Skip to content

Commit 1c23864

Browse files
BobyMCbobsBobyMCbobs
committed
feat: add sigstore-policy-tester extension
To enable verifying of every container image run through containerd
1 parent 357b561 commit 1c23864

File tree

7 files changed

+148
-0
lines changed

7 files changed

+148
-0
lines changed

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ TARGETS += realtek-firmware
107107
TARGETS += revpi-firmware
108108
TARGETS += spin
109109
TARGETS += stargz-snapshotter
110+
TARGETS += containerd-image-verifier-sigstore
110111
TARGETS += tailscale
111112
TARGETS += tenstorrent
112113
TARGETS += thunderbolt

‎tools/containerd-image-verifier-sigstore/10-containerd-image-verifier.part‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[plugins]
2+
[plugins."io.containerd.image-verifier.v1.bindir"]
3+
bin_dir = "/usr/local/bin/containerd-image-verifier"
4+
max_verifiers = 10
5+
per_verifier_timeout = "10s"

‎tools/containerd-image-verifier-sigstore/README.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# containerd-image-verifier-sigstore extension
2+
3+
## Installation
4+
5+
See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
6+
7+
## Usage
8+
9+
```yaml
10+
machine:
11+
files:
12+
- content: |
13+
apiVersion: policy.sigstore.dev/v1alpha1
14+
kind: ClusterImagePolicy
15+
metadata:
16+
name: system
17+
spec:
18+
images:
19+
- glob: "**"
20+
authorities:
21+
- keyless:
22+
url: https://fulcio.sigstore.dev
23+
identities:
24+
- issuer: https://accounts.google.com
25+
subject: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
26+
ctlog:
27+
url: https://rekor.sigstore.dev
28+
path: /var/local/etc/containers/sigstore/kubernetes.yaml
29+
op: create
30+
- content: |
31+
apiVersion: policy.sigstore.dev/v1alpha1
32+
kind: ClusterImagePolicy
33+
metadata:
34+
name: system
35+
spec:
36+
images:
37+
- glob: "**"
38+
authorities:
39+
- keyless:
40+
identities:
41+
- issuer: https://accounts.google.com
42+
subjectRegExp: "@siderolabs\.com$"
43+
path: /var/local/etc/containers/sigstore/siderolabs.yaml
44+
op: create
45+
```
46+
47+
**Important note: add all other identities and keys within the ClusterImagePolicy above for target container images**

‎tools/containerd-image-verifier-sigstore/manifest.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: v1alpha1
2+
metadata:
3+
name: containerd-image-verifier-sigstore
4+
version: "$VERSION"
5+
author: Caleb Woodbine
6+
description: |
7+
Verify images signed with Sigstore against ClusterImagePolicy declarations
8+
compatibility:
9+
talos:
10+
version: ">= v1.9.0"

‎tools/containerd-image-verifier-sigstore/pkg.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: containerd-image-verifier-sigstore
2+
variant: scratch
3+
shell: /bin/bash
4+
dependencies:
5+
- stage: base
6+
steps:
7+
- sources:
8+
- url: https://github.com/sigstore/policy-controller/archive/refs/tags/{{ .SIGSTORE_POLICY_TESTER_VERSION }}.tar.gz
9+
destination: sigstore-policy-controller.tar.gz
10+
sha256: {{ .SIGSTORE_POLICY_TESTER_VERSION_SHA256 }}
11+
sha512: {{ .SIGSTORE_POLICY_TESTER_VERSION_SHA512 }}
12+
- url: https://github.com/BobyMCbobs/containerd-image-verifier-sigstore/archive/refs/tags/{{ .CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION }}.tar.gz
13+
destination: containerd-image-verifier-sigstore.tar.gz
14+
sha256: {{ .CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION_SHA256 }}
15+
sha512: {{ .CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION_SHA512 }}
16+
env:
17+
GOPATH: /tmp/go
18+
cachePaths:
19+
- /.cache/go-build
20+
- /tmp/go/pkg
21+
- network: default
22+
prepare:
23+
- |
24+
sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml
25+
- |
26+
mkdir -p ${GOPATH}/src/github.com/sigstore/policy-controller
27+
28+
tar -xzf sigstore-policy-controller.tar.gz --strip-components=1 -C ${GOPATH}/src/github.com/sigstore/policy-controller
29+
- |
30+
mkdir -p ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
31+
32+
tar -xzf containerd-image-verifier-sigstore.tar.gz --strip-components=1 -C ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
33+
- |
34+
cd ${GOPATH}/src/github.com/sigstore/policy-controller
35+
go mod download
36+
- |
37+
cd ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
38+
go mod download
39+
- network: none
40+
build:
41+
- |
42+
cd ${GOPATH}/src/github.com/sigstore/policy-controller
43+
44+
mkdir ./bin
45+
46+
CGO_ENABLED=0 go build -o ./bin/sigstore-policy-tester ./cmd/tester
47+
- |
48+
cd ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
49+
50+
mkdir ./bin
51+
52+
CGO_ENABLED=0 go build -ldflags="-X 'main.DefaultPolicyDirPath=/var/local/etc/containers/sigstore/'" -o ./bin/containerd-image-verifier-sigstore .
53+
install:
54+
- |
55+
cd ${GOPATH}/src/github.com/sigstore/policy-controller
56+
mkdir -p /rootfs/usr/local/bin/
57+
cp -av bin/sigstore-policy-tester /rootfs/usr/local/bin/
58+
- |
59+
cd ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
60+
mkdir -p /rootfs/usr/local/bin/containerd-image-verifier/
61+
cp -av bin/containerd-image-verifier-sigstore /rootfs/usr/local/bin/containerd-image-verifier/
62+
- |
63+
mkdir -p /rootfs/etc/cri/conf.d
64+
cp /pkg/10-containerd-image-verifier.part /rootfs/etc/cri/conf.d/
65+
test:
66+
- |
67+
mkdir -p /extensions-validator-rootfs
68+
cp -r /rootfs/ /extensions-validator-rootfs/rootfs
69+
cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
70+
/extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
71+
finalize:
72+
- from: /rootfs
73+
to: /rootfs
74+
- from: /pkg/manifest.yaml
75+
to: /

‎tools/containerd-image-verifier-sigstore/vars.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
VERSION: "{{ .SIGSTORE_POLICY_TESTER_VERSION }}"
2+
CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION: "{{ .CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION }}"

‎tools/vars.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,11 @@ LIBNVME_SHA512: 96a1bbd6cea1e77381254e242e781b023416abfbf44c82a0aa6eb0b316b30316
66
NVME_CLI_VERSION: v2.14
77
NVME_CLI_SHA256: ff689ec0dabd32e8077a9fc0b2732067b08dedeef471aadea0136ae210f6edd1
88
NVME_CLI_SHA512: 7f600ee719f06283e136427a0f9eb0b22412f7f4549c774768caff54150207ba87e2a431ea1569e5ed86a554aecd23c00c4e8c351aa0168a81807c86a0cb2edc
9+
# renovate: datasource=github-releases depName=sigstore/policy-tester
10+
SIGSTORE_POLICY_TESTER_VERSION: v0.12.0
11+
SIGSTORE_POLICY_TESTER_VERSION_SHA256: f0a3545341b426a77452f58be10f01d194e157e8232bf512967fd36984dd096e
12+
SIGSTORE_POLICY_TESTER_VERSION_SHA512: fb542d15b0b269e505888e41ba7af456e489d7592dca459b193e02ab59cbadd64c9bdcf23ef0323143f8c0905c2aecafad705bd56a31905f3e63dd311d022be1
13+
# renovate: datasource=github-releases depName=sigstore/policy-tester
14+
CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION: v0.2.0
15+
CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION_SHA256: aaa04e076733dcc08a20d7636be588846dfbf371f55fb23e82d3c0440779972c
16+
CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION_SHA512: cf62552a2842536fd07337eb7cdfb36afa6c795c99cb4eebdcaef0251848f4db2a763af21731d81af9fb6b46ccd4d604ca37c8ef7eaaad0d017722bb66cd2a4e

0 commit comments

Comments
 (0)