Add support for new bundle specification for attesting/verifying OCI image attestations #3889

codysoyland · 2024-09-25T19:31:43Z

Summary

This PR adds support for the new Cosign Bundle Specification in cosign attest and cosign verify-attestation.

Related: #3139

To test, run the following (replacing MY_IDENTITY, MY_ISSUER, MY_TRUSTED_ROOT and MY_IMAGE as needed -- trusted root is optional). Note that the new OCI support requires passing --new-bundle-format into both commands.

go run ./cmd/cosign attest --predicate my-predicate.json --new-bundle-format MY_IMAGE
go run ./cmd/cosign verify-attestation --certificate-identity MY_IDENTITY --certificate-oidc-issuer MY_ISSUER --new-bundle-format --trusted-root=MY_TRUSTED_ROOT MY_IMAGE

Full example (using crane, but can instead use docker tag/docker push):

make cosign
docker run -d -p 5050:5000 ghcr.io/project-zot/zot-linux-arm64:latest
crane copy busybox:latest localhost:5050/busybox
echo '{"foo": "bar"}' > predicate.json
./cosign attest --predicate predicate.json --new-bundle-format localhost:5050/busybox:latest
# Dex workflow, assuming GitHub as provider
./cosign verify-attestation --certificate-identity=yourname@example.com --certificate-oidc-issuer=https://github.com/login/oauth --new-bundle-format localhost:5050/busybox:latest

To show that it uses the OCI 1.1 referrers API, you can use oras:

oras discover localhost:5050/busybox:latest
Discovered 1 artifact referencing latest
Digest: sha256:db142d433cdde11f10ae479dbf92f3b13d693fd1c91053da9979728cceb1dc68

Artifact Type                                   Digest
application/vnd.dev.sigstore.bundle.v0.3+json   sha256:3fb46d845fe437667a6b3ed45d2b11dea11c43f8fbe76dd642eb71de2a9b8b77

Release Note

Documentation

Signed-off-by: Cody Soyland <codysoyland@github.com>

…le-spec

Signed-off-by: Cody Soyland <codysoyland@github.com>

codecov · 2024-11-06T20:12:07Z

Codecov Report

Attention: Patch coverage is 10.29412% with 366 lines in your changes missing coverage. Please review.

Project coverage is 35.81%. Comparing base (2ef6022) to head (2c27fc5).
Report is 258 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/cosign/verify.go	19.27%	126 Missing and 8 partials ⚠️
pkg/oci/remote/write.go	0.00%	92 Missing ⚠️
cmd/cosign/cli/verify/verify_attestation.go	0.00%	35 Missing ⚠️
cmd/cosign/cli/attest/attest.go	0.00%	32 Missing ⚠️
pkg/oci/remote/signatures.go	0.00%	31 Missing ⚠️
cmd/cosign/cli/attest/common.go	0.00%	10 Missing ⚠️
cmd/cosign/cli/verify/verify.go	0.00%	8 Missing ⚠️
cmd/cosign/cli/attest/attest_blob.go	14.28%	6 Missing ⚠️
cmd/cosign/cli/verify.go	0.00%	6 Missing ⚠️
pkg/cosign/verify_bundle.go	40.00%	4 Missing and 2 partials ⚠️
... and 4 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3889      +/-   ##
==========================================
- Coverage   40.10%   35.81%   -4.29%     
==========================================
  Files         155      210      +55     
  Lines       10044    13666    +3622     
==========================================
+ Hits         4028     4895     +867     
- Misses       5530     8142    +2612     
- Partials      486      629     +143

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: Cody Soyland <codysoyland@github.com>

This reverts commit 67d421a. Signed-off-by: Cody Soyland <codysoyland@github.com>

Signed-off-by: Cody Soyland <codysoyland@github.com>

…cheme natively Signed-off-by: Cody Soyland <codysoyland@github.com>

Signed-off-by: Cody Soyland <codysoyland@github.com>

cmd/cosign/cli/attest/attest.go

cmd/cosign/cli/attest/common.go

cmd/cosign/cli/options/verify.go

cmd/cosign/cli/verify/verify_attestation.go

pkg/cosign/verify.go

Signed-off-by: Cody Soyland <codysoyland@github.com>

pkg/cosign/verify.go

cmurphy · 2024-12-10T19:39:00Z

pkg/cosign/verify.go

+	// Wrap TrustedMaterial
+	vTrustedMaterial := &verifyTrustedMaterial{TrustedMaterial: co.TrustedMaterial}
+
+	// If TrustedMaterial is not set, fetch it from TUF (TODO: should this even be done? Old verifier requires co.RootCerts to be set)


If they haven't set --trusted-root then they could be using other flags or relying on the TUF v1 setup which might be pointed to something other than the public good instance. I understand that this is only meant to be called when --new-bundle-format is set but I'm worried that this would be surprising behavior if the PGI trusted root is used while the cached TUF metadata is pointed somewhere else.

pkg/cosign/verify.go

cmurphy · 2024-12-10T20:12:24Z

pkg/cosign/verify.go

+	}
+
+	for _, verified := range bundlesVerified {
+		atLeastOneBundleVerified = atLeastOneBundleVerified || verified


Could you clarify why it's okay for only one bundle to be verified?

cmurphy · 2024-12-10T20:50:15Z

pkg/oci/remote/referrers.go

@@ -25,7 +25,9 @@ import (
 func Referrers(d name.Digest, artifactType string, opts ...Option) (*v1.IndexManifest, error) {
 	o := makeOptions(name.Repository{}, opts...)
 	rOpt := o.ROpt
-	rOpt = append(rOpt, remote.WithFilter("artifactType", artifactType))
+	if artifactType != "" {


Is there not a more specific artifact type we can filter by when getting attestations?

The artifactType for bundles is something like application/vnd.dev.sigstore.bundle.v0.3+json. Since the version number is baked into the type, we can't use the filter feature here. Therefore, getBundles uses an empty string as the artifactType in the call to Referrers.

cmurphy · 2024-12-10T21:41:08Z

test/e2e_test.go

@@ -361,7 +377,7 @@ func attestVerify(t *testing.T, predicateType, attestation, goodCue, badCue stri
 	}

 	// Now attest the image
-	ko := options.KeyOpts{KeyRef: privKeyPath, PassFunc: passFunc}
+	ko := options.KeyOpts{KeyRef: privKeyPath, PassFunc: passFunc, NewBundleFormat: newBundleFormat}


Maybe out of scope for this PR but a note for the future, this is setting NewBundleFormat without setting TrustedRootPath, which means the TrustedMaterial will default to using PGI. We're trying to avoid making external network calls to live services. The only reason that isn't a problem here is because this test is using a local key pair and is not uploading to Rekor, so it doesn't matter what verification material is used. But a useful test in the future might be to have this use ephemeral keys from Fulcio (localhost:5555) and upload the entry to Rekor (localhost:3000) so that the full verification path with a locally generated trust root could be tested.

cmurphy · 2024-12-10T21:43:38Z

pkg/cosign/verify.go

@@ -156,13 +163,113 @@ type CheckOpts struct {
 	// IgnoreTlog skip tlog verification
 	IgnoreTlog bool

+	// UseSignedTimestamps use signed timestamps if available
+	UseSignedTimestamps bool


Is this potentially something that could be split out into its own PR, so that each PR has a clear singular focus?

That's a good idea for something we can split out... I think this is needed because the existing timestamp verification in cosign doesn't work with TUF/PGI, and is only enforced if you provide a timestamp cert chain to the verification subcommands.

Signed-off-by: Cody Soyland <codysoyland@github.com>

Co-authored-by: Colleen Murphy <cmurphy@users.noreply.github.com> Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland · 2024-12-18T21:20:35Z

pkg/cosign/verify_bundle.go

+)
+
+// VerifyNewBundle verifies a SigstoreBundle with the given parameters
+func VerifyNewBundle(_ context.Context, co *CheckOpts, artifactPolicyOption verify.ArtifactPolicyOption, bundle verify.SignedEntity) (*verify.VerificationResult, error) {


Consider splitting this into separate PR and refactoring existing verifyNewBundle.

codysoyland added 4 commits October 29, 2024 16:57

Add support for new bundle specification in cosign attest

3dc6a85

Signed-off-by: Cody Soyland <codysoyland@github.com>

Add support for TSA for new bundle format in attest cli

f6b6f81

Signed-off-by: Cody Soyland <codysoyland@github.com>

Add support for new bundle specification in cosign verify-attestation

e46acdb

Signed-off-by: Cody Soyland <codysoyland@github.com>

Refactor and use CheckOpts to build sigstore-go verification options

e509ec5

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland force-pushed the verify-attestation-bundle-spec branch from 4af8cc0 to e509ec5 Compare November 1, 2024 20:41

codysoyland added 3 commits November 4, 2024 09:27

Merge branch 'cosign-attest-bundle-spec' into verify-attestation-bund…

558e873

…le-spec

Remove accidentally-committed commented code

8b3edc9

Signed-off-by: Cody Soyland <codysoyland@github.com>

Add comment about missing output data

b17dfd8

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland mentioned this pull request Nov 5, 2024

Representation of Container Image Signature Bundles as OCI Artifacts #3927

Open

codysoyland added 3 commits November 5, 2024 15:01

Add tests and fix a few verifier options

5ae6109

Signed-off-by: Cody Soyland <codysoyland@github.com>

Remove incomplete code

96410a7

Signed-off-by: Cody Soyland <codysoyland@github.com>

Clean up linter warnings

c540689

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland added 4 commits November 6, 2024 15:16

Update docs

8796901

Signed-off-by: Cody Soyland <codysoyland@github.com>

Use ParsePredicateType helper here

67d421a

Signed-off-by: Cody Soyland <codysoyland@github.com>

Add missing annotations

ba5c7cb

Signed-off-by: Cody Soyland <codysoyland@github.com>

Filter by bundle artifact type

7a4c4df

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland mentioned this pull request Nov 6, 2024

Add support for new bundle specification in cosign attest #3888

Closed

4 tasks

Fix up MediaType logic

693b391

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland mentioned this pull request Nov 8, 2024

Upgrade to TUF v2 client #3844

Open

2 tasks

codysoyland added 5 commits November 22, 2024 11:43

Revert "Use ParsePredicateType helper here"

a380b89

This reverts commit 67d421a. Signed-off-by: Cody Soyland <codysoyland@github.com>

Rename flag to NewBundleFormat for consistency

189e0d5

Signed-off-by: Cody Soyland <codysoyland@github.com>

Add unit tests for cosign.VerifyNewBundle

ac29355

Signed-off-by: Cody Soyland <codysoyland@github.com>

Remove redundant new-bundle-format flags

2f3b321

Signed-off-by: Cody Soyland <codysoyland@github.com>

Update docs

524f558

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland force-pushed the verify-attestation-bundle-spec branch from af5093d to 524f558 Compare November 22, 2024 16:44

codysoyland marked this pull request as ready for review November 22, 2024 19:55

codysoyland added 3 commits November 22, 2024 15:07

This TODO is not needed: go-containerregistry supports tag fallback s…

5c1fd5a

…cheme natively Signed-off-by: Cody Soyland <codysoyland@github.com>

Update flag name

4d41f5f

Signed-off-by: Cody Soyland <codysoyland@github.com>

Add missing brace

77be5a8

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland changed the title ~~Add support for new bundle specification in cosign verify-attestation~~ Add support for new bundle specification for attesting/verifying OCI image attestations Nov 22, 2024

malancas reviewed Dec 6, 2024

View reviewed changes

codysoyland mentioned this pull request Dec 10, 2024

Add support for Sigstore Bundle Spec sigstore/policy-controller#1725

Draft

codysoyland added 7 commits December 10, 2024 10:28

Add TODO about setting default trusted material

f81e48a

Signed-off-by: Cody Soyland <codysoyland@github.com>

Remove redundant TrustedRootPath option

a9c13b8

Signed-off-by: Cody Soyland <codysoyland@github.com>

Remove incorrect check

5fe5139

Signed-off-by: Cody Soyland <codysoyland@github.com>

Correct flag naming

a872c26

Signed-off-by: Cody Soyland <codysoyland@github.com>

Rename var for clarity

7ffa6d9

Signed-off-by: Cody Soyland <codysoyland@github.com>

Remove dependency on github.com/pkg/errors

73e7c0d

Signed-off-by: Cody Soyland <codysoyland@github.com>

Simplify logic to combine errors

5e4bbfe

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland requested a review from a team as a code owner December 10, 2024 20:08

cmurphy reviewed Dec 10, 2024

View reviewed changes

This was referenced Dec 12, 2024

Build and sign container images on new tags freedomofpress/dangerzone#1017

Draft

Implement independent container updates freedomofpress/dangerzone#1006

Open

codysoyland mentioned this pull request Dec 17, 2024

Attaching the signature artifact to the Image artifact #3935

Open

codysoyland and others added 7 commits December 18, 2024 10:22

Add comment

2f98fb2

Signed-off-by: Cody Soyland <codysoyland@github.com>

Remove unused proposed fields

b2aca85

Signed-off-by: Cody Soyland <codysoyland@github.com>

Rename and privatize verification options method

45fe8f5

Signed-off-by: Cody Soyland <codysoyland@github.com>

Merge branch 'main' into verify-attestation-bundle-spec

91f288c

Signed-off-by: Cody Soyland <codysoyland@github.com>

Remove redundant line

b24be4b

Signed-off-by: Cody Soyland <codysoyland@github.com>

Use current time if no tlog or signed timestamps

00d3e2e

Signed-off-by: Cody Soyland <codysoyland@github.com>

Update pkg/cosign/verify.go

2c27fc5

Co-authored-by: Colleen Murphy <cmurphy@users.noreply.github.com> Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland commented Dec 18, 2024

View reviewed changes

This was referenced Jan 10, 2025

Add UseSignedTimestamps to CheckOpts, refactor TSA options #4006

Merged

[DRAFT] Refactor verifyNewBundle into library function #4013

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for new bundle specification for attesting/verifying OCI image attestations #3889

Add support for new bundle specification for attesting/verifying OCI image attestations #3889

codysoyland commented Sep 25, 2024 •

edited

Loading

codecov bot commented Nov 6, 2024 •

edited

Loading

cmurphy Dec 10, 2024

cmurphy Dec 10, 2024

cmurphy Dec 10, 2024

codysoyland Dec 18, 2024

cmurphy Dec 10, 2024

cmurphy Dec 10, 2024

codysoyland Dec 18, 2024

codysoyland Dec 18, 2024

Add support for new bundle specification for attesting/verifying OCI image attestations #3889

Are you sure you want to change the base?

Add support for new bundle specification for attesting/verifying OCI image attestations #3889

Conversation

codysoyland commented Sep 25, 2024 • edited Loading

Summary

Release Note

Documentation

codecov bot commented Nov 6, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codysoyland commented Sep 25, 2024 •

edited

Loading

codecov bot commented Nov 6, 2024 •

edited

Loading