feature: add TSA support when verifying authorities #468

hectorj2f · 2022-12-23T12:36:41Z

Signed-off-by: Hector Fernandez hector@chainguard.dev

Summary

We are adding support to verify images using timestamp authorities. To test it, we use scaffolding and a working branch to install cosign v2.0.0-rc so we can use TSA verifications (sigstore/cosign-installer#105).

Release Note

Add support to verify images using timeStamp authorities.

Documentation

codecov-commenter · 2022-12-23T12:41:49Z

Codecov Report

Merging #468 (b5766e5) into main (9d7bafc) will decrease coverage by 0.92%.
The diff coverage is 15.17%.

@@            Coverage Diff             @@
##             main     #468      +/-   ##
==========================================
- Coverage   55.66%   54.73%   -0.93%     
==========================================
  Files          38       38              
  Lines        3992     4129     +137     
==========================================
+ Hits         2222     2260      +38     
- Misses       1598     1688      +90     
- Partials      172      181       +9

Impacted Files	Coverage Δ
pkg/apis/config/sigstore_keys.go	`29.31% <ø> (ø)`
...g/apis/policy/v1alpha1/clusterimagepolicy_types.go	`0.00% <ø> (ø)`
pkg/apis/policy/v1alpha1/zz_generated.deepcopy.go	`12.65% <0.00%> (-0.40%)`	⬇️
...kg/apis/policy/v1beta1/clusterimagepolicy_types.go	`0.00% <ø> (ø)`
pkg/apis/policy/v1beta1/zz_generated.deepcopy.go	`19.93% <0.00%> (-1.02%)`	⬇️
pkg/webhook/validator.go	`61.91% <0.00%> (-3.56%)`	⬇️
...s/policy/v1alpha1/clusterimagepolicy_validation.go	`92.24% <57.14%> (-1.06%)`	⬇️
...is/policy/v1beta1/clusterimagepolicy_validation.go	`94.18% <62.50%> (-1.09%)`	⬇️
...s/policy/v1alpha1/clusterimagepolicy_conversion.go	`76.72% <100.00%> (+0.83%)`	⬆️
pkg/apis/policy/v1alpha1/trustroot_validation.go	`43.35% <0.00%> (+12.72%)`	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

vaikas · 2022-12-23T18:40:30Z

test/testdata/trustroot/e2e/with-tsa.yaml

+  name: my-sigstore-keys
+spec:
+  sigstoreKeys:
+    timestampAuthorities:


The TrustRoot "my-sigstore-keys" is invalid: spec.sigstoreKeys.certificateAuthorities: Invalid value: "null": spec.sigstoreKeys.certificateAuthorities in body must be of type array: "null" Error: Process completed with exit code 1.

Don't we still need the signing CA added? It's currently listed as 'required', so if this is a bad assumption we need to relax it in the trustroot API.

I am still working on this ... thanks for looking at it. I am adding a WIP.

I'll complete the tests.

Oh no worries, was just thinking through my assumptions on how things work :) My thinking has been that there always has to be a CA, but maybe that's wrong.

Don't we still need the signing CA added? It's currently listed as 'required', so if this is a bad assumption we need to relax it in the trustroot API.

You can sign using the TSA as verification and a raw key without anything else.

We should relax the validation.

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

hectorj2f · 2022-12-27T16:30:13Z

.github/workflows/kind-cluster-image-policy-tsa.yaml

+      with:
+        mirror: mirror.gcr.io
+
+    - uses: hectorj2f/cosign-installer@c5ac9ce01eb4b0048c02123cb3721624c8f4dc55 # v2


I am waiting for a decision so we can install cosign v2 and RC versions via sigstore/cosign-installer#105

I created #478 to track this change.

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

mattmoor

Can you open tracking issues for updating the installer/tsa/cosign deps once they are released with the changes we need?

hectorj2f · 2022-12-28T20:50:57Z

@mattmoor Yes, I'll create one issue. I am working myself on the change too sigstore/cosign-installer#105.

hectorj2f self-assigned this Dec 23, 2022

hectorj2f mentioned this pull request Dec 23, 2022

WIP: Add time-stamping signature verification #391

Closed

hectorj2f changed the title ~~WIP: Add TSA support when verifying authorities~~ Add TSA support when verifying authorities Dec 23, 2022

hectorj2f force-pushed the add_tsa_support branch from 1b396a1 to 3cbfc71 Compare December 23, 2022 16:13

vaikas reviewed Dec 23, 2022

View reviewed changes

hectorj2f changed the title ~~Add TSA support when verifying authorities~~ WIP: Add TSA support when verifying authorities Dec 23, 2022

hectorj2f added 5 commits December 25, 2022 23:24

add TSA support

4158a25

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

set tsa go deps

c9f4fd2

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

docs: add new api field RFC3161timestamp

1ec0d8e

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

add e2e tests for TSA

24a5046

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

test: use the local tsa

9f7e7b8

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

hectorj2f force-pushed the add_tsa_support branch from 3cbfc71 to 9f7e7b8 Compare December 25, 2022 23:52

tests: update more testdata

3074163

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

hectorj2f force-pushed the add_tsa_support branch from 363bed2 to 3074163 Compare December 26, 2022 20:25

test my custom cosign-installer of v2 rc versions

f1f9e6a

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

hectorj2f force-pushed the add_tsa_support branch 3 times, most recently from cb72c04 to f39b4e6 Compare December 27, 2022 09:38

test: remove force flag from cosign sign cmd

b3bf7db

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

hectorj2f force-pushed the add_tsa_support branch from f39b4e6 to b3bf7db Compare December 27, 2022 10:02

test: create the cip once the trustroot was created

3f9ef92

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

hectorj2f changed the title ~~WIP: Add TSA support when verifying authorities~~ feature: add TSA support when verifying authorities Dec 27, 2022

hectorj2f added the feature label Dec 27, 2022

hectorj2f commented Dec 27, 2022

View reviewed changes

test: add job rejection test case

e37beb4

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

hectorj2f force-pushed the add_tsa_support branch 2 times, most recently from 03147c8 to 7b585e6 Compare December 28, 2022 19:34

test: add TSA failed verification test case

b5766e5

Signed-off-by: Hector Fernandez <hector@chainguard.dev>

hectorj2f force-pushed the add_tsa_support branch from 7b585e6 to b5766e5 Compare December 28, 2022 19:55

hectorj2f requested review from vaikas and mattmoor December 28, 2022 20:22

mattmoor approved these changes Dec 28, 2022

View reviewed changes

hectorj2f requested review from cpanato and dlorenc December 28, 2022 20:59

priyawadhwa approved these changes Dec 29, 2022

View reviewed changes

hectorj2f merged commit d6ef1f3 into sigstore:main Dec 29, 2022

hectorj2f deleted the add_tsa_support branch December 29, 2022 05:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feature: add TSA support when verifying authorities #468

feature: add TSA support when verifying authorities #468

hectorj2f commented Dec 23, 2022 •

edited

Loading

codecov-commenter commented Dec 23, 2022 •

edited

Loading

vaikas Dec 23, 2022

hectorj2f Dec 23, 2022

hectorj2f Dec 23, 2022

vaikas Dec 23, 2022

hectorj2f Dec 25, 2022

hectorj2f Dec 25, 2022

hectorj2f Dec 27, 2022

hectorj2f Dec 27, 2022

hectorj2f Dec 28, 2022

mattmoor left a comment

hectorj2f commented Dec 28, 2022

feature: add TSA support when verifying authorities #468

feature: add TSA support when verifying authorities #468

Conversation

hectorj2f commented Dec 23, 2022 • edited Loading

Summary

Release Note

Documentation

codecov-commenter commented Dec 23, 2022 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mattmoor left a comment

Choose a reason for hiding this comment

hectorj2f commented Dec 28, 2022

hectorj2f commented Dec 23, 2022 •

edited

Loading

codecov-commenter commented Dec 23, 2022 •

edited

Loading