how to disable cosign verification?

[tuananh]

Free Text

how to disable cosign verification via config file?

[suzuki-shunsuke]

You can disable cosign verification in registries.

cosign:
  enabled: false

https://github.com/aquaproj/aqua-registry/blob/2728d8ffd1887f0338067a9175a7c7d354bd48cc/pkgs/suzuki-shunsuke/cmdx/registry.yaml#L35-L36

But there is no way to disable cosign verification using command line options, environment variables, and aqua.yaml.
Could you tell me why you want to disable it?

[tuananh]

We are using it in corporate setting and dont want to request another endpoint

[suzuki-shunsuke]

request another endpoint

I see.

Cosign accesses some endpoints such as oauth2.sigstore.dev and fulcio.sigstore.dev.
So to use Cosign you need to allow the access to these endpoints, but you don't want to do it.

Is my understanding correct?

[suzuki-shunsuke]

Currently, there is no option to disable Cosign as I said, and cosign verification is important in terms of security.
But I also understand your motivation.

So there are some ideas.

1. Add the environment variable to disable Cosign
2. Add the setting to disable Cosign to aqua.yaml

In this case we should disable not only Cosign but also SLSA.

export AQUA_DISABLE_COSIGN=true
export AQUA_DISABLE_SLSA_VERIFICATION=true

aqua.yaml

cosign:
  enabled: false
slsa_verification:
  enabled: false

These settings aren't good in terms of security, so we need to be cautious to introduce these options.

[suzuki-shunsuke]

Thank you for your feedback.
I wrote a proposal to resolve the issue.

• Support disabling the verification with Cosign and slsa-verifier #2633

[suzuki-shunsuke]

From aqua v2.22.0 and aqua-installer v2.3.0, you can disable the verification with Cosign and SLSA Provenance.

Please see the release note, document, and issue.

• https://aquaproj.github.io/docs/reference/security/cosign-slsa#disable-the-verification-with-cosign-and-slsa-provenance
• https://github.com/aquaproj/aqua/releases/tag/v2.22.0
• https://github.com/aquaproj/aqua-installer/releases/tag/v2.3.0
• Support disabling the verification with Cosign and slsa-verifier #2633