[docs] add documentation regarding verify images signatures #8990

cpanato · 2023-11-24T11:56:02Z

Description: <Describe what has changed.

add documentation regarding verify images signatures

related to open-telemetry/opentelemetry-collector-releases#207

Fixes: #9610

/assign @jpkrohling

README.md

codecov · 2023-11-24T11:59:56Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.47%. Comparing base (1d52fb9) to head (8bc3c48).
Report is 60 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8990      +/-   ##
==========================================
+ Coverage   91.63%   92.47%   +0.84%     
==========================================
  Files         356      387      +31     
  Lines       16849    18246    +1397     
==========================================
+ Hits        15439    16873    +1434     
+ Misses       1068     1027      -41     
- Partials      342      346       +4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

tigrannajaryan

I have a few questions which are about signing (not verifying) which would belong more to the PR that implements signing, but I am not sure which PR is that, so asking here to understand the signing story better.

tigrannajaryan · 2023-12-05T18:08:22Z

README.md

+Example:
+
+```console
+$ cosign verify --certificate-identity=https://github.com/open-telemetry/opentelemetry-collector-releases/.github/workflows/release.yaml@refs/tags/v99.99.01 --certificate-oidc-issuer=https://token.actions.githubusercontent.com ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector:99.99.01


Please add some explanation about what exactly is being verified here and how to spot the expected valid output.

@cpanato, can you provide this?

tigrannajaryan · 2023-12-05T18:10:20Z

README.md

+
+> **Note**: To verify a signed artifact or blob, first [install Cosign](https://docs.sigstore.dev/system_config/installation/), then follow the instructions below.
+
+We are signing the images `otel/opentelemetry-collector` and `otel/opentelemetry-collector-contrib` using [sigstore cosign](https://github.com/sigstore/cosign) tool and to verify the signatures you can run the following command:


Sigstore docs say that when signing:

A verifiable OpenID Connect identity token, which contains a user’s email address or service account, is provided in the request.

What identity token do we provide for signing the Collector? Is it an email address or some other identity? Where can this identity token be seen?

Sigstore docs say:

All signers should monitor the Fulcio CT log for unauthorized use of their identity, and all verifiers should look for alerts from consistency monitors.

What do we (Otel) do to monitor the CT log?

Right now, nothing. I just created open-telemetry/sig-security#45 to track this.

The identity is the JSON that is provided above in the readme and includes things like the github repo name and the workflow that generated it. The actual "Subject" of the token would be https://github.com/cpanato/opentelemetry-collector-releases/.github/workflows/release.yaml@refs/tags/v99.99.01 , in the readme's example.

github-actions · 2023-12-20T03:14:41Z

This PR was marked stale due to lack of activity. It will be closed in 14 days.

github-actions · 2024-01-09T03:15:35Z

This PR was marked stale due to lack of activity. It will be closed in 14 days.

github-actions · 2024-01-25T03:15:36Z

This PR was marked stale due to lack of activity. It will be closed in 14 days.

github-actions · 2024-02-09T03:15:25Z

This PR was marked stale due to lack of activity. It will be closed in 14 days.

cpanato · 2024-02-13T14:28:28Z

@jpkrohling let me know when is good to update this PR to merge, to avoid keeping the updating this.

jpkrohling · 2024-02-15T09:06:09Z

Given that the -releases PR is merged, this one can be rebased and marked as ready!

cpanato · 2024-02-20T12:39:01Z

@jpkrohling rebased, thanks!

README.md

github-actions · 2024-03-07T03:14:51Z

This PR was marked stale due to lack of activity. It will be closed in 14 days.

tigrannajaryan · 2024-04-11T14:23:14Z

Folks, what's the status of this PR? It would be great to finalize and merge it.

cpanato · 2024-04-11T14:31:54Z

@tigrannajaryan i will do that tomorrow, sorry for the delay

Signed-off-by: cpanato <ctadeu@gmail.com>

cpanato · 2024-04-12T07:52:31Z

@jpkrohling @tigrannajaryan made some changes and update the image reference PTAL

TylerHelmuth · 2024-04-16T19:20:42Z

.chloggen/doc-verify-images.yaml

We can omit a changelog for this

I'm OK keeping this though, as it can help spread the word about our images being signed.

will wait the decision to remove or keep :)

let's keep this and merge the PR, if that's the only thing holding this PR

jpkrohling · 2024-04-23T15:28:53Z

.chloggen/doc-verify-images.yaml

I'm OK keeping this though, as it can help spread the word about our images being signed.

README.md

github-actions · 2024-05-09T03:15:54Z

This PR was marked stale due to lack of activity. It will be closed in 14 days.

cpanato · 2024-05-13T11:39:27Z

anything that i need to do?

jpkrohling · 2024-05-13T11:47:43Z

anything that i need to do?

I don't think so, I just pinged @open-telemetry/collector-maintainers to see if this can be merged as is.

README.md

github-actions · 2024-05-29T03:16:02Z

This PR was marked stale due to lack of activity. It will be closed in 14 days.

README.md

@jpkrohling

…emetry#8990) **Description:** <Describe what has changed. - add documentation regarding verify images signatures related to open-telemetry/opentelemetry-collector-releases#207 Fixes: open-telemetry#9610 /assign @jpkrohling --------- Signed-off-by: cpanato <ctadeu@gmail.com> Co-authored-by: Juraci Paixão Kröhling <juraci@kroehling.de> Co-authored-by: Pablo Baeyens <pbaeyens31+github@gmail.com>

cpanato mentioned this pull request Nov 24, 2023

sign binaries and images with sigstore cosign open-telemetry/opentelemetry-collector-releases#207

Merged

cpanato commented Nov 24, 2023

View reviewed changes

README.md Outdated Show resolved Hide resolved

cpanato force-pushed the doc-verify-images branch from 4d863cd to e85f89f Compare November 24, 2023 12:01

cpanato changed the title ~~add documentation regarding verify images signatures~~ [docs] add documentation regarding verify images signatures Nov 24, 2023

cpanato force-pushed the doc-verify-images branch 2 times, most recently from 30e2eab to 2d09309 Compare November 24, 2023 12:07

tigrannajaryan reviewed Dec 5, 2023

View reviewed changes

github-actions bot added Stale and removed Stale labels Dec 20, 2023

github-actions bot added Stale and removed Stale labels Jan 9, 2024

github-actions bot added the Stale label Jan 25, 2024

jpkrohling removed the Stale label Jan 25, 2024

github-actions bot added the Stale label Feb 9, 2024

github-actions bot removed the Stale label Feb 14, 2024

cpanato force-pushed the doc-verify-images branch from 2d09309 to 233b262 Compare February 20, 2024 12:38

cpanato requested a review from jpkrohling February 20, 2024 12:38

cpanato marked this pull request as ready for review February 20, 2024 12:38

cpanato requested a review from a team as a code owner February 20, 2024 12:38

cpanato force-pushed the doc-verify-images branch from 233b262 to b9bc933 Compare February 20, 2024 12:47

jpkrohling reviewed Feb 21, 2024

View reviewed changes

README.md Show resolved Hide resolved

github-actions bot added the Stale label Apr 11, 2024

tigrannajaryan removed the Stale label Apr 11, 2024

add documentation regarding verify images signatures

f04339d

Signed-off-by: cpanato <ctadeu@gmail.com>

cpanato force-pushed the doc-verify-images branch from b9bc933 to f04339d Compare April 12, 2024 07:51

cpanato requested review from jpkrohling and tigrannajaryan April 12, 2024 07:52

tigrannajaryan approved these changes Apr 12, 2024

View reviewed changes

TylerHelmuth reviewed Apr 16, 2024

View reviewed changes

TylerHelmuth added the Skip Changelog PRs that do not require a CHANGELOG.md entry label Apr 16, 2024

jpkrohling approved these changes Apr 23, 2024

View reviewed changes

github-actions bot added the Stale label May 9, 2024

jpkrohling removed Stale labels May 13, 2024

Merge branch 'main' into doc-verify-images

925028e

mx-psi approved these changes May 13, 2024

View reviewed changes

README.md Show resolved Hide resolved

README.md Outdated Show resolved Hide resolved

github-actions bot added the Stale label May 29, 2024

Apply suggestions from code review

9b15025

mx-psi reviewed May 29, 2024

View reviewed changes

README.md Outdated Show resolved Hide resolved

Apply suggestions from code review

8bc3c48

mx-psi merged commit 40f5a4e into open-telemetry:main May 29, 2024
48 checks passed

github-actions bot added this to the next release milestone May 29, 2024

cpanato deleted the doc-verify-images branch May 29, 2024 10:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[docs] add documentation regarding verify images signatures #8990

[docs] add documentation regarding verify images signatures #8990

cpanato commented Nov 24, 2023 •

edited

Loading

codecov bot commented Nov 24, 2023 •

edited

Loading

tigrannajaryan left a comment

tigrannajaryan Dec 5, 2023

jpkrohling Jan 25, 2024

tigrannajaryan Dec 5, 2023

tigrannajaryan Dec 5, 2023

jpkrohling Jan 25, 2024

jpkrohling Jan 25, 2024

github-actions bot commented Dec 20, 2023

github-actions bot commented Jan 9, 2024

github-actions bot commented Jan 25, 2024

github-actions bot commented Feb 9, 2024

cpanato commented Feb 13, 2024

jpkrohling commented Feb 15, 2024

cpanato commented Feb 20, 2024

github-actions bot commented Mar 7, 2024

tigrannajaryan commented Apr 11, 2024

cpanato commented Apr 11, 2024

cpanato commented Apr 12, 2024

TylerHelmuth Apr 16, 2024

jpkrohling Apr 23, 2024

cpanato Apr 23, 2024

jpkrohling May 13, 2024

jpkrohling Apr 23, 2024

github-actions bot commented May 9, 2024

cpanato commented May 13, 2024

jpkrohling commented May 13, 2024

github-actions bot commented May 29, 2024


		> Note: To verify a signed artifact or blob, first [install Cosign](https://docs.sigstore.dev/system_config/installation/), then follow the instructions below.

		We are signing the images `otel/opentelemetry-collector` and `otel/opentelemetry-collector-contrib` using [sigstore cosign](https://github.com/sigstore/cosign) tool and to verify the signatures you can run the following command:

[docs] add documentation regarding verify images signatures #8990

[docs] add documentation regarding verify images signatures #8990

Conversation

cpanato commented Nov 24, 2023 • edited Loading

codecov bot commented Nov 24, 2023 • edited Loading

Codecov Report

tigrannajaryan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Dec 20, 2023

github-actions bot commented Jan 9, 2024

github-actions bot commented Jan 25, 2024

github-actions bot commented Feb 9, 2024

cpanato commented Feb 13, 2024

jpkrohling commented Feb 15, 2024

cpanato commented Feb 20, 2024

github-actions bot commented Mar 7, 2024

tigrannajaryan commented Apr 11, 2024

cpanato commented Apr 11, 2024

cpanato commented Apr 12, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented May 9, 2024

cpanato commented May 13, 2024

jpkrohling commented May 13, 2024

github-actions bot commented May 29, 2024

cpanato commented Nov 24, 2023 •

edited

Loading

codecov bot commented Nov 24, 2023 •

edited

Loading