feat: sign checksum using cosign #498

Dentrax · 2021-11-10T11:52:34Z

Signed-off-by: Furkan [email protected]
Signed-off-by: Batuhan Apaydın [email protected]

Fixes #491

Dentrax · 2021-11-10T14:18:02Z

We used cosign-release: 'v1.3.0' here, but we can not do verify for now since we have to wait the next cosign release. Here is the related PR: sigstore/cosign#991 by @shibumi. This feature scheduled in the next v1.4.0 release. If we want to export the cert in the release, then probably we have to wait one of these PRs to get merged: sigstore/cosign#1016 and sigstore/cosign#1021 by @developer-guy

shibumi · 2021-11-10T18:22:07Z

.goreleaser.yml

@@ -34,6 +34,10 @@ archives:
    amd64: x86_64
 checksum:
  name_template: 'checksums.txt'
+signs:
+  - cmd: cosign
+    args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output=${signature}", "${artifact}"]


This part is missing the signature: ${artifact}.sig value.. also it might makes sense to wait for the goreleaser support for releasing certificates, too :)

IMHO we don't need this one because we're using artifacts: checksum, so it creates checksums.txt.sig by default, as you can see from here. Also, we don't need to wait to release the certificates feature because in cosign with sigstore/cosign#991, we can verify blobs in keyless mode. The problem here is that these certificates are short-lived IIRC, so for users who might want to use these to verify the ko binary might be problematic because these certificates will be expired in a short time, WDYT @shibumi @imjasonh?

Just for the record (@developer-guy know this already). Short-Lived certificates are not problematic, because it just refers to the signature generation, not the signature verification. See also: goreleaser/goreleaser#2659 (comment)

google-cla · 2021-11-11T14:39:24Z

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

.goreleaser.yml

developer-guy · 2021-12-10T18:44:14Z

@shibumi cosign v1.4.1 with some bunch of fixes is released today as you might know, would you like to give this issue a hand? 🤩 Or I can do it if you want if you don't have time 🤝

shibumi · 2021-12-11T04:18:21Z

@developer-guy I can confirm this works: https://github.com/shibumi/kubectl-htpasswd/releases/tag/v0.1.7

But you must set the experimental flag with cosign v1.4.1

.github/workflows/release.yml

shibumi · 2021-12-11T04:20:40Z

.goreleaser.yml

+    certificate: '{{ trimsuffix .Env.artifact ".txt" }}.pem'
+    signature: "${artifact}.sig"
+    args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output-signature=${signature}", "--output-certificate=${certificate}",  "${artifact}"]
+    artifacts: checksum


Do you really only want to sign the checksums?

I left it empty.
https://github.com/goreleaser/goreleaser/pull/2716/files#diff-7326b55c062b0f46fe9e39aace0a25f4515cf206040fb91a6fd2cae839f5e826R208-R218

developer-guy · 2021-12-21T08:57:51Z

kindly ping @mattmoor @imjasonh @shibumi, seems everything works fine.
👉 https://github.com/developer-guy/ko/releases/tag/v0.9.3-signchecksum

$ httpie --download https://github.com/developer-guy/ko/releases/download/v0.9.3-signchecksum/checksums.txt.sig
$ httpie --download https://github.com/developer-guy/ko/releases/download/v0.9.3-signchecksum/checksums.txt.pem
$ httpie --download https://github.com/developer-guy/ko/releases/download/v0.9.3-signchecksum/checksums.txt

$ cosign verify-blob --signature checksums.txt.sig --cert checksums.txt.pem checksums.txt
Verified OK

👉 https://github.com/developer-guy/ko/runs/4592518036?check_suite_focus=true

.goreleaser.yml

imjasonh · 2021-12-21T14:49:24Z

.github/workflows/release.yml

        with:
          go-version: 1.17.x
-      - uses: goreleaser/goreleaser-action@v1
+      - uses: sigstore/[email protected]
+      - uses: goreleaser/goreleaser-action@v2


Could we add a step after goreleaser that runs cosign verify <checksum> to check that this worked as expected?

Question: Is cosign validating this already? I like the idea of validating the signature after signature creation, but I am not sure if validating makes sense if cosign is validating it already during creation.

nice let's do this.

shibumi · 2021-12-21T15:11:21Z

@Dentrax can you add these two lines to the goreleaser configuration? They ensure that goreleaser will produce a source tarball and signs this tarball as well. It provides an easy way to download a signed tarball via curl

source:
  enabled: true

developer-guy · 2021-12-22T19:54:02Z

we only sign the chekcsums.txt file right now, I think it is enough for verifying sha256 of the files has not been tampered with but, the final decision belongs to @imjasonh, let's ask that to him and wait for his response, then according to his response, maybe we can start signing tar files instead of just checksums.txt file. WDYT @shibumi?

developer-guy · 2021-12-22T20:09:33Z

Btw @imjasonh GoReleaser is now capable of generating SBOMs by using the Syft tool under the hood, so, that we can add that support to the ko project🙋🏻‍♂️

imjasonh · 2021-12-22T20:22:01Z

Btw @imjasonh GoReleaser is now capable of generating SBOMs by using the Syft tool under the hood, so, that we can add that support to the ko project🙋🏻‍♂️

I'm not opposed, but I think that's a separate issue. I'd like to make sure that Syft's SBOM of ko and ko's SBOM of ko don't disagree. 🙃

developer-guy · 2021-12-23T06:28:22Z

I removed the --oidc-issuer flag to enable ambient credential detection support in cosign

shibumi · 2021-12-23T09:07:25Z

we only sign the chekcsums.txt file right now, I think it is enough for verifying sha256 of the files has not been tampered with but, the final decision belongs to @imjasonh, let's ask that to him and wait for his response, then according to his response, maybe we can start signing tar files instead of just checksums.txt file. WDYT @shibumi?

You misunderstood me. The problem is: If you do not generate source tarballs with goreleaser, goreleaser will not create a source tarball for the project. Instead, Github will create the source tarball, but there will be no checksum file for the source tarball.

developer-guy · 2022-01-25T17:03:24Z

kindly ping @imjasonh 🙋🏻‍♂️

github-actions · 2022-04-26T01:29:30Z

This Pull Request is stale because it has been open for 90 days with
no activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.

feat: prepare for the new releases Signed-off-by: Furkan <[email protected]> Signed-off-by: Batuhan Apaydın <[email protected]>

developer-guy · 2022-05-10T08:29:47Z

kindly ping @imjasonh

Dentrax · 2022-05-10T08:58:36Z

Rebased, updated. Test release: https://github.com/Dentrax/ko/releases/tag/v0.0.9

developer-guy · 2022-06-06T05:56:09Z

kindly ping @imjasonh

imjasonh

Sorry it's taken so long to get back to this. 😞

Some time shortly before or after we cut a ko release we should include some docs about how to verify the releases, and what verifying proves. But I don't think we should add docs to README.md yet that won't be useful for current releases.

imjasonh · 2022-06-06T13:40:04Z

.github/workflows/release.yml

@@ -7,6 +7,9 @@ on:

 jobs:
  goreleaser:
+    permissions:
+      id-token: write
+      contents: write


Just to confirm: This needs contents: write to be able to add things to the release right?

imjasonh · 2022-08-19T14:01:26Z

I think with #730 we have a fair assurance that the artifacts that we've released have come from reliable sources and are tamper-evident. I'll close this unless folks think there's more we should do to gain more assurance.

google-cla bot added the cla: yes label Nov 10, 2021

shibumi reviewed Nov 10, 2021

View reviewed changes

google-cla bot added cla: no and removed cla: yes labels Nov 11, 2021

developer-guy mentioned this pull request Nov 11, 2021

Feature - Scorecard should sign releases with cosign ossf/scorecard#1201

Closed

google-cla bot added cla: yes and removed cla: no labels Nov 11, 2021

developer-guy mentioned this pull request Nov 15, 2021

implement a new flag for sign-blob subcommand to save certificate to disk or stdout sigstore/cosign#1016

Merged

developer-guy force-pushed the feature/sign-checksum branch from 06fb65d to 71dbea1 Compare December 6, 2021 09:43

shibumi reviewed Dec 6, 2021

View reviewed changes

.goreleaser.yml Outdated Show resolved Hide resolved

developer-guy mentioned this pull request Dec 10, 2021

feat: goreleaser release google/addlicense#101

Open

shibumi suggested changes Dec 11, 2021

View reviewed changes

developer-guy force-pushed the feature/sign-checksum branch 7 times, most recently from 51b042e to 6cad12e Compare December 21, 2021 08:38

imjasonh reviewed Dec 21, 2021

View reviewed changes

developer-guy force-pushed the feature/sign-checksum branch from 6cad12e to 0ee1a85 Compare December 22, 2021 19:33

developer-guy force-pushed the feature/sign-checksum branch from 0ee1a85 to 6da18da Compare December 23, 2021 06:12

github-actions bot added the lifecycle/stale label Apr 26, 2022

Dentrax force-pushed the feature/sign-checksum branch from 6da18da to 6a357fb Compare May 10, 2022 08:13

feat: sign checksum using cosign

4a0f1af

feat: prepare for the new releases Signed-off-by: Furkan <[email protected]> Signed-off-by: Batuhan Apaydın <[email protected]>

Dentrax force-pushed the feature/sign-checksum branch from 6a357fb to 4a0f1af Compare May 10, 2022 08:15

github-actions bot removed the lifecycle/stale label May 11, 2022

imjasonh reviewed Jun 6, 2022

View reviewed changes

imjasonh closed this Aug 19, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: sign checksum using cosign #498

feat: sign checksum using cosign #498

Dentrax commented Nov 10, 2021

Dentrax commented Nov 10, 2021

shibumi Nov 10, 2021

developer-guy Nov 10, 2021

shibumi Nov 10, 2021

google-cla bot commented Nov 11, 2021

developer-guy commented Dec 10, 2021

shibumi commented Dec 11, 2021

shibumi Dec 11, 2021

developer-guy Dec 21, 2021

developer-guy commented Dec 21, 2021

imjasonh Dec 21, 2021

shibumi Dec 21, 2021

developer-guy Dec 21, 2021

shibumi commented Dec 21, 2021

developer-guy commented Dec 22, 2021

developer-guy commented Dec 22, 2021

imjasonh commented Dec 22, 2021

developer-guy commented Dec 23, 2021

shibumi commented Dec 23, 2021 •

edited

Loading

developer-guy commented Jan 25, 2022

github-actions bot commented Apr 26, 2022

developer-guy commented May 10, 2022

Dentrax commented May 10, 2022 •

edited

Loading

developer-guy commented Jun 6, 2022

imjasonh left a comment

imjasonh Jun 6, 2022

imjasonh commented Aug 19, 2022

feat: sign checksum using cosign #498

feat: sign checksum using cosign #498

Conversation

Dentrax commented Nov 10, 2021

Dentrax commented Nov 10, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

google-cla bot commented Nov 11, 2021

developer-guy commented Dec 10, 2021

shibumi commented Dec 11, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

developer-guy commented Dec 21, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shibumi commented Dec 21, 2021

developer-guy commented Dec 22, 2021

developer-guy commented Dec 22, 2021

imjasonh commented Dec 22, 2021

developer-guy commented Dec 23, 2021

shibumi commented Dec 23, 2021 • edited Loading

developer-guy commented Jan 25, 2022

github-actions bot commented Apr 26, 2022

developer-guy commented May 10, 2022

Dentrax commented May 10, 2022 • edited Loading

developer-guy commented Jun 6, 2022

imjasonh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

imjasonh commented Aug 19, 2022

shibumi commented Dec 23, 2021 •

edited

Loading

Dentrax commented May 10, 2022 •

edited

Loading