Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add registry certificate verification support #1734

Merged
merged 8 commits into from
Aug 29, 2023

Conversation

5p2O5pe25ouT
Copy link
Contributor

@5p2O5pe25ouT 5p2O5pe25ouT commented Apr 13, 2023

I want to help add support for carrying certificates when Syft scans the registry. Supported configurations are:

...MTLS for a specific registry:

# .syft.yaml
registry:
  ca-cert: "./ca-certs/myreg.crt"     # trust a specific CA cert

  auth:
   # note: no user/pass was provided, so the keychain will be used for basic auth
    - authority: "myregistry.com"
      tls-cert: "./certs/myreg-client.crt"
      tls-key: "./certs/myreg-client.key"

... MTLS for multiple registries:

# .syft.yaml
registry:
  ca-cert: "./ca-certs"     # trust all in all *.crt files in a dir as root CAs

  auth:

    - authority: "myregistry.com"
      tls-cert: "./certs/myreg-client.crt"
      tls-key: "./certs/myreg-client.key"

    - authority: "otherreg.com"
      tls-cert: "./certs/other-client.crt"
      tls-key: "./certs/other-client.key"

... configure via environment variables:

export SYFT_REGISTRY_CA_CERT="./ca-certs/"
export SYFT_REGISTRY_AUTH_TLS_CERT="./certs/myreg-client.crt"
export SYFT_REGISTRY_AUTH_TLS_KEY="./certs/other-client.key"

which will be the same as:

registry:
  ca-cert: "./ca-certs"   

  auth:

    - authority: ""
      tls-cert: "./certs/myreg-client.crt"
      tls-key: "./certs/myreg-client.key"

...which will offer the client cert during TLS negotiation to any registry that will accept it.

Pulls in features from anchore/stereoscope#169 and anchore/stereoscope#195

@spiffcs spiffcs self-requested a review June 22, 2023 16:21
@wagoodman wagoodman self-assigned this Jun 22, 2023
@wagoodman wagoodman added the enhancement New feature or request label Aug 24, 2023
@wagoodman wagoodman changed the title add registry certificate verification support Add registry certificate verification support Aug 24, 2023
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
@wagoodman wagoodman merged commit b03e9c6 into anchore:main Aug 29, 2023
9 checks passed
GijsCalis pushed a commit to GijsCalis/syft that referenced this pull request Feb 19, 2024
* add registry certificate verification support

* replace stereoscope version

* modify go.mod

* pull in stereoscope update

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename registry cert options, add docs, and add test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update to account for changes in anchore/stereoscope#195

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: lishituo <24578666@qq.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

None yet

2 participants