SECURESIGN-1014 | Add support for Trusted Timestamp Authorities in SecureSign

[JasonPowr]

Opening this as a draft pr, so far this is just the basic deployment of the Timestamp Authority. just looking for some feedback. jira: https://issues.redhat.com/browse/SECURESIGN-1014

Testing

1. Build and deploy operator
2. TSA should come up with the rest of the stack
3. Sign an image with the flag --timestamp-server-url=$TSA_URL eg

TSA_URL=https://<tsa-url>/api/v1/timestamp
cosign sign -y --timestamp-server-url=$TSA_URL <image>

4. To verify the timestamp you need to retrieve the certificate chain using curl https://<tsa-url>/api/v1/timestamp/certchain > ts_chain.pem, then run the cosign verify cmd like so:

cosign verify --timestamp-certificate-chain=ts_chain_local.pem <image>

TODO

improve e2e and upgrade test

[JasonPowr]

/test tas-operator-e2e

[JasonPowr]

/test tas-operator-e2e

[JasonPowr]

/test tas-operator-e2e

[osmman]

I installed sample Securesign resource and I am getting this status condition on TSA object:

status:
  conditions:
    - message: ''
      reason: Ready
      status: 'True'
      type: Ready
    - message: ''
      reason: Pending
      status: Unknown
      type: TSASignerCondition
    - message: Ingress created
      reason: Creating
      status: 'False'
      type: TSAServerCondition

It looks like that TSA service has been deployed correctly but status of TSASignerCondition and TSAServerCondition are not positive.

[JasonPowr]

@osmman Should be resolved now, I also made those changes to the tests

status:
  conditions:
  - lastTransitionTime: "2024-08-19T12:37:36Z"
    message: ""
    reason: Ready
    status: "True"
    type: Ready
  - lastTransitionTime: "2024-08-19T12:37:26Z"
    message: ""
    reason: Resolved
    status: "True"
    type: TSASignerCondition
  - lastTransitionTime: "2024-08-19T12:37:36Z"
    message: ""
    reason: Ready
    status: "True"
    type: TSAServerCondition

[osmman]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JasonPowr, osmman

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [JasonPowr,osmman]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[JasonPowr]

/unhold