code-sandboxes 1.9.8__tar.gz → 1.9.9__tar.gz

{code_sandboxes-1.9.8 → code_sandboxes-1.9.9}/CHANGELOG.md

@@ -8,6 +8,19 @@
 
 ## Unreleased
 
+## 1.9.9
+
+- **cosign gets the same registry credential the build pushed with**
+  (`environments.attest`; PLAN_ENV.md D-17, E1-09). cosign has no AWS
+  credential chain of its own for ECR, unlike the boto3 client the scan is
+  read with. Found live on r1, 2026-09-14: `cosign sign` reached the
+  repository anonymously and was refused, plain `401 Unauthorized`, on
+  every real artifact this pipeline ever tried to sign. `Attestor` takes a
+  `registry_auth` — the same `{"DOCKER_CONFIG": <dir>}` shape the resolver
+  and the builder already read off a `BuildCredential` — and sets it on
+  cosign's own subprocess, added to this process's own environment rather
+  than replacing it.
+
 ## 1.9.8
 
 - **Every page of a scan's findings is read before deciding**

{code_sandboxes-1.9.8 → code_sandboxes-1.9.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.8
+Version: 1.9.9
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.8 → code_sandboxes-1.9.9}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.8"
+__version__ = "1.9.9"

{code_sandboxes-1.9.8 → code_sandboxes-1.9.9}/code_sandboxes/environments/attest.py

@@ -150,6 +150,15 @@ class Attestor:
     policy
         What the findings have to say. The owner's default unless an
         organization tightened it (E3-06).
+    registry_auth
+        What cosign reads the repository with, to sign it (D-17): the same
+        `{"DOCKER_CONFIG": <dir>}` shape the resolver and the builder already
+        take off a `BuildCredential`, the one attribute name every caller
+        reads regardless of what kind of credential it holds. cosign has no
+        AWS credential chain of its own for ECR, unlike the boto3 client the
+        scan is read with — found live, 2026-09-14: with none, `cosign sign`
+        reached the registry anonymously and was refused, `401 Unauthorized`,
+        on every real artifact this pipeline ever tried to sign.
     """
 
     def __init__(
@@ -166,6 +175,7 @@ class Attestor:
         scan_timeout_seconds: float = DEFAULT_SCAN_TIMEOUT_SECONDS,
         scan_interval_seconds: float = DEFAULT_SCAN_INTERVAL_SECONDS,
         log: Callable[[str], None] | None = None,
+        registry_auth: Mapping[str, str] | None = None,
     ) -> None:
         self._ecr = ecr
         self._cosign = (shutil.which("cosign") or "") if cosign is None else cosign
@@ -178,6 +188,7 @@ class Attestor:
         self._timeout = scan_timeout_seconds
         self._interval = scan_interval_seconds
         self._log = log or (lambda _line: None)
+        self._registry_auth = dict(registry_auth or {})
 
     # -- the scan -------------------------------------------------------------
 
@@ -459,9 +470,19 @@ class Attestor:
         return bool(answer.get("imageDetails"))
 
     def _invoke(self, command: Sequence[str]) -> subprocess.CompletedProcess[str]:
+        # `registry_auth` — same shape as the resolver's own — puts cosign's
+        # `DOCKER_CONFIG` beside the rest of this process's environment,
+        # never replacing it: `--key` alone still needs AWS's own chain to
+        # reach the KMS key, which this does not touch.
+        env = {**os.environ, **self._registry_auth} if self._registry_auth else None
         try:
             finished = self._run(
-                list(command), capture_output=True, text=True, check=False, timeout=self._timeout
+                list(command),
+                capture_output=True,
+                text=True,
+                check=False,
+                timeout=self._timeout,
+                env=env,
             )
         except subprocess.TimeoutExpired as expired:
             raise EnvironmentsError(
@@ -552,6 +573,7 @@ def attest_artifact(
         key=str(getattr(credential, "signing_key", "") or ""),
         policy=policy,
         log=log,
+        registry_auth=getattr(credential, "registry_auth", None),
     )
     return use.attest(
         registry=registry,

{code_sandboxes-1.9.8 → code_sandboxes-1.9.9}/tests/test_environment_attest.py

@@ -168,14 +168,16 @@ class FakeEcr:
 
 
 class Cosign:
-    """A cosign whose argv is read, and which can refuse."""
+    """A cosign whose argv and env are read, and which can refuse."""
 
     def __init__(self, returncode: int = 0) -> None:
         self.returncode = returncode
         self.argv: list[str] = []
+        self.env: dict[str, str] | None = None
 
-    def __call__(self, argv, **_kwargs) -> subprocess.CompletedProcess[str]:
+    def __call__(self, argv, *, env=None, **_kwargs) -> subprocess.CompletedProcess[str]:
         self.argv = list(argv)
+        self.env = env
         return subprocess.CompletedProcess(self.argv, self.returncode, "", "Pushing signature\n")
 
 
@@ -471,6 +473,35 @@ class TestTheSignature:
         assert reference == f"{REGISTRY}/{REPOSITORY}:{signature_tag(DIGEST)}"
         assert signed_now is True
 
+    def test_no_registry_auth_leaves_cosigns_own_environment_untouched(self) -> None:
+        """The common case — nothing to add — inherits this process's own
+        environment rather than replacing it with an empty one."""
+        cosign = Cosign()
+        an_attestor(run=cosign).sign(registry=REGISTRY, repository=REPOSITORY, digest=DIGEST)
+        assert cosign.env is None
+
+    def test_registry_auth_reaches_cosign_as_docker_config(self) -> None:
+        """cosign has no AWS credential chain of its own for ECR, unlike the
+        boto3 client the scan is read with: found live, 2026-09-14, `cosign
+        sign` reached the registry anonymously and was refused with a plain
+        `401 Unauthorized` on every real artifact this pipeline tried to
+        sign. The same `{"DOCKER_CONFIG": <dir>}` the resolver and the
+        builder already take off a `BuildCredential` fixes it here too."""
+        docker_config = "/tmp/dl-docker-abc"  # noqa: S108 - a build's own dir, never touched by this test
+        cosign = Cosign()
+        an_attestor(run=cosign, registry_auth={"DOCKER_CONFIG": docker_config}).sign(
+            registry=REGISTRY, repository=REPOSITORY, digest=DIGEST
+        )
+        assert cosign.env is not None
+        assert cosign.env["DOCKER_CONFIG"] == docker_config
+        # Added to this process's own environment, not instead of it — cosign
+        # still needs AWS's own chain to reach the KMS key with `--key`.
+        import os
+
+        for name in ("PATH", "HOME"):
+            if name in os.environ:
+                assert cosign.env[name] == os.environ[name]
+
     def test_a_replay_finds_the_signature_instead_of_pushing_a_second(self) -> None:
         """Immutable tags would refuse the second, and two signatures are two words."""
         ecr = FakeEcr(signed={signature_tag(DIGEST)})