Enable `--template` option to use with `sign-image` (for use with HSMs, for example) #112

svenkata9 · 2022-12-09T12:31:16Z

Signed-off-by: Sankaranarayanan Venkatasubramanian sankaranarayanan.venkatasubramanian@intel.com

Description

The gsc tool cannot do production signing on the gramized docker images today, and this PR enables that. This PR introduces passing a 'self-contained' Dockerfile as an argument to gsc sign-image with the option --template. For example, using a template like this, we can do production signing with Azure Key Vault. Once this PR is merged, contrib repo will be updated with templates for Azure Key Vault and OpenSSL engine.

How to test this PR?

For testing this PR, you will need to use the Dockerfile template mentioned above for use with AKV, or create one based on this for using local signing. and then you will be able to sign the unsigned gsc image using ./gsc sign-image --template Dockerfile.sign.akv.debian.template

This change is

… for example) Signed-off-by: Sankaranarayanan Venkatasubramanian <sankaranarayanan.venkatasubramanian@intel.com>

dimakuv

Reviewed 5 of 5 files at r1, all commit messages.
Reviewable status: all files reviewed, 11 unresolved discussions, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @svenkata9)

a discussion (no related file):
You need to update the docs:

https://gramine.readthedocs.io/projects/gsc/en/latest/#gsc-sign-image-signs-a-graminized-image -- add --template option
https://gramine.readthedocs.io/projects/gsc/en/latest/#stages-of-building-graminized-sgx-docker-images -- in stage 3, mention that users can also supply their own Dockerfile templates, to e.g. sign with HSM flows.

a discussion (no related file):
I'm not sure if --template is the best name for this option. Maybe --custom-dockerfile? I don't know, I can't come up with a better name. So not blocking.

a discussion (no related file):
The user needs to manually modify the templates, e.g. specify the AKV URL: https://github.com/svenkata9/contrib/blob/54ee9fc3aa1ba367bf203f769c51b555a8310576/Integrations/azure/akv-sign/Dockerfile.sign.akv.debian.template#L23

It would be better to provide such names (e.g. AKV URL) in the gsc sign-image command itself. But on the other hand, I understand that this won't be extensible and only confusing...

-- commits line 2 at r1:
This commit title is too long. Let's split into two: title and message body:

Add `--template` option to use with `sign-image` command

Currently `gsc sign-image` command only provides one way to
sign images -- using Gramine's default `gramine-sgx-sign` tool;
this logic is encapsulated in `Dockerfile.common.sign.template`.

This commit adds the ability to sign images using user-specified
tools, e.g. for signing with hardware HSMs provided by Azure KeyVault
and OpenSSL engine.

.gitignore line 24 at r1 (raw file):

*.sig
*.token
/templates/Dockerfile.sign.user.template

This doesn't look right. I suggest:

Add the removal of this file in gsc.py (in the finally clause)
Remove this line from here.

gsc.py line 353 at r1 (raw file):

    distro, _ = distro.split(':')
    env.loader = jinja2.FileSystemLoader('templates/')
    sign_template = []

This should be sign_template = None

gsc.py line 354 at r1 (raw file):

    env.loader = jinja2.FileSystemLoader('templates/')
    sign_template = []
    build_args = []

This should be a dict, not a list: build_args = {}

gsc.py line 370 at r1 (raw file):

    else:
        shutil.copy(args.template, 'templates/Dockerfile.sign.user.template')
        sign_template = env.get_template(f'{distro}/Dockerfile.sign.user.template')

Actually, don't you want to propagate the key into the user template:

        build_args = {"key": args.key}

this way users won't need to manually modify this line in the template: https://github.com/svenkata9/contrib/blob/54ee9fc3aa1ba367bf203f769c51b555a8310576/Integrations/azure/akv-sign/Dockerfile.sign.akv.debian.template#L24

See the example with passphrase usage here:

gsc/templates/Dockerfile.common.sign.template

Line 5 in b7f0576

ARG passphrase

gsc.py line 382 at r1 (raw file):

    finally:
        if args.template is None:
            os.remove(tmp_build_key_path)

Please add the removal of the copied templates/Dockerfile.sign.user.template, smth like:

    else:
        os.remove('templates/Dockerfile.sign.user.template')

gsc.py line 516 at r1 (raw file):

sub_sign.add_argument('-k', '--key', help='Key to sign the Intel SGX enclaves inside the Docker image.')
sub_sign.add_argument('-t', '--template',
                      help='Custom Dockerfile/template to use for signing, say, with a HSM.')

say, with a HSM -> e.g. with an HSM

templates/ubuntu/Dockerfile.sign.user.template line 2 at r1 (raw file):

{% extends "debian/Dockerfile.sign.user.template" %}

Please remove this empty line.

dimakuv

Reviewable status: all files reviewed, 12 unresolved discussions, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ) (waiting on @svenkata9)

templates/centos/Dockerfile.sign.user.template line 1 at r1 (raw file):

{% extends "Dockerfile.sign.user.template" %}

As I mentioned in gramineproject/contrib#20, I don't think you need these three new template files at all.

…h HSMs, for example)

svenkata9

Reviewable status: 3 of 6 files reviewed, 12 unresolved discussions, not enough approvals from maintainers (2 more required), not enough approvals from different teams (2 more required, approved so far: ), "fixup! " found in commit messages' one-liners (waiting on @dimakuv)

a discussion (no related file):