[str] = []
 
     def batch_get_image(self, repositoryName, imageIds, acceptedMediaTypes):  # noqa: N803 - boto3's spelling
         manifest = self.manifest or {
@@ -157,28 +154,29 @@ class FakeEcr:
             },
         }
 
-    def describe_images(self, repositoryName, imageIds):  # noqa: N803 - boto3's spelling
-        tag = imageIds[0].get("imageTag") or ""
-        self.described_tags.append(tag)
-        if tag in self.signed:
-            return {"imageDetails": [{"imageTags": [tag]}]}
-        error = Exception("ImageNotFoundException")
-        error.response = {"Error": {"Code": "ImageNotFoundException"}}
-        raise error
-
 
 class Cosign:
-    """A cosign whose argv and env are read, and which can refuse."""
+    """Every cosign invocation, in order; `argv`/`env` are the last call's own.
+
+    `verify_returncode` is `sign`'s own upfront replay check (E1-09): 1 (not
+    signed yet) unless a test says otherwise, so the ordinary path — verify,
+    then sign — still leaves `argv`/`env` as the `sign` call a test written
+    against the single-call fake already expects.
+    """
 
-    def __init__(self, returncode: int = 0) -> None:
+    def __init__(self, returncode: int = 0, *, verify_returncode: int = 1) -> None:
         self.returncode = returncode
+        self.verify_returncode = verify_returncode
+        self.calls: list[tuple[list[str], dict[str, str] | None]] = []
         self.argv: list[str] = []
         self.env: dict[str, str] | None = None
 
     def __call__(self, argv, *, env=None, **_kwargs) -> subprocess.CompletedProcess[str]:
         self.argv = list(argv)
         self.env = env
-        return subprocess.CompletedProcess(self.argv, self.returncode, "", "Pushing signature\n")
+        self.calls.append((self.argv, self.env))
+        code = self.verify_returncode if "verify" in argv else self.returncode
+        return subprocess.CompletedProcess(self.argv, code, "", "Pushing signature\n")
 
 
 def an_attestor(**changes) -> Attestor:
@@ -466,17 +464,21 @@ class TestTheSignature:
             # `--tlog-upload=false` alone can no longer override (found live
             # 2026-09-14): turned off so the plain flag is honored again.
             "--use-signing-config=false",
-            # cosign 3.1.3 defaults to the OCI 1.1 referrers API rather than
-            # the classic sidecar tag: found live 2026-09-14, `cosign sign`
-            # reported success but pushed no tag `_signature_exists` or
-            # `signature_ref` could ever find. `legacy` restores it.
-            "--registry-referrers-mode=legacy",
             "--key",
             KEY,
             f"{REGISTRY}/{REPOSITORY}@{DIGEST}",
         ]
-        assert reference == f"{REGISTRY}/{REPOSITORY}:{signature_tag(DIGEST)}"
+        # The digest itself: what `cosign verify --key <key>` takes, not a
+        # tag — cosign 3.1.3 defaults to storing a signature as an OCI 1.1
+        # referrer, not the classic `sha256-<hex>.sig` sidecar tag (found
+        # live 2026-09-14, twice: `--registry-referrers-mode` only ever
+        # governed *reading* referrers, never where `sign` writes one).
+        assert reference == f"{REGISTRY}/{REPOSITORY}@{DIGEST}"
         assert signed_now is True
+        # The upfront replay check, cosign's own answer for whether this key
+        # already signed it — not yet, here, so `sign` ran right after.
+        subcommands = [call[0][1] for call in cosign.calls]
+        assert subcommands == ["verify", "sign"]
 
     def test_no_registry_auth_leaves_cosigns_own_environment_untouched(self) -> None:
         """The common case — nothing to add — inherits this process's own
@@ -508,15 +510,19 @@ class TestTheSignature:
                 assert cosign.env[name] == os.environ[name]
 
     def test_a_replay_finds_the_signature_instead_of_pushing_a_second(self) -> None:
-        """Immutable tags would refuse the second, and two signatures are two words."""
-        ecr = FakeEcr(signed={signature_tag(DIGEST)})
-        cosign = Cosign()
-        reference, signed_now = an_attestor(ecr=ecr, run=cosign).sign(
+        """A second signature would not error the way a second push under the
+        old immutable tag once did, but it would still be two things claiming
+        to be Datalayer's word on the same artifact — cosign's own answer to
+        `verify` is asked first, and `sign` never runs when it says yes."""
+        cosign = Cosign(verify_returncode=0)
+        reference, signed_now = an_attestor(run=cosign).sign(
             registry=REGISTRY, repository=REPOSITORY, digest=DIGEST
         )
         assert signed_now is False
-        assert cosign.argv == []
-        assert reference.endswith(signature_tag(DIGEST))
+        assert len(cosign.calls) == 1
+        assert "verify" in cosign.argv
+        assert "sign" not in cosign.argv
+        assert reference == f"{REGISTRY}/{REPOSITORY}@{DIGEST}"
 
     def test_cosign_refusing_is_a_provider_error(self) -> None:
         with pytest.raises(EnvironmentsError) as raised:
@@ -535,6 +541,23 @@ class TestTheSignature:
             an_attestor(cosign="").sign(registry=REGISTRY, repository=REPOSITORY, digest=DIGEST)
         assert raised.value.detail["missing"] == "cosign"
 
+    def test_can_verify_asks_cosign_and_answers_its_exit_code(self) -> None:
+        reference = f"{REGISTRY}/{REPOSITORY}@{DIGEST}"
+        assert an_attestor(run=Cosign(verify_returncode=0)).can_verify(reference) is True
+        assert an_attestor(run=Cosign(verify_returncode=1)).can_verify(reference) is False
+
+    def test_can_verify_names_the_key_and_ignores_the_transparency_log(self) -> None:
+        cosign = Cosign(verify_returncode=0)
+        an_attestor(run=cosign, key=KEY).can_verify(f"{REGISTRY}/{REPOSITORY}@{DIGEST}")
+        assert cosign.argv == [
+            "/usr/bin/cosign",
+            "verify",
+            "--insecure-ignore-tlog=true",
+            "--key",
+            KEY,
+            f"{REGISTRY}/{REPOSITORY}@{DIGEST}",
+        ]
+
     def test_the_signature_sits_beside_the_image_at_cosigns_own_tag(self) -> None:
         assert signature_tag(DIGEST) == "sha256-" + "aa" * 32 + ".sig"
         with pytest.raises(ValueError):
@@ -560,7 +583,7 @@ class TestAttestingAnArtifact:
             artifact=self.an_artifact(), size_bytes=116_183_040, attestor=attestor
         )
         assert answer["scan_summary"]["decision"] == "pass"
-        assert answer["signature_ref"].endswith(signature_tag(DIGEST))
+        assert answer["signature_ref"] == f"{REGISTRY}/{REPOSITORY}@{DIGEST}"
         assert answer["sbom_ref"].endswith(".sbom")
         assert answer["provenance_ref"].endswith(".att")
         assert answer["size_bytes"] == 116_183_040