From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Burak Ok <burakok@microsoft.com>
Date: 2026-05-22
Subject: [PATCH] IG: Use notation for default signature verification

---
 pkg/operators/oci-handler/oci.go    |  3 ++-
 pkg/resources/embed.go             |  6 ++++++
 pkg/resources/notation-cert.pem    | 33 ++++++++++++++++++++++++++++
 pkg/resources/notation-policy.json | 19 ++++++++++++++++
 4 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 pkg/resources/notation-cert.pem
 create mode 100644 pkg/resources/notation-policy.json

diff --git a/pkg/operators/oci-handler/oci.go b/pkg/operators/oci-handler/oci.go
index d8e1a16cf..9f851078d 100644
--- a/pkg/operators/oci-handler/oci.go
+++ b/pkg/operators/oci-handler/oci.go
@@ -119,7 +119,6 @@ func (o *ociHandler) GlobalParams() api.Params {
 			Key:          publicKeys,
 			Title:        "Public keys",
 			Description:  "Public keys used to verify the gadgets with cosign",
-			DefaultValue: resources.InspektorGadgetPublicKey,
 			TypeHint:     api.TypeStringSlice,
 		},
 		{
@@ -127,12 +126,14 @@ func (o *ociHandler) GlobalParams() api.Params {
 			Key:         certificates,
 			Title:       "Notation certificates",
 			Description: "Certificates used to verify the gadgets with notation",
+			DefaultValue: resources.NotationCertificate,
 			TypeHint:    api.TypeStringSlice,
 		},
 		{
 			Key:         policyDocument,
 			Title:       "Notation policy Document",
 			Description: "Policy Document used to verify the gadgets with notation",
+			DefaultValue: resources.NotationPolicyDocument,
 			TypeHint:    api.TypeString,
 		},
 		{
diff --git a/pkg/resources/embed.go b/pkg/resources/embed.go
index fe7918fa0..d236ad8ee 100644
--- a/pkg/resources/embed.go
+++ b/pkg/resources/embed.go
@@ -22,3 +22,9 @@ var GadgetDeployment string
 
 //go:embed inspektor-gadget.pub
 var InspektorGadgetPublicKey string
+
+//go:embed notation-cert.pem
+var NotationCertificate string
+
+//go:embed notation-policy.json
+var NotationPolicyDocument string
diff --git a/pkg/resources/notation-cert.pem b/pkg/resources/notation-cert.pem
new file mode 100644
index 000000000..5603e05b3
--- /dev/null
+++ b/pkg/resources/notation-cert.pem
@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFrzCCA5egAwIBAgIQaCjVTH5c2r1DOa4MwVoqNTANBgkqhkiG9w0BAQwFADBf
+MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTAw
+LgYDVQQDEydNaWNyb3NvZnQgU3VwcGx5IENoYWluIFJTQSBSb290IENBIDIwMjIw
+HhcNMjIwMjE3MDAxMjM2WhcNNDcwMjE3MDAyMTA5WjBfMQswCQYDVQQGEwJVUzEe
+MBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTAwLgYDVQQDEydNaWNyb3Nv
+ZnQgU3VwcGx5IENoYWluIFJTQSBSb290IENBIDIwMjIwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCeJQFmGR9kNMGdOSNiHXGLVuol0psf7ycBgr932JQz
+gxhIm1Cee5ZkwtDDX0X/MpzoFxe9eO11mF86BggrHDebRkqQCrCvRpI+M4kq+rjn
+MmPzI8du0hT7Jlju/gaEVPrBHzeq29TsViq/Sb3M6wLtxk78rBm1EjVpFYkXTaNo
+6mweKZoJ8856IcYJ0RnqjzBGaTtoBCt8ii3WY13qbdY5nr0GPlvuLxFbKGunUqRo
+Xkyk6q7OI79MNnHagUVQjsqGzv9Tw7hDsyTuB3qitPrHCh17xlI1MewIH4SAklv4
+sdo51snn5YkEflF/9OZqZEdJ6vjspvagQ1P+2sMjJNgl2hMsKrc/lN53HEx4HGr5
+mo/rahV3d61JhM4QQMeZSA/Vlh6AnHOhOKEDb9NNINC1Q+T3LngPTve8v2XabZAL
+W7/e6icnmWT4OXxzPdYh0u7W81MRLlXD3OrxKVfeUaF4c5ALL/XJdTbrjdJtjnld
+uho4/98ZAajSyNHW8uuK9S7RzJMTm5yQeGVjeQTE8Z6fjDrzZAz+mB2T4o9WpWNT
+I7hucxZFGrb3ew/NpDL/Wv6WjeGHeNtwg6gkhWkgwm0SDeV59ipZz9ar54HmoLGI
+LQiMC7HP12w2r575A2fZQXOpq0W4cWBYGNQWLGW60QXeksVQEBGQzkfM+6+/I8Cf
+BQIDAQABo2cwZTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV
+HQ4EFgQUC7NoO6/ar+5wpXbZIffMRBYH0PgwEAYJKwYBBAGCNxUBBAMCAQAwEQYD
+VR0gBAowCDAGBgRVHSAAMA0GCSqGSIb3DQEBDAUAA4ICAQBIxzf//8FoV9eLQ2ZG
+OiZrL+j63mihj0fxPTSVetpVMfSV0jhfLLqPpY1RMWqJVWhsK0JkaoUkoFEDx93R
+cljtbB6M2JHF50kRnRl6N1ged0T7wgiYQsRN45uKDs9ARU8bgHBZjJOB6A/VyCaV
+qfcfdwa4yu+c++hm2uU54NLSYsOn1LYYmiebJlBKcpfVs1sqpP1fL37mYqMnZgz6
+2RnMER0xqAFSCOZUDJljK+rYhNS0CBbvvkpbiFj0Bhag63pd4cdE1rsvVVYl8J4M
+5A8S28B/r1ZdxokOcalWEuS5nKhkHrVHlZKu0HDIk318WljxBfFKuGxyGKmuH1eZ
+JnRm9R0P313w5zdbX7rwtO/kYwd+HzIYaalwWpL5eZxY1H6/cl1TRituo5lg1oWM
+ZncWdq/ixRhb4l0INtZmNxdl8C7PoeW85o0NZbRWU12fyK9OblHPiL6S6jD7LOd1
+P0JgxHHnl59zx5/K0bhsI+pQKB0OQ8z1qRtA66aY5eUPxZIvpZbH1/o8GO4dG2ED
+/YbnJEEzvdjztmB88xyCA9Vgr9/0IKTkgQYiWsyFM31k+OS4v4AX1PshP2Ou54+3
+F0Tsci41yQvQgR3pcgMJQdnfCUjmzbeyHGAlGVLzPRJJ7Z2UIo5xKPjBB1Rz3TgI
+tIWPFGyqAK9Aq7WHzrY5XHP5kA==
+-----END CERTIFICATE-----
diff --git a/pkg/resources/notation-policy.json b/pkg/resources/notation-policy.json
new file mode 100644
index 000000000..5cc088c62
--- /dev/null
+++ b/pkg/resources/notation-policy.json
@@ -0,0 +1,19 @@
+{
+    "version": "1.0",
+    "trustPolicies": [
+        {
+            "name": "supplychain",
+            "registryScopes": ["*"],
+            "signatureVerification": {
+                "level": "strict",
+                "override": {
+                    "revocation": "skip"
+                }
+            },
+            "trustStores": ["ca:supplychain"],
+            "trustedIdentities": [
+                "x509.subject: CN=Microsoft SCD Products RSA Signing,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US"
+            ]
+        }
+    ]
+}
-- 
2.34.1
