EXPERIMENTAL FEATURE: Sigstore/Cosign Support

[xopham]

With #107, we are adding experimental support for Cosign from the SigStore Project that provides "Container Signing, Verification and Storage in an OCI registry". Thus, we enable an additional container image signature solution besides Notary v1 / Docker Content Trust.

The support is currently in experimental state and we'd love to get your feedback!

[maltefiala]

Great feature. However, it seems as if custom repositories are not supported at the moment:

kubectl apply -f testimage.yaml
Error from server: error when creating "testimage.yaml": admission webhook "connaisseur-svc.connaisseur.svc" denied the request: unexpected cosign exception for image "XXXXX": error: GET XXXXX : Authentication is required

[xopham]

Thanks for sharing your feedback @maltefiala! Which registry (configuration) are you using? From the error message, it seems to be an authentication issue, so I presume that by "custom registry", you probably refer to a private registry meaning that pulling the image or signature data for that matter requires authentication, right? Have you tried on a public image?
However, docker.io for example tends to respond with an authentication error even if the image does not exist which I guess is meant to avoid unwanted information disclosure on the existence of container images.

In case of private images: At this experimental stage, we simply injected the cosign binary into connaisseur and then call that from python. However, cosign uses the local docker context and as we do not provide any, this means we are not able to pull from private registries at the moment. Currently, we are extending Connaisseur for proper multi-validator support (I described the plans here in #151 ) by which we will make the tool much more extendable and rework the configuration via helm/values.yaml. Once that's done, we'll probably implement our own cosign signature validation (see #142) and by this can also pass authentication for private registries. So I guess, it is still a few steps to go 👩‍💻 , but I hope we manage to get there soon 🚀

[xopham]

@maltefiala Cosign authentication is now supported as by #179 in Connaisseur 2.0. Feel free to checkout the docs to get started. There is some more details on Cosign authentication in the validator section

[zosocanuck]

Hi,

I'm using cosign with connaisseur and after following all the instructions I'm still getting:

Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: no trust data for image xxx

[2021-06-29 15:19:23,830] INFO: COSIGN output for image: docker.io/xxx/yyy:latest; RETURNCODE: 1; STDOUT: ; STDERR: error: GET https://index.docker.io/v2/xxx/yyy/manifests/sha256-0415f56ccc05526f2af5a7ae8654baec97d4a614f24736e8eef41a4591f08019.cosign: MANIFEST_UNKNOWN: manifest unknown; map[Tag:sha256-0415f56ccc05526f2af5a7ae8654baec97d4a614f24736e8eef41a4591f08019.cosign]
[2021-06-29 15:19:23,834] ERROR: {'message': 'no trust data for image "docker.io/xxx/yyy:latest".', 'context': {'trust_data_type': 'dev.cosignproject.cosign/signature', 'stderr': 'error: GET https://index.docker.io/v2/xxx/yyy/manifests/sha256-0415f56ccc05526f2af5a7ae8654baec97d4a614f24736e8eef41a4591f08019.cosign: MANIFEST_UNKNOWN: manifest unknown; map[Tag:sha256-0415f56ccc05526f2af5a7ae8654baec97d4a614f24736e8eef41a4591f08019.cosign]\n', 'user': 'minikube-user', 'operation': 'CREATE', 'kind': 'Pod', 'namespace': 'connaisseur', 'name': 'testing', 'image': 'docker.io/xxx/yyy:latest'}, 'detection_mode': False}

I tested with your testimage instructions and that worked fine. How to troubleshoot?

[xopham]

Hi @zosocanuck! Which version of Cosign are you using for signing? There has been a few breaking updates on the signature format and naming recently by the cosign project. We are currently supporting cosign v0.2.0 signatures, but hope to update to the latest version soon, specifically as cosign seems to be maturing quickly.

[zosocanuck]

I pulled from the latest branch:

$ go install github.com/sigstore/cosign/cmd/cosign@latest

[zosocanuck]

switching over to cosign v0.2.0 resolved the issue.

[xopham]

Great to hear. Thanks for letting me know :-)
We are working on getting Connaisseur v2.0.0 #151 released and I hope to improve the sigstore/cosign support thereafter.

feel free to share your feedback from using Connaisseur to help us steer development

[xopham]

@zosocanuck now supporting the latest built of Cosign as by #173 in Connaisseur v2.0.0. Feel free to checkout the docs to get started.