search

aquaproj / aqua

Declarative CLI Version manager written in Go. Support Lazy Install, Registry, and continuous update with Renovate. CLI version is switched seamlessly
https://aquaproj.github.io
863 stars 39 forks source link

Fail to install tools because of the error of Cosign #2759

Closed suzuki-shunsuke closed 7 months ago

suzuki-shunsuke commented 7 months ago

aqua info

aqua v2.25.0

Overview

aqua uses Cosign v1.

https://aquaproj.github.io/docs/reference/security/cosign-slsa/#verify-packages-with-cosign

Recently, Sigstore has published a new TUF trust root.

https://sigstore.slack.com/archives/C01DGF0G8U9/p1710871645742299

https://blog.sigstore.dev/tuf-root-update/

A new TUF trust root doesn't support Cosign v1 but aqua is still using Cosign v1, so aqua fails to install tools which enable Cosign verification. Due to the issue, aqua-installer can't install aqua.

To solve the issue, we have two options.

How to reproduce

Run aqua-installer or aqua update-aqua.

Debug output

$

Expected behaviour

aqua and aqua-installer can install tools.

Actual behaviour

It fails to instal tools.

https://github.com/aquaproj/aqua-registry/actions/runs/8355302244/job/22870132650

time="2024-03-20T07:35:36Z" level=info msg="Verification by Cosign failed temporarily, retring" aqua_version=2.25.0 env=linux/amd64 exe_name=aqua-registry package_name=aquaproj/registry-tool package_version=v0.2.3 program=aqua registry=standard retry_count=1 wait_time=459ms
Error: verifying blob [/tmp/091089404]: getting Fulcio roots: initializing tuf: unable to initialize client, local cache may be corrupt: invalid key
main.go:62: error during command execution: verifying blob [/tmp/091089404]: getting Fulcio roots: initializing tuf: unable to initialize client, local cache may be corrupt: invalid key

Note

No response

suzuki-shunsuke commented 7 months ago

About aqua-installer, we solve this issue by disabling cosign verification temporarily.

suzuki-shunsuke commented 7 months ago

What to do when you face the issue

export AQUA_DISABLE_COSIGN=true
export AQUA_DISABLE_SLSA=true

GitHub Actions Workflows

env:
  AQUA_DISABLE_COSIGN: "true"
  AQUA_DISABLE_SLSA: "true"
suzuki-shunsuke commented 7 months ago

We're working on upgrading Cosign to v2, but it is being blocked by https://github.com/slsa-framework/slsa-github-generator/issues/3350 . We're waiting for a new release of slsa-github-generator.

suzuki-shunsuke commented 7 months ago

v2.25.1 is out 🎉 https://github.com/aquaproj/aqua/releases/tag/v2.25.1

suzuki-shunsuke commented 7 months ago

Announced.