Add support for new bundle specification for attesting/verifying OCI image attestations #3889

codysoyland · 2024-09-25T19:31:43Z

Summary

This PR adds support for the new Cosign Bundle Specification in cosign attest and cosign verify-attestation.

Related: #3139

To test, run the following (replacing MY_IDENTITY, MY_ISSUER, MY_TRUSTED_ROOT and MY_IMAGE as needed -- trusted root is optional). Note that the new OCI support requires passing --new-bundle-format into both commands.

go run ./cmd/cosign attest --predicate my-predicate.json --new-bundle-format MY_IMAGE
go run ./cmd/cosign verify-attestation --certificate-identity MY_IDENTITY --certificate-oidc-issuer MY_ISSUER --new-bundle-format --trusted-root=MY_TRUSTED_ROOT MY_IMAGE

Full example (using crane, but can instead use docker tag/docker push):

make cosign
docker run -d -p 5050:5000 ghcr.io/project-zot/zot-linux-arm64:latest
crane copy busybox:latest localhost:5050/busybox
echo '{"foo": "bar"}' > predicate.json
./cosign attest --predicate predicate.json --new-bundle-format localhost:5050/busybox:latest
# Dex workflow, assuming GitHub as provider
./cosign verify-attestation --certificate-identity=yourname@example.com --certificate-oidc-issuer=https://github.com/login/oauth --new-bundle-format localhost:5050/busybox:latest

To show that it uses the OCI 1.1 referrers API, you can use oras:

oras discover localhost:5050/busybox:latest
Discovered 1 artifact referencing latest
Digest: sha256:db142d433cdde11f10ae479dbf92f3b13d693fd1c91053da9979728cceb1dc68

Artifact Type                                   Digest
application/vnd.dev.sigstore.bundle.v0.3+json   sha256:3fb46d845fe437667a6b3ed45d2b11dea11c43f8fbe76dd642eb71de2a9b8b77

Release Note

Documentation

codecov · 2024-11-06T20:12:07Z

Codecov Report

Attention: Patch coverage is 23.57955% with 269 lines in your changes missing coverage. Please review.

Project coverage is 36.46%. Comparing base (2ef6022) to head (597f74d).
Report is 332 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/oci/remote/write.go	0.00%	92 Missing ⚠️
cmd/cosign/cli/verify/verify_attestation.go	0.00%	38 Missing ⚠️
pkg/oci/remote/signatures.go	0.00%	37 Missing ⚠️
cmd/cosign/cli/attest/attest.go	0.00%	32 Missing ⚠️
pkg/cosign/verify.go	71.81%	22 Missing and 9 partials ⚠️
cmd/cosign/cli/attest/common.go	0.00%	10 Missing ⚠️
cmd/cosign/cli/options/verify.go	0.00%	8 Missing ⚠️
cmd/cosign/cli/verify/verify.go	0.00%	7 Missing ⚠️
cmd/cosign/cli/attest/attest_blob.go	14.28%	6 Missing ⚠️
cmd/cosign/cli/verify.go	0.00%	5 Missing ⚠️
... and 2 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3889      +/-   ##
==========================================
- Coverage   40.10%   36.46%   -3.64%     
==========================================
  Files         155      210      +55     
  Lines       10044    13734    +3690     
==========================================
+ Hits         4028     5008     +980     
- Misses       5530     8099    +2569     
- Partials      486      627     +141

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

cmd/cosign/cli/attest/attest.go

cmd/cosign/cli/attest/common.go

cmd/cosign/cli/options/verify.go

cmd/cosign/cli/verify/verify_attestation.go

pkg/cosign/verify.go

cmurphy · 2024-12-10T19:39:00Z

pkg/cosign/verify.go

+	// Wrap TrustedMaterial
+	vTrustedMaterial := &verifyTrustedMaterial{TrustedMaterial: co.TrustedMaterial}
+
+	// If TrustedMaterial is not set, fetch it from TUF (TODO: should this even be done? Old verifier requires co.RootCerts to be set)


If they haven't set --trusted-root then they could be using other flags or relying on the TUF v1 setup which might be pointed to something other than the public good instance. I understand that this is only meant to be called when --new-bundle-format is set but I'm worried that this would be surprising behavior if the PGI trusted root is used while the cached TUF metadata is pointed somewhere else.

pkg/cosign/verify.go

cmurphy · 2024-12-10T20:12:24Z

pkg/cosign/verify.go

+	}
+
+	for _, verified := range bundlesVerified {
+		atLeastOneBundleVerified = atLeastOneBundleVerified || verified


Could you clarify why it's okay for only one bundle to be verified?

This logic was copied from

cosign/pkg/cosign/verify.go

Line 1054 in 737c83c

func VerifyImageAttestation(ctx context.Context, atts oci.Signatures, h v1.Hash, co *CheckOpts) (checkedAttestations []oci.Signature, bundleVerified bool, err error) {

, but I renamed bundleVerified to atLeastOneBundleVerified so it's more clear. The effect is that if there are multiple bundles associated with an image, verification will succeed if at least one of them is verified.

I can write a comment about this if it helps!

Adding onto this - Do we want to support multiple bundles on a single container? We shouldn't be bound to Cosign's previous decisions and it might be worth revisiting this now.

There are valid use-cases for multiple bundles (rotating a signing key/identity for example), but I just want to take a second to make sure we really do want to support this.

IMO, there are not many downsides to supporting multiple bundles and it's pretty much "free" with OCI, but it's good to challenge that assumption. I guess you could say a downside is that we need this logic here to decide if invalid attestations should cause a verification failure, but I would argue that this logic is natural if the principle of monotonicity is followed.

I would also highlight that each bundle may only contain one attestation, so if a user wishes to store both an SBOM and vulnerability scan attestation referencing the same image, multiple bundles must be allowed.

pkg/oci/remote/referrers.go

cmurphy · 2024-12-10T21:41:08Z

test/e2e_test.go

@@ -361,7 +377,7 @@ func attestVerify(t *testing.T, predicateType, attestation, goodCue, badCue stri
 	}

 	// Now attest the image
-	ko := options.KeyOpts{KeyRef: privKeyPath, PassFunc: passFunc}
+	ko := options.KeyOpts{KeyRef: privKeyPath, PassFunc: passFunc, NewBundleFormat: newBundleFormat}


Maybe out of scope for this PR but a note for the future, this is setting NewBundleFormat without setting TrustedRootPath, which means the TrustedMaterial will default to using PGI. We're trying to avoid making external network calls to live services. The only reason that isn't a problem here is because this test is using a local key pair and is not uploading to Rekor, so it doesn't matter what verification material is used. But a useful test in the future might be to have this use ephemeral keys from Fulcio (localhost:5555) and upload the entry to Rekor (localhost:3000) so that the full verification path with a locally generated trust root could be tested.

pkg/cosign/verify.go

pkg/cosign/verify_bundle.go

codysoyland · 2025-01-24T22:00:36Z

I rebased and squashed all commits into one as there have been a couple of items refactored into separate PRs (#4006 and #4013) and this ongoing PR was getting a bit messy.

I still need to finish #4013 and rebase this one again, at which point I will be ready for another review pass.

Thanks everyone who has been patiently reviewing and helping me iterate on this!

codysoyland · 2025-02-07T20:15:30Z

cmd/cosign/cli/options/verify.go

-	NewBundleFormat bool
-	TrustedRootPath string


Note these have moved to CommonVerifyOptions

codysoyland · 2025-02-07T20:23:45Z

This has been rebased again and is ready for review.

steiza

There's a lot here! Sorry this took me so long to review; just a few minor questions on the changes.

Do I understand the Codecov report correctly that 1% of these changes are covered via tests? Any thoughts on how to increase that?

cmd/cosign/cli/options/verify.go

pkg/cosign/verify.go

codysoyland · 2025-02-14T21:37:04Z

Do I understand the Codecov report correctly that 1% of these changes are covered via tests? Any thoughts on how to increase that?

True, there are no remaining unit tests in this PR after the last rebase, but Codecov may not take into account the new e2e tests which should cover quite a bit. I'll try manually running coverage and see what I can reasonably cover with more tests.

dmitris · 2025-02-17T15:41:01Z

@codysoyland - thanks for pushing this forward, eagerly awaiting this feature! If I can help with testing or anything else, please let me know!

Could you resolve the conflicts, please? Thanks.

haydentherapper

This is really amazing work @codysoyland!

Going to read up on OCI 1.1 and take another pass later, though we should ask the authors of the original OCI 1.1 code as well to review those bits.

cmd/cosign/cli/verify/verify_attestation.go

pkg/cosign/verify.go

haydentherapper · 2025-02-17T18:07:51Z

pkg/cosign/verify.go

+	}
+
+	for _, verified := range bundlesVerified {
+		atLeastOneBundleVerified = atLeastOneBundleVerified || verified


Adding onto this - Do we want to support multiple bundles on a single container? We shouldn't be bound to Cosign's previous decisions and it might be worth revisiting this now.

There are valid use-cases for multiple bundles (rotating a signing key/identity for example), but I just want to take a second to make sure we really do want to support this.

pkg/oci/remote/signatures.go

codysoyland · 2025-02-18T19:22:53Z

@codysoyland - thanks for pushing this forward, eagerly awaiting this feature! If I can help with testing or anything else, please let me know!

Thank you! I'd be interested in any manual test results you may have!

Could you resolve the conflicts, please? Thanks.

I just rebased and resolved the conflict. 👍🏻

Edit: I realized just now that the verification logic here is kind of broken due to the rebase. I'm actively working on fixing that!

codysoyland · 2025-02-20T22:01:54Z

I generated coverage with e2e testing. Here is a link to the report. TL;DR: Most of the "happy paths" are covered, but many error cases are not covered. I'll take another pass to see if there's any low hanging fruit for additional testing, but I don't think the coverage of this PR is much different from our existing coverage. However I would still like to improve it.

dmitris · 2025-02-24T15:33:18Z

@codysoyland "stepped on" some of the files you're modifying with #3889 - could you rebase and resolve the conflicts, please?

cmd/cosign/cli/options/verify.go

Signed-off-by: Cody Soyland <codysoyland@github.com>

…e-format Signed-off-by: Cody Soyland <codysoyland@github.com>

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland · 2025-02-26T21:50:31Z

Going to read up on OCI 1.1 and take another pass later, though we should ask the authors of the original OCI 1.1 code as well to review those bits.

This is a great idea! The parts that I think need attention from a reviewer with more OCI experience would be the logic in:

pkg/oci/remote (WriteAttestationNewBundleFormat and Bundle)
pkg/cosign (getBundles)

Perhaps @hectorj2f or @vaikas might be able to take a look?

pkg/oci/remote/write.go

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland · 2025-02-27T21:39:11Z

I found github.com/google/go-containerregistry/pkg/registry which was very easy to use to add some unit tests to the OCI interactions on top of what is already covered by e2e tests. I just pushed a test that verifies the response when there are no attestations. I'll try to add a few more test cases to improve coverage.

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland force-pushed the verify-attestation-bundle-spec branch from 4af8cc0 to e509ec5 Compare November 1, 2024 20:41

codysoyland mentioned this pull request Nov 5, 2024

Representation of Container Image Signature Bundles as OCI Artifacts #3927

Open

This was referenced Nov 6, 2024

Add support for new bundle specification in cosign attest #3888

Closed

Upgrade to TUF v2 client #3844

Open

codysoyland force-pushed the verify-attestation-bundle-spec branch from af5093d to 524f558 Compare November 22, 2024 16:44

codysoyland marked this pull request as ready for review November 22, 2024 19:55

codysoyland changed the title ~~Add support for new bundle specification in cosign verify-attestation~~ Add support for new bundle specification for attesting/verifying OCI image attestations Nov 22, 2024

malancas reviewed Dec 6, 2024

View reviewed changes

codysoyland mentioned this pull request Dec 10, 2024

Add support for Sigstore Bundle Spec sigstore/policy-controller#1725

Draft

codysoyland requested a review from a team as a code owner December 10, 2024 20:08

cmurphy reviewed Dec 10, 2024

View reviewed changes

This was referenced Dec 12, 2024

Publish image attestations freedomofpress/dangerzone#1017

Closed

Implement independent container updates freedomofpress/dangerzone#1006

Open

codysoyland mentioned this pull request Dec 17, 2024

Attaching the signature artifact to the Image artifact #3935

Open

codysoyland commented Dec 18, 2024

View reviewed changes

pkg/cosign/verify_bundle.go Outdated Show resolved Hide resolved

This was referenced Jan 10, 2025

Add UseSignedTimestamps to CheckOpts, refactor TSA options #4006

Merged

Refactor verifyNewBundle into library function #4013

Merged

codysoyland force-pushed the verify-attestation-bundle-spec branch from 2c27fc5 to 1602cc1 Compare January 24, 2025 21:38

almet mentioned this pull request Jan 30, 2025

Add attestations to images freedomofpress/dangerzone#1063

Closed

codysoyland force-pushed the verify-attestation-bundle-spec branch from 1602cc1 to 6d7fbf2 Compare February 7, 2025 19:21

codysoyland commented Feb 7, 2025

View reviewed changes

steiza reviewed Feb 14, 2025

View reviewed changes

cmd/cosign/cli/options/verify.go Show resolved Hide resolved

pkg/cosign/verify.go Show resolved Hide resolved

haydentherapper reviewed Feb 17, 2025

View reviewed changes

codysoyland force-pushed the verify-attestation-bundle-spec branch from 6d7fbf2 to f440737 Compare February 18, 2025 19:03

iainlane mentioned this pull request Feb 21, 2025

Add instructions for verifying the attestations using cosign actions/attest-build-provenance#162

Open

dmitris mentioned this pull request Feb 21, 2025

cosign attest[-blob]: add TSA certificate command-line options and AttestOptions fields #4078

Open

dmitris reviewed Feb 24, 2025

View reviewed changes

cmd/cosign/cli/options/verify.go Outdated Show resolved Hide resolved

codysoyland force-pushed the verify-attestation-bundle-spec branch from c4f6cbb to 2c72624 Compare February 25, 2025 19:43

codysoyland added 9 commits February 25, 2025 14:53

Add support for new bundle specification for container images

281ad08

Signed-off-by: Cody Soyland <codysoyland@github.com>

Move new bundle options to CommonVerifyOptions

f41ccf8

Signed-off-by: Cody Soyland <codysoyland@github.com>

Add TODO about --new-bundle-format flag

5868319

Signed-off-by: Cody Soyland <codysoyland@github.com>

Add missing CommonVerifyOptions

667d854

Signed-off-by: Cody Soyland <codysoyland@github.com>

Require TrustedMaterial in CheckOpts

9150a03

Signed-off-by: Cody Soyland <codysoyland@github.com>

Load TrustedMaterial

c46c33e

Signed-off-by: Cody Soyland <codysoyland@github.com>

Remove TODO comment

f08196b

Signed-off-by: Cody Soyland <codysoyland@github.com>

Require bundle version 0.3 or newer.

a4d736d

Signed-off-by: Cody Soyland <codysoyland@github.com>

Return error if no bundles exist in registry

adfe2e3

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland force-pushed the verify-attestation-bundle-spec branch from 2c72624 to adfe2e3 Compare February 25, 2025 19:53

codysoyland added 2 commits February 25, 2025 16:26

Add note on --trusted-root flag that it only applies with --new-bundl…

1086a05

…e-format Signed-off-by: Cody Soyland <codysoyland@github.com>

Clarify comment on output type

190f50f

Signed-off-by: Cody Soyland <codysoyland@github.com>

codysoyland requested review from hectorj2f, vaikas and haydentherapper February 26, 2025 21:34

lcarva reviewed Feb 27, 2025

View reviewed changes

pkg/oci/remote/write.go Show resolved Hide resolved

lcarva reviewed Feb 27, 2025

View reviewed changes

pkg/oci/remote/write.go Outdated Show resolved Hide resolved

codysoyland added 2 commits February 27, 2025 15:09

Use Digest, not Repository

90b8538

Signed-off-by: Cody Soyland <codysoyland@github.com>

First pass at testing getBundles with go-containerregistry test registry

e6cf194

Signed-off-by: Cody Soyland <codysoyland@github.com>

Add more tests for container attestation verification

597f74d

Signed-off-by: Cody Soyland <codysoyland@github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for new bundle specification for attesting/verifying OCI image attestations #3889

Add support for new bundle specification for attesting/verifying OCI image attestations #3889

codysoyland commented Sep 25, 2024 •

edited

Loading

codecov bot commented Nov 6, 2024 •

edited

Loading

cmurphy Dec 10, 2024

cmurphy Dec 10, 2024

codysoyland Feb 7, 2025

haydentherapper Feb 17, 2025

codysoyland Feb 18, 2025

cmurphy Dec 10, 2024

codysoyland commented Jan 24, 2025

codysoyland Feb 7, 2025

codysoyland commented Feb 7, 2025 •

edited

Loading

steiza left a comment

codysoyland commented Feb 14, 2025

dmitris commented Feb 17, 2025

haydentherapper left a comment

haydentherapper Feb 17, 2025

codysoyland commented Feb 18, 2025 •

edited

Loading

codysoyland commented Feb 20, 2025 •

edited

Loading

dmitris commented Feb 24, 2025

codysoyland commented Feb 26, 2025

codysoyland commented Feb 27, 2025

Add support for new bundle specification for attesting/verifying OCI image attestations #3889

Are you sure you want to change the base?

Add support for new bundle specification for attesting/verifying OCI image attestations #3889

Conversation

codysoyland commented Sep 25, 2024 • edited Loading

Summary

Release Note

Documentation

codecov bot commented Nov 6, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codysoyland commented Jan 24, 2025

Choose a reason for hiding this comment

codysoyland commented Feb 7, 2025 • edited Loading

steiza left a comment

Choose a reason for hiding this comment

codysoyland commented Feb 14, 2025

dmitris commented Feb 17, 2025

haydentherapper left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codysoyland commented Feb 18, 2025 • edited Loading

codysoyland commented Feb 20, 2025 • edited Loading

dmitris commented Feb 24, 2025

codysoyland commented Feb 26, 2025

codysoyland commented Feb 27, 2025

codysoyland commented Sep 25, 2024 •

edited

Loading

codecov bot commented Nov 6, 2024 •

edited

Loading

codysoyland commented Feb 7, 2025 •

edited

Loading

codysoyland commented Feb 18, 2025 •

edited

Loading

codysoyland commented Feb 20, 2025 •

edited

Loading