[shubhamrai9122-creator]

Changes

Fixes #2894

tkn task sign, tkn pipeline sign and their verify commands decoded every file as v1beta1, even with apiVersion: tekton.dev/v1. Marshalling the v1beta1 Step wrote resources: {} into each step, which Tekton Pipelines rejects (strict decoding error: unknown field "spec.steps[0].resources"). It also silently dropped v1-only fields: a step's computeResources was missing from the signed file.

This adds trustedresources.Decode, which reads the apiVersion and decodes a tekton.dev/v1 Task or Pipeline into the v1 type. The four commands and UnmarshalCRD use it. A file without a tekton.dev/v1 apiVersion is still decoded as v1beta1, as before. Because a v1 resource is now marshalled with the v1 type, the signature covers the same bytes Tekton Pipelines hashes in v1.Task.Checksum() / v1.Pipeline.Checksum(). That's probably also the sign/verify mismatch mentioned at the end of the issue.

Tests in pkg/trustedresources:

• TestDecode checks the type chosen for v1, v1beta1 and missing apiVersions.
• TestSignV1 signs a v1 Task (with computeResources) and a v1 Pipeline (with an inline taskSpec). It decodes the signed file strictly into the v1 type, as Pipelines does, and verifies the signature against Pipelines' own Checksum(). Run against the old behaviour, both cases fail with json: unknown field "resources".

Submitter Checklist

• Includes tests
• Run the code checkers with make check (ran gofmt, go vet and go test -mod=vendor ./...; everything passes except TestDeterministicLayers/TestDeterministicManifest in pkg/bundle, which fail the same way on main on my machine)
• Regenerate the manpages, docs and go formatting with make generated (no flag or help text changes)
• Commit messages follow commit message best practices

Release Notes

Fix tkn task sign and tkn pipeline sign for tekton.dev/v1 resources: the signed file no longer gets an invalid `resources: {}` field on each step, keeps v1 fields such as `computeResources`, and verifies with Tekton Pipelines.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign vdemeester after the PR has been reviewed.
You can assign the PR to them by writing /assign @vdemeester in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[shubhamrai9122-creator]

/assign @vdemeester