Code Distribution Integrity Assurance using Helm Provenance and Integrity

[bukasaaime]

Request Summary:

Helm has provenance tools which help chart users verify the integrity and origin of a package. Using industry-standard tools based on PKI, GnuPG, Keybase.io and well-respected package managers, Helm can generate and verify signature files.

Implementing Helm Provenance and Integrity for Mojaloop installation packaged chart, will constitute Mojaloop cryptographic Code Signing.

Request Details:

• Deadline: Soon after DA meeting / discussions.
• Impact (Teams): Code Quality Security, DevSecOps and DevOps
• Impact (Components): Mojaloop codebase and documentation

Artifacts:

• Artifact to consider @bukasaaime , @mdebarros

https://helm.sh/docs/topics/provenance/

Dependencies:

• If Applicable

Accountability:

• Owner: @godfreykutumela
• Raised By: @bukasaaime

Decision(s):

• Approved By:

Details

• Actual decision made as a result of discussion

Follow-up:

• Actions to implement the decisions

[bukasaaime]

Update

We have done a proposal to have Mojaloop helm release code signed using

1. Keybase.io GPG keys,
2. Kubernetes commands
3. Helm package manager,
4. Helm chart(s),
5. Github,
6. Circle CI,
7. npm packages
8. Docker images, flags and hash values.
9. The Mojaloop customization trough external configs (including the default config),
10. mojaloop.io site for publication of Mojaloop helm release versions and hash values.
11. signature verification by a Mojaloop user
12. installation by Mojaloop user.

We are seeking approval from the DA.

[bukasaaime]

Keybase.io is an elegant solution for hosting GPG keys for establishing Provenance and managing developers chain of trust. It is recommended by the Helm documentation https://helm.sh/docs/topics/provenance/ and is optional. It is open source, very secure and used by many developers around the world.

[godfreykutumela]

@MichaelJBRichards This is now approved by the DA for testing and implementation on the condition that appropriate documentation explaining this is included in the standard section of the community guides. The helm release note will reference this only on the first release and thereafter removed.

Implementation Plan:

• Release initial documentation by 30 August 2022
• Start testing the solution from 29 August 2022 - @bukasaaime will be the lead for the security team and I guess @mdebarros for the DevOps team
• Once testing is completed, then we can aim to implement this with the next helm release - @mdebarros and @elnyry-sam-k to advise on the helm release schedule