Skip to content

Add registry certificate verification support #1734

Merged
wagoodman merged 8 commits into
anchore:mainfrom
5p2O5pe25ouT:main
Aug 29, 2023
Merged

Add registry certificate verification support #1734
wagoodman merged 8 commits into
anchore:mainfrom
5p2O5pe25ouT:main

Conversation

@5p2O5pe25ouT
Copy link
Copy Markdown
Contributor

@5p2O5pe25ouT 5p2O5pe25ouT commented Apr 13, 2023

I want to help add support for carrying certificates when Syft scans the registry. Supported configurations are:

...MTLS for a specific registry:

# .syft.yaml
registry:
  ca-cert: "./ca-certs/myreg.crt"     # trust a specific CA cert

  auth:
   # note: no user/pass was provided, so the keychain will be used for basic auth
    - authority: "myregistry.com"
      tls-cert: "./certs/myreg-client.crt"
      tls-key: "./certs/myreg-client.key"

... MTLS for multiple registries:

# .syft.yaml
registry:
  ca-cert: "./ca-certs"     # trust all in all *.crt files in a dir as root CAs

  auth:

    - authority: "myregistry.com"
      tls-cert: "./certs/myreg-client.crt"
      tls-key: "./certs/myreg-client.key"

    - authority: "otherreg.com"
      tls-cert: "./certs/other-client.crt"
      tls-key: "./certs/other-client.key"

... configure via environment variables:

export SYFT_REGISTRY_CA_CERT="./ca-certs/"
export SYFT_REGISTRY_AUTH_TLS_CERT="./certs/myreg-client.crt"
export SYFT_REGISTRY_AUTH_TLS_KEY="./certs/other-client.key"

which will be the same as:

registry:
  ca-cert: "./ca-certs"   

  auth:

    - authority: ""
      tls-cert: "./certs/myreg-client.crt"
      tls-key: "./certs/myreg-client.key"

...which will offer the client cert during TLS negotiation to any registry that will accept it.

Pulls in features from anchore/stereoscope#169 and anchore/stereoscope#195

@spiffcs spiffcs self-requested a review June 22, 2023 16:21
@wagoodman wagoodman self-assigned this Jun 22, 2023
@wagoodman wagoodman added the enhancement New feature or request label Aug 24, 2023
@wagoodman wagoodman changed the title add registry certificate verification support Add registry certificate verification support Aug 24, 2023
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
@wagoodman wagoodman merged commit b03e9c6 into anchore:main Aug 29, 2023
GijsCalis pushed a commit to GijsCalis/syft that referenced this pull request Feb 19, 2024
* add registry certificate verification support

* replace stereoscope version

* modify go.mod

* pull in stereoscope update

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename registry cert options, add docs, and add test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update to account for changes in anchore/stereoscope#195

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: lishituo <24578666@qq.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

2 participants