Implement signing - Githubissues

gardenlinux / python-gardenlinux-lib

Contains tools to work with the features directory of gardenlinux, for example deducting dependencies from feature sets or validating cnames

0 stars 0 forks source link

Implement signing #25

Closed Vincinator closed 1 month ago

Vincinator commented 2 months ago

Requirements

Use SSL key
sign layer + metadata
place signature in annotation inside manifest
place what has been signed in annotation inside manifest
Check if there is an emerging standard for signatures in OCI
- https://github.com/opencontainers/distribution-spec/issues/70
- https://github.com/opencontainers/image-spec/issues/400

Thanks @nkraetzschmar

Integration into Pipelines

Use KMS signing
For development and local testing add oci-sign.crt creation in Makefile of gardenlinux/gardenlinux cert/ folder

Vincinator commented 1 month ago

Checked Annotation Rules. I see no issue with using annotations for storing signed object* and signature.

*signed object: the string that contains target digest + metadata

Vincinator commented 1 month ago

I could not find consensus in the oci-spec repository on signing, could not find a clear favourite that will emerge in the next time.

We may consider also using https://github.com/notaryproject/notary, but for now we do not plan to use this.

Vincinator commented 1 month ago

TODO: need to input version as this should be part also of string that should be signed

Vincinator commented 1 month ago

TODO: we also need to add verification of signatures before we edit add a manifest. For example, if we attach a layer, we need to make sure that the old signature of the manifest entry was valid. Otherwise, we would make something that was invalid before valid without directly checking it.

e.g.:

we have a manifest A with an invalid signature in the oci-index
we attach a layer with test results for example
attaching a layer changes the manifest and its digest, so the signature of the manifest in the oci-index must be re-calculated.
if we did not verify signature of that manifest entry, we would make a modified manifest with invalid signature valid and allow any other compromised layer to be signed by us

EDIT: done ✅

Vincinator commented 1 month ago

TODO: we also need to add verification of digests. The signed-data contains a digest, which is a sha256 hash of the respective blob (if layer) or json (if manifest).

If the blob or manifest is modified, the digests also changes in the registry. gl-oci should also verify digest where possible, but in theory it should not be required, because the oct-registry would not allow to host mismatching digests, with the potential implementation dependent exception of entries in the oci-index.

Therefore we just make sure to verify digests wherever we use the digest.

EDIT: done ✅

Vincinator commented 1 month ago

TODO: verification of signatures fails