-
Notifications
You must be signed in to change notification settings - Fork 531
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feature: 'cosign verify' add flags --ca-roots and --ca-intermediates to allow multiple CA roots #3462
Comments
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry Savintsev <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
--ca-roots
and --ca-intermediates
to allow multiple CA roots
--ca-roots
and --ca-intermediates
to allow multiple CA roots
When looking further into the implementation, I realized there is likely a problem in terms of the possible intermediate certificates. It is not clear how the intermediate certificates would be passed if there are intermediate certificates... Currently with Now if we make an alternative
To recap, the coverage of different cases by the flags would be:
I updated the issue Subject and the proposal above, as well as the (draft) PR with a |
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Thanks for the ping @dmitris! I don't have too much to add from (This works out, since a For context, this is the route we're going down with sigstore-python: sigstore/sigstore-python#821 and sigstore/sigstore-python#779. Once we support |
Thanks for the comment @woodruffw! I can see the advantages of the "full cover" single The full migration to
|
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
@dmitris Sorry for the delayed response. Overall I'm supportive of this change. Splitting To your question about opinionated order for As you noted, you could have trusted intermediates as roots of trusts. This is where I'll differ from openssl - This is a footgun if you aren't experienced with PKI. Like you noted, what happens if the roots file contains an intermediate? I'd expect this to be a common misuse. I would prefer we require that all certs in the file are self-signed roots. I'm open to relaxing this constraint if the use-case pops up to have intermediates as the roots of trust, but we'll deal with that if/when someone asks. I agree with @woodruffw that long-term, we want to support the TrustedRoot file to align with other Sigstore clients. I also recognize this is going to be a larger change, so delaying this to be a part of the longer-term UX changes to Cosign is fine. If you wanted to take on implementing support for this as part of this work, happy to chat more. Once this change lands, along with support for the newer bundle format, we'll release 3.0 and remove the multitude of ways to specify a chain. Also @TomHennen since we've chatted about this, thoughts? |
Letting intermediates act as roots, definitely isn't what I expected! Here's a test where I try to cover the existing 'offline' uses and where I'm surprised that I can leave the root out and it still works. 75485e8#diff-29007b577f66b9fca944d7d87e89d87a1027754f251a7e41feac1e61809b6cc4R663 To some extent I think just fixing up the command line options like you're doing would solve this? I don't have an opinion on if it would be good/bad to differ fromm what openssl does. |
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to sigstore/cosign#3462. Document the new 'cosign verify' --ca-roots flag and its difference to the --certificate-chain flag. List the supported and currently unsupported use cases (single/multiple CA(s), intermediate CAs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to sigstore/cosign#3462. Document the new 'cosign verify' --ca-roots flag and its difference to the --certificate-chain flag. List the supported and currently unsupported use cases (single/multiple CA(s), intermediate CAs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to sigstore/cosign#3462. Document the new 'cosign verify' --ca-roots flag and its difference to the --certificate-chain flag. List the supported and currently unsupported use cases (single/multiple CA(s), intermediate CAs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-intermediates flag to enable to pass a PEM file with intermediate CA certificates. One can use either --ca-roots, optionally together with --ca-intermediates - or --certificate-chain, which contains zero, one or several intermediate CA certificate followed by the root CA certificate. Expand the helper Go program test/gencert/main.go to allow to generate root and intermediate CA certificates, and a certificate signed by the intermediate CA. Expand the functional test e2e_tsa_certbundle.sh to test the --ca-intermediates flag (together with --ca-roots). Fixed sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-intermediates flag to enable to pass a PEM file with intermediate CA certificates. One can use either --ca-roots, optionally together with --ca-intermediates - or --certificate-chain, which contains zero, one or several intermediate CA certificate followed by the root CA certificate. Expand the helper Go program test/gencert/main.go to allow to generate root and intermediate CA certificates, and a certificate signed by the intermediate CA. Expand the functional test e2e_tsa_certbundle.sh to test the --ca-intermediates flag (together with --ca-roots). Fixed sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-intermediates flag to enable to pass a PEM file with intermediate CA certificates. One can use either --ca-roots, optionally together with --ca-intermediates - or --certificate-chain, which contains zero, one or several intermediate CA certificate followed by the root CA certificate. Expand the helper Go program test/gencert/main.go to allow to generate root and intermediate CA certificates, and a certificate signed by the intermediate CA. Expand the functional test e2e_tsa_certbundle.sh to test the --ca-intermediates flag (together with --ca-roots). Fixed sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-intermediates flag to enable to pass a PEM file with intermediate CA certificates. One can use either --ca-roots, optionally together with --ca-intermediates - or --certificate-chain, which contains zero, one or several intermediate CA certificate followed by the root CA certificate. Expand the helper Go program test/gencert/main.go to allow to generate root and intermediate CA certificates, and a certificate signed by the intermediate CA. Expand the functional test e2e_tsa_certbundle.sh to test the --ca-intermediates flag (together with --ca-roots). Fixed sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-intermediates flag to enable to pass a PEM file with intermediate CA certificates. One can use either --ca-roots, optionally together with --ca-intermediates - or --certificate-chain, which contains zero, one or several intermediate CA certificate followed by the root CA certificate. Expand the helper Go program test/gencert/main.go to allow to generate root and intermediate CA certificates, and a certificate signed by the intermediate CA. Expand the functional test e2e_tsa_certbundle.sh to test the --ca-intermediates flag (together with --ca-roots). Fixed sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-intermediates flag to enable to pass a PEM file with intermediate CA certificates. One can use either --ca-roots, optionally together with --ca-intermediates - or --certificate-chain, which contains zero, one or several intermediate CA certificate followed by the root CA certificate. Expand the helper Go program test/gencert/main.go to allow to generate root and intermediate CA certificates, and a certificate signed by the intermediate CA. Expand the functional test e2e_tsa_certbundle.sh to test the --ca-intermediates flag (together with --ca-roots). Fixed sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to sigstore/cosign#3462. Document the new 'cosign verify' --ca-roots flag and its difference to the --certificate-chain flag. List the supported and currently unsupported use cases (single/multiple CA(s), intermediate CAs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to issue sigstore#3462. Current commit adds the flag to verify the CLI options. The new flag doesn't have any effect yet (will add in follow-up PRs). Signed-off-by: Dmitry S <dsavints@gmail.com>
Add --ca-roots command-line flag for 'cosign verify' to enable verifying cosign signatures using PEM bundles of CA roots. Whether to also add --ca-intermediates flag is TBD. Unit tests will be added in the next commit(s). Fixes sigstore#3462. Signed-off-by: Dmitry S <dsavints@gmail.com>
Related to sigstore/cosign#3462. Document the new 'cosign verify' --ca-roots flag and its difference to the --certificate-chain flag. List the supported and currently unsupported use cases (single/multiple CA(s), intermediate CAs). Signed-off-by: Dmitry S <dsavints@gmail.com>
…310) * document --ca-roots flag for 'cosign verify' Related to sigstore/cosign#3462. Document the new 'cosign verify' --ca-roots flag and its difference to the --certificate-chain flag. List the supported and currently unsupported use cases (single/multiple CA(s), intermediate CAs). Signed-off-by: Dmitry S <dsavints@gmail.com> * add docs on --ca-intermediates for 'cosign verify' Signed-off-by: Dmitry S <dsavints@gmail.com> * markdown fixes - add empty lines around shell backticks Signed-off-by: Dmitry S <dsavints@gmail.com> --------- Signed-off-by: Dmitry S <dsavints@gmail.com>
Description
Problem
Currently you can call
cosign verify --certificate-chain
with a file that contains a single CA root certificate and possibly related intermediate certificates. However, in a production environment with BYO CA (no Fulcio - as in [1], for example), due to the multiregion cloud redundancy, there may be multiple CAs that issue codesigning certificate, and it is necessary to be able to pass a certificate bundle file tocosign verify
- otherwise the users ofcosign verify
would need to manually implement the "trial-and-error" loop callingcosign verify
with different CA certificates passed as--certificate-chain
values until the command succeeds! Needless to say, this would not be a good user experience 😄Proposed Solution
add a new
--ca-roots
and--ca-intermediates
optional flags forcosign verify
and the related commands (verify-attestation
,verify-blob
,verify-blob-attestation
) which would allow to pass a CA Roots certificate bundle PEM file as well as one for the Intermediate Certificates.. The--ca-roots
and--ca-intermediates
would be mutually exclusive with the--certificate-chain
parameter - should use one or the other but not both.Miscellaneous
https://docs.sigstore.dev/system_config/custom_components/ indicates "a last resort" configuration option with the environment variable
SIGSTORE_ROOT_FILE
:However, this doesn't help to solve the stated problem - relying on the environment variable is inconvenient and fragile in a production deployment, and the documentation talks about the file containing a single certificate, not a certificate bundle with multiple CA roots.
References
[1] Scaling Up Supply Chain Security: Implementing Sigstore for Seamless Container Image Signing
Below is list of issues that are related to x509 and certificates:
cosign sign-blob
should accept--certificate
and--certificate-chain
#2635/cc @woodruffw
The text was updated successfully, but these errors were encountered: