CSPACE-SIGNER-01: Attested workload image is signed by an approved signer¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | GCP Confidential Space (AMD SEV-SNP) |
| Lifecycle stage | attest |
| Assurance | report-derived |
| Mode | Passive: reads only the files and values you pass to the scan. |
What it checks¶
It passes when:
- Image is signed by an approved signer (…).
How to fix¶
- Gate key release on the signer identity, not only the image digest: require assertion.submods.container.image_signatures to include a key_id in your approved cosign fingerprint set (and verify the signature, CSPACE-ATT-02). Supply each approved signer as a 64-character lowercase SHA-256 fingerprint; malformed entries are rejected and fail the check closed rather than being ignored. Rotate approved signers through your signing policy.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- Need --attestation-token and --gcp-approved-signers; skipping check.
ERROR:
- Could not read a bounded, structurally valid attestation token.
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--attestation-token |
Path to a captured Confidential Space attestation token (JWT). |
--gcp-approved-signers |
Approved workload-image signer key fingerprints (SHA-256 hex, comma/space separated) for CSPACE-SIGNER-01. |
Permissions¶
None. The check reads only the files or values you pass to the scan.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).