🐛 Sigstore verification not wired into workload label propagation or enforcement early-return

[kevincogan]

Describe the bug

Sigstore verification is not fully wired through the AgentCard controller and signing workflow.

There are three related issues from PR #355:

1. signature-verified label ignores Sigstore

The agent.kagenti.dev/signature-verified pod label is used by NetworkPolicies to gate agent traffic, but the current if/else if chain in agentcard_controller.go only handles the mTLS and JWS paths.

This means:

• Sigstore-only: when EnableSigstoreVerification=true and RequireSignature=false, the label is never set.
• JWS + Sigstore: the label can be set to true based on JWS alone, even if Sigstore verification fails.

2. Sigstore enforcement does not requeue on failure

JWS enforcement failures return early with a 1-minute requeue.

Sigstore failures currently update status to Synced=False, but then continue to the normal return path. In enforcement mode, failed Sigstore verification should also return early with RequeueAfter: 1 * time.Minute.

Audit mode should continue to allow processing.

3. Signing workflow uses sigstore-go instead of sigstore-a2a

The signing workflow is currently using sigstore-go directly rather than the intended sigstore-a2a implementation.

This means the PR may be verifying a Sigstore artifact, but it is not validating the intended sigstore-a2a AgentCard signing flow end to end.

Expected behavior

• Sigstore verification should be included in the agent.kagenti.dev/signature-verified label decision.
• For JWS + Sigstore, the label should only be true when both verification paths pass.
• In Sigstore enforcement mode, failed verification should return early with a 1-minute requeue.
• In Sigstore audit mode, failed verification should only be recorded in status and should not block processing.
• The signing workflow should use sigstore-a2a, not direct sigstore-go usage.

Proposed fixes

Label propagation

} else if r.RequireSignature || r.EnableSigstoreVerification {
    verified := trust.isVerified

    if r.EnableSigstoreVerification && sigstoreResult != nil && !sigstoreResult.Absent {
        verified = verified && sigstoreResult.Verified
    }

    if err := r.propagateSignatureLabel(ctx, agentCard.Name, workload, verified); err != nil {
        // existing error handling
    }
}

Sigstore enforcement requeue

if sigstoreResult != nil &&
    !sigstoreResult.Absent &&
    !sigstoreResult.Verified &&
    !r.SigstoreAuditMode {

    agentCardLogger.Info("Sigstore verification failed, rejecting agent card",
        "workload", workload.Name,
        "details", sigstoreResult.Details)

    return ctrl.Result{RequeueAfter: 1 * time.Minute}, nil
}

Signing workflow

Restore the signing workflow to use sigstore-a2a and verify that the generated bundle/artifact is compatible with the operator-side verification logic.

Additional context

File:

kagenti-operator/internal/controller/agentcard_controller.go

Version:

v0.6.0
branch: feature/sigstore-a2a-signed-card-verification
commit: 2efa0c7

Risk is low to medium. Sigstore is disabled by default, so the controller changes mainly affect deployments that explicitly enable Sigstore. The signing workflow issue should be fixed before treating the PR as merge-ready because it affects whether the intended sigstore-a2a path is actually being tested.

[kevincogan]

@DeanKelly751 can you take a look into this, thanks! :))

[DeanKelly751]

Working on this now :)