Summary
scripts/collect-firmware-refvals.sh currently runs a host-installed veritas CLI (pip install "osc-veritas[snp]==0.1.3rc1") instead of the quay.io/openshift_sandboxed_containers/coco-tools:0.5.1 container it used to run in, as part of #113 / #130.
This is a deliberate, temporary deviation, not the desired end state — track moving back to the container once possible.
Why the deviation was needed
The pinned container's requirements.txt vendors veritas @ v0.1.2 (tagged 2026-07-15). That version predates --skip-tlog, --cosign-pub-key, and --mirror-registry (all added 2026-07-24). Without --skip-tlog, the Azure branch's image-signature verification was repeatedly failing against Red Hat's private Rekor instance (rekor-server-default.apps.rosa.rekor-prod.2jng.p3.openshiftapps.com), and there was no way to fix this within the pinned container — no newer coco-tools tag exists yet upstream (confidential-devhub/coco-tools tags top out at 0.5.1).
osc-veritas is published on PyPI (0.1.3rc1 is the current, non-yanked release) and does include --skip-tlog, confirmed via a real pip install + veritas --help.
Why container-based is preferred long-term
- Encapsulation: the container bundles all required tooling (veritas + cosign + tdx-measure + sev-snp-measure + oc + skopeo) in one pinned, reproducible image. Operators only need
podman (already a repo-wide prerequisite for pattern.sh itself) instead of separately installing/version-managing cosign (new prerequisite today), the Rust tdx-measure toolchain, and Python 3.11+.
- Reduced host-environment drift: not every operator's workstation has Python 3.11+,
cosign >= 2.0, and a Rust/cargo toolchain readily available; a container avoids needing any of that.
- Supply-chain / reproducibility: a pinned, hash-addressable container image is more auditable than "whatever
veritas/cosign/deps happen to be pip/cargo-installed on an operator's laptop at collection time."
- Consistency: matches how the pattern already handles similar "run a pinned tool against artifacts" tasks elsewhere (e.g.
collect-dcap-collateral.sh's pcsclient.py model, pattern.sh's own containerized ansible execution).
Action
Once confidential-devhub/coco-tools publishes a release pinning veritas >= 0.1.3 (stable, non-RC once available), revert scripts/collect-firmware-refvals.sh to invoke veritas via podman run <new-coco-tools-tag> instead of the host-installed CLI, and drop the cosign/host-veritas prerequisite checks. Consider filing an upstream ask against confidential-devhub/coco-tools requesting this release bump if it doesn't happen naturally.
Summary
scripts/collect-firmware-refvals.shcurrently runs a host-installedveritasCLI (pip install "osc-veritas[snp]==0.1.3rc1") instead of thequay.io/openshift_sandboxed_containers/coco-tools:0.5.1container it used to run in, as part of #113 / #130.This is a deliberate, temporary deviation, not the desired end state — track moving back to the container once possible.
Why the deviation was needed
The pinned container's
requirements.txtvendorsveritas @ v0.1.2(tagged 2026-07-15). That version predates--skip-tlog,--cosign-pub-key, and--mirror-registry(all added 2026-07-24). Without--skip-tlog, the Azure branch's image-signature verification was repeatedly failing against Red Hat's private Rekor instance (rekor-server-default.apps.rosa.rekor-prod.2jng.p3.openshiftapps.com), and there was no way to fix this within the pinned container — no newercoco-toolstag exists yet upstream (confidential-devhub/coco-toolstags top out at0.5.1).osc-veritasis published on PyPI (0.1.3rc1is the current, non-yanked release) and does include--skip-tlog, confirmed via a realpip install+veritas --help.Why container-based is preferred long-term
podman(already a repo-wide prerequisite forpattern.shitself) instead of separately installing/version-managingcosign(new prerequisite today), the Rusttdx-measuretoolchain, and Python 3.11+.cosign>= 2.0, and a Rust/cargo toolchain readily available; a container avoids needing any of that.veritas/cosign/deps happen to be pip/cargo-installed on an operator's laptop at collection time."collect-dcap-collateral.sh'spcsclient.pymodel,pattern.sh's own containerized ansible execution).Action
Once
confidential-devhub/coco-toolspublishes a release pinningveritas >= 0.1.3(stable, non-RC once available), revertscripts/collect-firmware-refvals.shto invoke veritas viapodman run <new-coco-tools-tag>instead of the host-installed CLI, and drop thecosign/host-veritasprerequisite checks. Consider filing an upstream ask againstconfidential-devhub/coco-toolsrequesting this release bump if it doesn't happen naturally.