SPIRE Integration also needs to sign ResolutionRequest's status and PipelineRun's status

[chuangw6]

Feature request

The TEP-0089 only mentions the importance of signing the content of TaskRun's status.

When integrating SPIRE, we also need to sign remote ResolutionRequest's status and PipelineRun's status.

Use case

• ResolutionRequest's status

ResolutionRequest Status contains 2 important pieces of data: status.data and status.source. status.data is the place to store the original remote content resolved by the remote resolution controller, and status.source is the place to record the source information where the remote resource came from.
Therefore, we need to sign the status content to make sure both status.data and status.source is trustful.

• PipelineRun's status

Similar to TaskRun status, PipelineRun status contains important information as well i.e. status.childReferences, status.taskruns and status.provenance.

To generate pipelinerun level provenance, Chains just looks up the status of PipelineRun CRD. Therefore, we need to guarantee the integrity there as well.

[chuangw6]

cc @lumjjb @pxp928 @jagathprakash @wlynch

[lumjjb]

The SPIRE mechanisms are a great fit for these use cases!

[pxp928]

Let me know how I can help with this. Great use cases.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[afrittoli]

This feels like something that should be frozen!
/lifecycle frozen