[Feature] Verify Sigstore/Fulcio certificate transparency log inclusion

[Hayden-IO]

Problem Statement

Fulcio certificates are written to a Certificate Transparency (CT) log on issuance. Note that this log is different than Rekor - Rekor accepts artifacts, the CT log only accepts certificates that chain up to Fulcio's root certificate. The CT log returns an "SCT" (signed certificate timestamp) that represents a promise to include the certificate in the log. Artifact verifiers that are trusting Fulcio certificates should verify the signature on the SCT. In doing so, they will have confidence that the certificate is written to a public log, and therefore is auditable (for example, I might monitor the CT log for my identity, to know if there's been a mis-issuance).

For the production Fulcio instance, we embed SCTs in the certificates in a custom X.509 extension, as defined by RFC6962. Note that private Fulcio instances may return the SCT as a header rather than in the extension, but consider supporting that with a lower priority since it's not in production.

In addition to verifying on artifact verification, if Kyverno does any signing, I would recommend verifying there too when Fulcio returns an issued certificate.

Code snippets:

• In Cosign, verifying the embedded SCT when validating the Fulcio certificates
• In Cosign, verifying on signing
• In Cosign, the functions that verify SCTs - You can call VerifyEmbeddedSCT with the certificate and its chain
• Fetching the CT log public key from TUF

Solution Description

I would recommend adding SCT verification.

Alternatives

No response

Additional Context

No response

Slack discussion

No response

Research

• I have read and followed the documentation AND the troubleshooting guide.
• I have searched other issues in this repository and mine is not recorded.

[welcome]

Thanks for opening your first issue here! Be sure to follow the issue template!

[flxw]

Hi, I just stumbled over this problem while playing with my private Sigstore and Kyverno.
I wrote a post on how to remedy it here: https://flxw.de/integrating-kyverno-with-a-private-sigstore-deployment.html
@realshuting - I see that you have already assigned the issue to yourself. Is there anything I help with?

[flxw]

Or would this better be addressed by setting TUF_ROOT and letting Kyverno handle cosign initialization?
I just found this here: #4091

[realshuting]

Hi @flxw - thanks for digging into the issue! Would you like to contribute a PR for this? I'd be glad to help:)

[flxw]

I think I'd like to make a contribution, I wanted to learn Go anyway :)
I stumbled upon this issue because I tried (and failed) to replicate the following cosign functionality:

cosign initialize --root root.json --mirror https://<some-tuf-mirror>

I need this in order to make kyverno work with my private SIgstore deployment, and I think it would be good to have this kind of functionality available for others, too.
Could we have a call to go over how things currently work, how to fix the current bug, and make a plan for a follow-up cosign initialization feature?

[realshuting]

Sure we can definitely set up a call together. You can find me on Kubernetes Slack @Shuting Zhao, we can chat there:)

[Hayden-IO]

Note that what I described in this issue is different than supporting private TUF deployments. TUF enables you to ship the roots of trust. The proposed feature in this issue is to add additional verification that a certificate issued from Fulcio is in a transparency log.