Deduplicate one attestation over multiple images

[znewman01]

    @asraa Would it be possible for cosign to be modified to allow it to attest multiple images with a single predicate?

For knative, I build multiple images with ko but I need to attach a single attestation to all the images that I build.

# Before calling sign_release, we do ko resolve first and get a bunch of yaml files with images built by ko. Then we read all those files and pull out the images and store them in a single file called imagerefs.txt

function sign_release() {
  ID_TOKEN=$(gcloud auth print-identity-token --audiences=sigstore \
    --include-email \
    --impersonate-service-account="${SIGNING_IDENTITY}")
  echo "Signing Images with the identity ${SIGNING_IDENTITY}"
  ## Sign the images with cosign
  if [[ -f "imagerefs.txt" ]]; then
      COSIGN_EXPERIMENTAL=1 cosign sign $(cat imagerefs.txt) --recursive --identity-token="${ID_TOKEN}"
      if  [ -n "${ATTEST_IMAGES:-}" ]; then # Temporary Feature Gate
        provenance-generator --clone-log=/logs/clone.json \
          --image-refs=imagerefs.txt --output=attestation.json
        COSIGN_EXPERIMENTAL=1 cosign attest $(cat imagerefs.txt) --recursive --identity-token="${ID_TOKEN}" \
          --predicate=attestation.json --type=slsaprovenance
      fi
  fi

}

Having to attest each image separately is annoying and doesn't look really good.

 REDACTED  MCW0CDP3YY  ~  $  cosign tree gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:v20221123-0c20c48d
📦 Supply Chain Security Related artifacts for an image: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:v20221123-0c20c48d
└── 🔐 Signatures for an image tag: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:sha256-51351c6bbb9a1ef81a23fbdcd0fd5cb6660a93e080ff4fec5dbbb235bd4562aa.sig
   ├── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
   ├── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
   ├── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
   ├── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
   ├── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
   ├── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
   └── 🍒 sha256:def545cfb64af1c6d43650a378fbcc08816c6d2adbadb3b12b55f82289c2cebf
└── 📦 SBOMs for an image tag: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:sha256-51351c6bbb9a1ef81a23fbdcd0fd5cb6660a93e080ff4fec5dbbb235bd4562aa.sbom
   └── 🍒 sha256:c2996953a9d0befe81ecbf12521245b32a93e336e2346e86b624c5fd5dc56fb5
└── 💾 Attestations for an image tag: gcr.io/knative-nightly/knative.dev/net-contour/cmd/controller:sha256-51351c6bbb9a1ef81a23fbdcd0fd5cb6660a93e080ff4fec5dbbb235bd4562aa.att
   ├── 🍒 sha256:705676515c619e186ed78d89e5997d794dcf10c971029bf34126cd153ee7eb2b
   ├── 🍒 sha256:173687aad52bf482ac9a6699c47b97a567d738c440c4509cf3f74a9c347c9b5e
   ├── 🍒 sha256:4e2d0081c8d1c9c574281e326d4847bb525c195ecf3b5f0354f595e258c7e34c
   ├── 🍒 sha256:f9c1947602e3f8e12bd342c641b001eb84943d992654d97b30b7067846b313fb
   ├── 🍒 sha256:10cc6e263f46ed101738215e7182ca74f5e8ccf6ee0d7dc141e91774b45558b9
   ├── 🍒 sha256:043d353999710b89e6025467c5a51e5c142109c17084288a1dba765c4ba94f80
   └── 🍒 sha256:703a183ee06c4652ea85f52753c5ec4321ca4a23f5e9cc679c21d8c8f5c295ab

Originally posted by @upodroid in #2394 (comment)

Would it be possible for cosign to be modified to allow it to attest multiple images with a single predicate?

@upodroid Are you basically asking for all of the sha256:def... from your example to be deduplicated? That feels reasonable. I'm not totally sure how we wind up with the duplicate entries, but presumably there's some place during the attest process where we could just remove duplicates from a list.

[upodroid]

I have two separate requests.

1. Deduplicate signatures. I'm seeing cases where cosign is sending duplicate signatures to the registry. Image Signing Status knative/test-infra#3615

2. Creating a single attestation with multiple subjects (images)

[znewman01]

CC @asraa

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue was closed because it has been stalled for 5 days with no activity.

[znewman01]

Still a good idea

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue was closed because it has been stalled for 5 days with no activity.