Add sigstore verification for registry.access.redhat.com

[wshanks]

Bluefin LTS uses a CentOS base that does not include the gpg key for registry.access.redhat.com. It does have the sigstore key though. Here the sigstore method is added to policy.json. This addition avoids signature verification failure when trying to pull images from registry.access.redhat.com (like the ubi images) with podman on Bluefin LTS.

See ublue-os/bluefin-lts#1292 for more context.

[gemini-code-assist]

Code Review

This pull request updates the container image policy in policy.json to include Sigstore verification for Red Hat registries. The feedback highlights a critical logic issue: adding the sigstoreSigned requirement alongside the existing signedBy GPG requirement creates a logical AND condition. Because the GPG key is missing in the target environment, this configuration will cause image pulls to fail. The reviewer suggests replacing the GPG requirement with the Sigstore one to ensure successful verification.

[gemini-code-assist]

In policy.json, the list of requirements for a specific registry scope is evaluated as a logical AND. By adding the sigstoreSigned requirement while retaining the existing signedBy (GPG) requirement, you are requiring that images satisfy both verification methods.

Since the PR description states that Bluefin LTS does not include the GPG key at /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release, the signedBy check will continue to fail even if the sigstore signature is valid. Furthermore, this change makes the policy stricter for all other systems: any system that currently has the GPG key but lacks the new sigstore key will now fail to pull images from this registry because both signatures are now mandatory.

To achieve the goal of allowing sigstore verification on systems without the GPG key, you should likely replace the GPG requirement with the Sigstore one, as policy.json does not natively support 'OR' logic within a single requirement list. Additionally, consider if registry.redhat.io (line 23) requires a similar update for consistency.

[wshanks]

The current PR was based on the Dosu feedback:

Can policy.json have both GPG and sigstore entries for the same registry? Yes — according to the containers-policy.json spec, when both signedBy (GPG) and sigstoreSigned entries are in the requirements array for the same registry, podman accepts an image if each signature satisfies at least one requirement. So you can safely list both methods, and it will work regardless of which key is present on the system.

However, actually checking the spec I see:

The policy requirements are represented as a JSON array of individual requirement objects. For an image to be accepted, all of the requirements must be satisfied simultaneously.

So it looks like Gemini is right and Dosu is wrong here.

That means we should not merge this PR in its current form. We need to decide between the options:

1. Switch completely to sigstore (does that break other images besides Bluefin LTS?).
2. Add the RPM-GPG-KEY-redhat-release key to Bluefin LTS
3. Use a different policy.json on Bluefin LTS than on other Bluefin images.

[castrojo]

Just knowing it's an issue is still worth it, thanks!