verifiers
Ratify supports many verifiers to validate different artifact types. View more CRD samples here. Each verifier must specify the name
of the verifier and the artifactType
this verifier handles. Common properties:
apiVersion: config.ratify.deislabs.io/v1beta1
kind: Verifier
metadata:
name: verifier-notation
spec:
name: required, name of the verifier
artifactType: required, the type of artifact this verifier handles
address: optional. Plugin path, defaults to value of env "RATIFY_CONFIG" or "~/.ratify/plugins"
source: optional. Source location to download the plugin binary, learn more at docs/reference/dynamic-plugins.md
artifact: e.g. wabbitnetworks.azurecr.io/test/sample-verifier-plugin:v1
parameters: optional. Parameters specific to this verifier
Notation
Sample Notation yaml spec:
apiVersion: config.ratify.deislabs.io/v1beta1
kind: Verifier
metadata:
name: verifier-notation
spec:
name: notation
artifactTypes: application/vnd.cncf.notary.signature
parameters:
verificationCertStores: # certificates for validating signatures
certs: # name of the trustStore
- default/certstore-akv # namespace/name of the certificate store CRD to include in this trustStore
- default/certstore-akv1
trustPolicyDoc: # policy language that indicates which identities are trusted to produce artifacts
version: "1.0"
trustPolicies:
- name: default
registryScopes:
- "*"
signatureVerification:
level: strict
trustStores:
- ca:certs
trustedIdentities:
- "*"
Name | Required | Description | Default Value |
---|---|---|---|
verificationCerts | no | An array of string. Notation verifier will load all certificates from path specified in this array | "" |
verificationCertStores | no | Defines a collection of cert store objects. This property supersedes the path defined in verificationCerts . It is assumed that the referenced certificate store exists in the Ratify installed namespace. To reference a certificate store defined in a different namespace, please specify the full namespace name. E.g. mynamespace/myCert | "" |
trustPolicyDoc | yes | Trust policy is a policy language that indicates which identities are trusted to produce artifacts. | "" |
Cosign
Cosign verifier can be used to verify signatures generated using cosign, learn more about the plugin here
apiVersion: config.ratify.deislabs.io/v1beta1
kind: Verifier
metadata:
name: verifier-cosign
spec:
name: cosign
artifactTypes: application/vnd.dev.cosign.artifact.sig.v1+json
parameters:
key: /usr/local/ratify-certs/cosign/cosign.pub
Name | Required | Description | Default Value |
---|---|---|---|
key | yes | Path to the public key used for validating the signature | "" |
Sbom
apiVersion: config.ratify.deislabs.io/v1beta1
kind: Verifier
metadata:
name: verifier-sbom
spec:
name: sbom
artifactTypes: org.example.sbom.v0
parameters:
nestedReferences: application/vnd.cncf.notary.signature
Name | Required | Description | Default Value |
---|---|---|---|
nestedReferences | no | If nestedReferences contains any string value, the nested artifact will also be verified. For example, customer might want to enforce notation signatures on all sboms. | "" |
Schemavalidator
Validate Json artifacts against JSON schemas, learn more about the plugin here
apiVersion: config.ratify.deislabs.io/v1beta1
kind: Verifier
metadata:
name: verifier-schemavalidator
spec:
name: schemavalidator
artifactTypes: vnd.aquasecurity.trivy.report.sarif.v1
parameters:
schemas:
application/sarif+json: https://json.schemastore.org/sarif-2.1.0-rtm.5.json
Name | Required | Description | Default Value |
---|---|---|---|
schemas | yes | A mapping between the schema name to the schema path. The path can be either a URL or a canonical file path that starts with file:// | "" |