Summary

When enable-oci11=true, discoverAttestationsOCI11 fetched referrer attestations and returned them via processAttestationArtifact without ever invoking a cryptographic verifier. The caller ValidatePolicyAttestationsForAuthority treats len(verifiedAttestations) > 0 as a successful authority check, so any image carrying an OCI 1.1 referrer whose ArtifactType contains "in-toto" was admitted regardless of whether the embedded DSSE envelope carried any valid signature, certificate, or transparency-log entry.

The path was introduced in #1894 and is present in v0.15.x / main.

This PR:

• Routes the discovered attestations through cosign.VerifyImageAttestation, which runs the same signature / cert / identity / transparency-log / claim checks as the legacy attestation path.
• Fixes processAttestationArtifact to hand the full DSSE envelope to static.NewAttestation (instead of an ad-hoc JSON wrapper that cosign.verifyOCIAttestation could not parse), and to reject envelopes that are missing payloadType / payload / signatures.
• Adds TestValidAttestationsOCI11_RejectsForgedDSSE, a regression test that drives validAttestations end-to-end with a forged DSSE envelope and asserts the call returns an error rather than treating the envelope as verified. The existing TestDiscoverAttestationsOCI11* tests now also exercise the verification hook via a passthrough stub.

Reproduction (without this fix)

# ClusterImagePolicy requiring SLSA provenance from a specific key:
apiVersion: policy.sigstore.dev/v1alpha1
kind: ClusterImagePolicy
metadata: { name: require-google-provenance }
spec:
  images: [{ glob: "registry.example.com/**" }]
  authorities:
  - name: google-cloud-build-key
    key: { data: "-----BEGIN PUBLIC KEY-----..." }
    attestations:
    - { name: require-provenance, predicateType: https://slsa.dev/provenance/v1 }
---
# ConfigMap enables OCI 1.1 storage discovery
data: { enable-oci11: "true" }

An attacker with push rights to the registry pushes:

1. A malicious image registry.example.com/evil@sha256:<D>.
2. An OCI 1.1 referrer manifest whose subject digest is <D>, artifactType: "application/vnd.dsse.envelope.v1+json+in-toto", with a single layer whose body is a DSSE envelope:

{
  "payloadType": "application/vnd.in-toto+json",
  "payload": "<base64 of an in-toto statement with predicateType https://slsa.dev/provenance/v1>",
  "signatures": [ { "sig": "ATTACKER_FORGED_SIGNATURE" } ]
}

The webhook returns Allowed even though the DSSE signature was never verified against the configured public key.

After this PR, the same flow returns an error from cosign.VerifyImageAttestation and the admission is rejected.

Test plan

• go test ./pkg/webhook/... — all existing tests pass, including the OCI 1.1 discovery tests
• TestValidAttestationsOCI11_RejectsForgedDSSE — new regression test passes on this branch and FAILS on main
• TestProcessAttestationArtifact/DSSE_envelope_missing_payloadType — new sub-test ensures malformed envelopes are rejected
• go build ./... clean
• gofmt -l clean