CGA-5g6r-gqx2-76cw

Summary

PolicyController before 0.2.1 may bypass attestation verification

Description

PolicyController will report a false positive, resulting in an admission when it should not be admitted when:

• There is at least one attestation with a valid signature
• There are NO attestations of the type being verified (--type defaults to "custom")

Users should upgrade to cosign version 0.2.1 or greater for a patch. There are no known workarounds at this time.