[GHSA-5c53-pm9x-v2gr] Vulnerability Disclosure and Image Attestation issues

[gmpinder]

This is a responsible disclosure of a moderate vulnerability (GHSA-5c53-pm9x-v2gr) that involves a Time of Check, Time of Use (TOCTOU) attack. This vulnerability requires the attacker have access to a key that can push to your registry. There is a span of time between when the build pushes the image and when it gets the digest over the internet to use for signing. This is very problematic when you have a multi-arch bulid as the logic was setup to wait for all builds to finish before getting the digests.

The solution was to get the digest file from the push command and bring it back up the chain. This ensures that every images is accounted for properly. This was fixed and released in v0.9.38.

However, you may have noticed we had several patches in the past week. This has caused attestation issues for images built on tags v0.9.38-v0.9.40. There is an ongoing issue for trying to fix the floating tag publish. Until that is fixed, I suggest you pin your version of the cli to v0.9.41 until we have a fixed build.

The published code on crates.io for this version range is perfectly fine building from source. It's only the CLI image's attestation that is the issue.

Thanks for your patience everyone!

EDIT: You no longer have to pin your version of the CLI in the GitHub Action. Version v0.9.42 was released with image tags fixed