From 93a047a847fb75ad56149caff7fcda1a336f07db Mon Sep 17 00:00:00 2001
From: Michele Baldessari <michele@acksyn.org>
Date: Thu, 6 Aug 2026 18:48:31 +0200
Subject: [PATCH 1/4] WIP add an image signing step

---
 pattern.sh | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/pattern.sh b/pattern.sh
index b2172fd4..3bed5219 100755
--- a/pattern.sh
+++ b/pattern.sh
@@ -17,6 +17,43 @@ function is_container() {
     return 1
 }
 
+function verify_image() {
+    local image="$1"
+
+    case "${image}" in
+        quay.io/validatedpatterns/*|quay.io/hybridcloudpatterns/*)
+            ;;
+        *)
+            echo "Skipping image verification for third-party registry"
+            return 0
+            ;;
+    esac
+
+    if ! command -v cosign >/dev/null 2>&1; then
+        echo "WARNING: cosign is not installed, cannot verify image signature"
+        echo "Install cosign to enable image verification: https://docs.sigstore.dev/cosign/system_config/installation/"
+        return 0
+    fi
+
+    echo "Verifying image signature for ${image}..."
+    local output rc
+    output=$(cosign verify \
+        --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+        --certificate-identity-regexp "https://github.com/validatedpatterns/utility-container/.*" \
+        "${image}" 2>&1) && rc=$? || rc=$?
+
+    if [ "${rc}" -eq 0 ]; then
+        echo "Image signature verified successfully"
+    elif [ "${rc}" -ge 10 ] && [ "${rc}" -le 13 ]; then
+        echo "WARNING: Image signature verification failed for ${image} (exit code ${rc})"
+        echo "${output}"
+        echo "Set VP_VERIFY_IMAGE=false to skip this check"
+    else
+        echo "WARNING: Could not verify image signature for ${image} (likely a network issue)"
+        echo "Set VP_VERIFY_IMAGE=false to skip this check"
+    fi
+}
+
 if is_container; then
     echo "Already running in a container"
     exec "$@"
@@ -103,6 +140,10 @@ fi
 # $HOME is mounted as itself for any files that are referenced with absolute paths
 # $HOME is mounted to /root because the UID in the container is 0 and that's where SSH looks for credentials
 
+if [ "${VP_VERIFY_IMAGE:-true}" != "false" ]; then
+    verify_image "$PATTERN_UTILITY_CONTAINER"
+fi
+
 podman run -it --rm --pull=newer \
     --security-opt label=disable \
     -e ANSIBLE_STDOUT_CALLBACK \

From 438a6b2f107f85763d3fd11572f5b170920a6edd Mon Sep 17 00:00:00 2001
From: Michele Baldessari <michele@acksyn.org>
Date: Thu, 6 Aug 2026 18:52:31 +0200
Subject: [PATCH 2/4] WIP do not use pull=newer when the images uses a digest

This is probably not even needed, but alas it makes the intent in
general a bit clearer
---
 pattern.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pattern.sh b/pattern.sh
index 3bed5219..f5ccb0b3 100755
--- a/pattern.sh
+++ b/pattern.sh
@@ -144,7 +144,12 @@ if [ "${VP_VERIFY_IMAGE:-true}" != "false" ]; then
     verify_image "$PATTERN_UTILITY_CONTAINER"
 fi
 
-podman run -it --rm --pull=newer \
+PULL_ARG="--pull=newer"
+if [[ "$PATTERN_UTILITY_CONTAINER" == *@sha256:* ]]; then
+    PULL_ARG=""
+fi
+
+podman run -it --rm ${PULL_ARG} \
     --security-opt label=disable \
     -e ANSIBLE_STDOUT_CALLBACK \
     -e DISABLE_VALIDATE_ORIGIN \

From d370ec4f53ab30f3df8ff64eee1a77f9fae94e82 Mon Sep 17 00:00:00 2001
From: Michele Baldessari <michele@acksyn.org>
Date: Thu, 6 Aug 2026 18:54:39 +0200
Subject: [PATCH 3/4] WIP Allow OICD and CERT ID to be overridden

---
 pattern.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pattern.sh b/pattern.sh
index f5ccb0b3..2e41a421 100755
--- a/pattern.sh
+++ b/pattern.sh
@@ -37,9 +37,11 @@ function verify_image() {
 
     echo "Verifying image signature for ${image}..."
     local output rc
+    local oidc_issuer="${VP_COSIGN_OIDC_ISSUER:-https://token.actions.githubusercontent.com}"
+    local cert_identity="${VP_COSIGN_CERT_IDENTITY:-https://github.com/validatedpatterns/utility-container/.*}"
     output=$(cosign verify \
-        --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-        --certificate-identity-regexp "https://github.com/validatedpatterns/utility-container/.*" \
+        --certificate-oidc-issuer "${oidc_issuer}" \
+        --certificate-identity-regexp "${cert_identity}" \
         "${image}" 2>&1) && rc=$? || rc=$?
 
     if [ "${rc}" -eq 0 ]; then

From b33242b0b8109513d9c379aa4706fcab70a065f2 Mon Sep 17 00:00:00 2001
From: Michele Baldessari <michele@acksyn.org>
Date: Thu, 6 Aug 2026 18:59:38 +0200
Subject: [PATCH 4/4] WIP actually error out when we know the signature
 verification failed

---
 pattern.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pattern.sh b/pattern.sh
index 2e41a421..7c48893e 100755
--- a/pattern.sh
+++ b/pattern.sh
@@ -47,9 +47,10 @@ function verify_image() {
     if [ "${rc}" -eq 0 ]; then
         echo "Image signature verified successfully"
     elif [ "${rc}" -ge 10 ] && [ "${rc}" -le 13 ]; then
-        echo "WARNING: Image signature verification failed for ${image} (exit code ${rc})"
+        echo "ERROR: Image signature verification failed for ${image} (exit code ${rc})"
         echo "${output}"
         echo "Set VP_VERIFY_IMAGE=false to skip this check"
+        exit 1
     else
         echo "WARNING: Could not verify image signature for ${image} (likely a network issue)"
         echo "Set VP_VERIFY_IMAGE=false to skip this check"