Add RFC for cosign integration #195

samj1912 · 2021-12-03T02:11:01Z

Signed-off-by: Sambhav Kothari skothari44@bloomberg.net

Fixes #192

Readable

Debatable points -

Dealing with daemon use case?
pack v/s lifecycle support?
SBOM future (for now this just exports the SBOM in cosign format but also continues to use the existing way of storing it in the app image for restore/rebuild)

buildpack-bot · 2021-12-03T02:11:45Z

Maintainers,

As you review this RFC please queue up issues to be created using the following commands:

/queue-issue <repo> "<title>" [labels]...
/unqueue-issue <uid>

Issues

(none)

dlorenc · 2021-12-03T03:04:43Z

Cosign maintainer here! We'd love any feedback on the SBOM use case. This is really just a first draft based on how we guessed people might use it. If there's anything you don't like or we could change to make things easier we can do that! I'm excited to see it used here at all.

text/0000-cosign.md

jabrown85 · 2021-12-09T15:34:44Z

text/0000-cosign.md

+# Motivation
+[motivation]: #motivation
+
+Supply chain security has been on top of everyone's minds in 2021. It is important to ensure the integrity and origin of software artifacts in order to have a secure supply chain. Sigstore's cosign has quikcly risen to become the defacto container signing solution. This RFC proposes that we natively add cosign support to the lifecycle to facilitate easy signed container artifacts as part of the build process.


Suggested change

Supply chain security has been on top of everyone's minds in 2021. It is important to ensure the integrity and origin of software artifacts in order to have a secure supply chain. Sigstore's cosign has quikcly risen to become the defacto container signing solution. This RFC proposes that we natively add cosign support to the lifecycle to facilitate easy signed container artifacts as part of the build process.

Supply chain security has been on top of everyone's minds in 2021. It is important to ensure the integrity and origin of software artifacts in order to have a secure supply chain. Sigstore's cosign has quickly risen to become the defacto container signing solution. This RFC proposes that we natively add cosign support to the lifecycle to facilitate easy signed container artifacts as part of the build process.

natalieparellano · 2022-01-03T21:17:39Z

text/0000-cosign.md

+# Drawbacks
+[drawbacks]: #drawbacks
+
+Increased complexity in lifecycle


I recall we discussed this in sub sync, but is it possible to add the advantage of having the lifecycle do the signing vs leaving it up to the platform?

How does it increase the complexity here ? Could someone add more details ?

I believe this is no longer going to be part of the lifecycle and should be updated.

If this moves outside lifecycle to being a platform responsibility, does the binary belong within the lifecycle distribution?

Probably not... but in this case pack create builder should be expanded to include optional platform-provided binaries within the builder at the desired location.

text/0000-cosign.md

Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>

jromero

If I recall correctly, this RFC falls under the same idea as other external operations such as preparer. Those of which I believe we would develop PoCs independently and try to incorporate back into the project via these guidelines. If so, should this be a draft or closed?

jromero · 2022-03-22T19:20:56Z

text/0000-cosign.md

+# Motivation
+[motivation]: #motivation
+
+Supply chain security has been on top of everyone's minds in 2021. It is important to ensure the integrity and origin of software artifacts in order to have a secure supply chain. Sigstore's cosign has quikcly risen to become the defacto container signing solution. This RFC proposes that we natively add cosign support to the lifecycle to facilitate easy signed container artifacts as part of the build process.


Suggested change

Supply chain security has been on top of everyone's minds in 2021. It is important to ensure the integrity and origin of software artifacts in order to have a secure supply chain. Sigstore's cosign has quikcly risen to become the defacto container signing solution. This RFC proposes that we natively add cosign support to the lifecycle to facilitate easy signed container artifacts as part of the build process.

Supply chain security has been on top of everyone's minds in 2021-2022. It is important to ensure the integrity and origin of software artifacts in order to have a secure supply chain. Sigstore's cosign has quikcly risen to become the defacto container signing solution. This RFC proposes that we natively add cosign support to the lifecycle to facilitate easy signed container artifacts as part of the build process.

😜

samj1912 · 2022-03-24T10:32:40Z

If I recall correctly, this RFC falls under the same idea as other external operations such as preparer. Those of which I believe we would develop PoCs independently and try to incorporate back into the project via these guidelines. If so, should this be a draft or closed?

I would prefer if this was a repo under buildpacks org, potentially under the platform team since pack would be the first target usecase. It would make it easier to manage/review/depend on repositories that fall under the buildpacks org umbrella.

hone · 2022-04-06T17:42:52Z

Is the only outstanding issue of how we proceed with a PoC/where the work happens?

samj1912 · 2022-04-06T22:30:21Z

Is the only outstanding issue of how we proceed with a PoC/where the work happens?

Pretty much

jromero · 2022-04-08T21:47:17Z

text/0000-cosign.md

+[spec-changes]: #spec-changes
+
+
+Noted above.


I'm not sure I understand this remark. Are there spec changes involved in this RFC?

Also a leftover.

jromero · 2022-04-08T21:50:15Z

text/0000-cosign.md

+# Motivation
+[motivation]: #motivation
+
+Supply chain security has been on top of everyone's minds in 2021. It is important to ensure the integrity and origin of software artifacts in order to have a secure supply chain. Sigstore's cosign has quikcly risen to become the defacto container signing solution. This RFC proposes that we natively add cosign support to the lifecycle to facilitate easy signed container artifacts as part of the build process.


Is this "native"? From what I last recall, this was going to follow the same path as preparer and publisher where it wouldn't be a part of the lifecycle per se.

Ah yes, it's a leftover from the old rfc. Will clean it up.

jromero · 2022-05-27T15:03:31Z

@samj1912 as we discussed, this RFC requires a few set of changes to align with the latest agreed upon strategy. Please let me know when it's updated and I'll review/start the voting period.

natalieparellano · 2022-11-30T14:40:29Z

@samj1912 what is the status of this RFC? Is this still something we want to do?

cmoulliard · 2023-06-23T15:43:09Z

text/0000-cosign.md

+- Supersedes: (put "N/A" unless this replaces an existing RFC, then link to that RFC)
+
+# Summary
+[summary]: #summary


This RFC supports indeed to sign an existing SBoM but also to export the attestation or attachment. Summary text should be reviewed

cmoulliard · 2023-06-23T15:44:21Z

text/0000-cosign.md

+- Verify that it has read access to the registries where the output images from `exporter` are stored and that their digests match the ones in `report.toml`
+- Verify that it has write access to the registries where it needs to output the signatures and attestations.
+- Generate cosign signatures for all the images along with the provided annotations.
+- If `export-sbom` is set to a value not equal to `none`, export the sbom accordingly as a cosign attestation or an attachment depending on the value. The default value is `attestation`. The SBOM will be fetched from the output image in the registry stored as defined in the platform API.


Where will the attestation or SBom file (= attachement I suppose ?) been exported ?

samj1912 requested a review from a team as a code owner December 3, 2021 02:11

samj1912 added the team/implementation label Dec 3, 2021

github-actions bot assigned nebhale Dec 3, 2021

samj1912 mentioned this pull request Dec 5, 2021

Add support for reading SBOMs on the image attached by buildpacks anchore/grype#520

Open

jabrown85 reviewed Dec 8, 2021

View reviewed changes

text/0000-cosign.md Outdated Show resolved Hide resolved

hone requested review from hone, jkutner and nebhale December 8, 2021 19:42

jabrown85 reviewed Dec 9, 2021

View reviewed changes

natalieparellano reviewed Jan 3, 2022

View reviewed changes

nebhale suggested changes Jan 6, 2022

View reviewed changes

text/0000-cosign.md Outdated Show resolved Hide resolved

hone requested a review from ekcasey January 12, 2022 19:44

ekcasey reviewed Jan 14, 2022

View reviewed changes

text/0000-cosign.md Outdated Show resolved Hide resolved

Add RFC for cosign integration

2caf23c

Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>

samj1912 force-pushed the cosign branch from ac39524 to 2caf23c Compare February 23, 2022 19:06

jromero mentioned this pull request Mar 1, 2022

Add prepare operation RFC #202

Draft

ekcasey requested review from ekcasey and nebhale March 9, 2022 19:33

jromero requested changes Mar 22, 2022

View reviewed changes

hone added team/platform scope/team RFC scoped to a sub-team as opposed to the entire project. and removed team/implementation labels Mar 23, 2022

hone unassigned nebhale Mar 23, 2022

samj1912 requested a review from jromero April 8, 2022 18:59

jromero reviewed Apr 8, 2022

View reviewed changes

This was referenced Apr 14, 2022

Add spec changes for image extensions buildpacks/spec#298

Closed

Allow platforms to provide run image sboms #211

Closed

jromero self-assigned this May 31, 2022

samj1912 mentioned this pull request Jun 7, 2022

sign container images after built buildpacks/pack#1443

Closed

1 task

natalieparellano added the type/rfc label Oct 31, 2022

natalieparellano unassigned jromero Oct 31, 2022

natalieparellano added the status/needs-steward label Oct 31, 2022

samj1912 mentioned this pull request Feb 26, 2023

SBOM layer support #278

Open

natalieparellano added scope/project and removed scope/team RFC scoped to a sub-team as opposed to the entire project. labels Mar 1, 2023

cmoulliard reviewed Jun 23, 2023

View reviewed changes

natalieparellano self-assigned this Aug 16, 2023

natalieparellano added status/steward-assigned and removed status/needs-steward labels Aug 16, 2023

jjbustamante mentioned this pull request Apr 19, 2024

Consider signing tags of releases buildpacks/pack#2138

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add RFC for cosign integration #195

Add RFC for cosign integration #195

samj1912 commented Dec 3, 2021 •

edited

buildpack-bot commented Dec 3, 2021

dlorenc commented Dec 3, 2021

jabrown85 Dec 9, 2021

natalieparellano Jan 3, 2022

hectorj2f Jan 13, 2022

jromero May 27, 2022

AidanDelaney Feb 13, 2023

natalieparellano Feb 13, 2023

jromero left a comment •

edited

jromero Mar 22, 2022

samj1912 commented Mar 24, 2022

hone commented Apr 6, 2022

samj1912 commented Apr 6, 2022

jromero Apr 8, 2022

samj1912 Apr 8, 2022

jromero Apr 8, 2022

samj1912 Apr 8, 2022

jromero commented May 27, 2022

natalieparellano commented Nov 30, 2022

cmoulliard Jun 23, 2023

cmoulliard Jun 23, 2023

		[spec-changes]: #spec-changes


		Noted above.

Add RFC for cosign integration #195

Are you sure you want to change the base?

Add RFC for cosign integration #195

Conversation

samj1912 commented Dec 3, 2021 • edited

buildpack-bot commented Dec 3, 2021

Issues

dlorenc commented Dec 3, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jromero left a comment • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

samj1912 commented Mar 24, 2022

hone commented Apr 6, 2022

samj1912 commented Apr 6, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jromero commented May 27, 2022

natalieparellano commented Nov 30, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

samj1912 commented Dec 3, 2021 •

edited

jromero left a comment •

edited