Script to create keyless signed images for testing

As per the comments, I'm creating an image that we can use with the
acceptance tests. Unlike the "golden-container" it wasn't built in
Konflux and hence it doesn't have a realistic Chains style
attestation. But it does have a keylessly sig and an a valid
attestation.

And actually there are two images, one created with cosign v2, and
one with cosign v3. This should be useful since we need to support
the new sigstore bundle introduced in cosign v3.

The verify.sh isn't important for anything, but I want to check it
in anyhow, since it serves as a nice instruction on how to verify
the keyless signed images and attestations, and it's useful to
sanity check the images when/if they need recreating.

Ref: https://issues.redhat.com/browse/EC-1652

Author: simonbaird

hack/keyless-test-image/create.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Copyright The Conforma Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+source "$(dirname ${BASH_SOURCE[0]})/helpers.sh"
+
+# This script creates two keylessly signed images that we use in our acceptance
+# tests. One created with cosign v2 and one with cosign v3 using the newer
+# sigstore bundle and OCI referrers
+
+# Prereqs if you want to recreate these images:
+# - A working push credential for quay.io/conforma/test
+# - The ability to authenticate as the "conformacommunity@gmail.com" Google account
+
+# Note: Ideally we would not rely on external images in the tests, but this is
+# the quickest way to get some meaningful acceptance tests for the keyless
+# image verification in the Tekton task. Also, we already have some other
+# external images used in the tests, so I figure adding one more isn't such a
+# big deal.
+
+REPO=quay.io/conforma/test
+
+# Todo: Maybe we can we specify these explicitly when signing
+# CERT_IDENITY="conformacommunity@gmail.com"
+# CERT_OIDC_ISSUER="https://accounts.google.com"
+
+# Todo maybe: Pin the versions of cosign, (perhaps with a go.mod file?) instead
+# of using @latest.
+
+for ver in v2 v3; do
+  LABEL="keyless_$ver"
+  COSIGN="go run github.com/sigstore/cosign/$ver/cmd/cosign@latest"
+  GIT_VER=$($COSIGN version --json | jq -r .gitVersion)
+  DATE_STR=$(date)
+
+
+  h1 "Creating image ($ver)"
+  podman build -t "$REPO:$LABEL" -f - . <<EOF
+FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
+RUN echo "hello from the conforma cosign $GIT_VER keyless signing test image built on $DATE_STR" > /hello.txt
+CMD ["cat", "/hello.txt"]
+EOF
+
+  h1 "Pushing image ($ver)"
+  podman push "$REPO:$LABEL"
+
+  h1 "Signing image ($ver)"
+  # Use the digest otherwise cosign complains
+  DIGEST=$(skopeo inspect "docker://quay.io/conforma/test:keyless_$ver" | jq -r .Digest)
+  $COSIGN sign -y "$REPO@$DIGEST"
+
+  h1 "Creating a signed attestation ($ver)"
+  # Push a minimal attestation
+  $COSIGN attest -y \
+    --predicate - \
+    --type "https://slsa.dev/provenance/v1" \
+    $REPO@$DIGEST <<EOF
+{
+  "buildDefinition": {
+    "buildType": "https://example.com/build-type/v1",
+    "externalParameters": {},
+    "internalParameters": {},
+    "resolvedDependencies": []
+  },
+  "runDetails": {
+    "builder": {
+      "id": "https://example.com/builder"
+    },
+    "metadata": {}
+  }
+}
+EOF
+
+done

hack/keyless-test-image/helpers.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Copyright The Conforma Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+# Output a fancy heading
+function h1() {
+  local text="$1"
+  local line=$(sed 's/./─/g' <<< "$text")
+  echo "╭─$line─╮"
+  echo "┝ $text ┥"
+  echo "╰─$line─╯"
+}
+
+# Output some text and wait for the user to press enter
+function pause() {
+  local default_msg="Press Enter to continue..."
+  local msg="${1:-$default_msg}"
+
+  nl
+  read -p "$msg"
+  nl
+}
+
+# Output a line break
+function nl() {
+  printf "\n"
+}

hack/keyless-test-image/verify.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Copyright The Conforma Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+source "$(dirname ${BASH_SOURCE[0]})/helpers.sh"
+
+# Verify the images created in create.sh
+
+# Adjust as needed
+CERT_ARGS=(
+--certificate-identity=conformacommunity@gmail.com
+--certificate-oidc-issuer=https://accounts.google.com
+)
+
+REPO=quay.io/conforma/test
+
+SLSA=https://slsa.dev/provenance/v1
+
+# Verify using the same version of cosign that created sigs and atts:
+
+for ver in v2 v3; do
+  COSIGN="go run github.com/sigstore/cosign/$ver/cmd/cosign@latest"
+  IMAGE_REF="$REPO:keyless_$ver"
+
+  h1 "cosign tree $IMAGE_REF"
+  $COSIGN tree "$IMAGE_REF"
+  pause
+
+  h1 "cosign verify $IMAGE_REF"
+  $COSIGN verify "$IMAGE_REF" "${CERT_ARGS[@]}" | jq
+  pause
+
+  h1 "cosign verify-attestation $IMAGE_REF"
+  $COSIGN verify-attestation "$IMAGE_REF" --type "$SLSA" "${CERT_ARGS[@]}" | jq
+  pause
+
+  h1 "cosign download attestation $IMAGE_REF"
+  $COSIGN download attestation --predicate-type "$SLSA" "$IMAGE_REF" | jq
+  pause
+done
+
+# Cross-version verification to demonstrate what happens:
+
+IMAGE_V2="$REPO:keyless_v2"
+IMAGE_V3="$REPO:keyless_v3"
+COSIGN_V2="go run github.com/sigstore/cosign/v2/cmd/cosign@latest"
+COSIGN_V3="go run github.com/sigstore/cosign/v3/cmd/cosign@latest"
+
+h1 "Backwards compatibility works (v2 sig with v3 cosign)"
+$COSIGN_V3 verify "$IMAGE_V2" "${CERT_ARGS[@]}" > /dev/null
+$COSIGN_V3 verify-attestation "$IMAGE_V2" --type "$SLSA" "${CERT_ARGS[@]}" > /dev/null
+pause
+
+h1 "Forwards compatibility does not work (v3 sig with v2 cosign)"
+set +e
+$COSIGN_V2 verify "$IMAGE_V3" "${CERT_ARGS[@]}"
+$COSIGN_V2 verify-attestation "$IMAGE_V3" --type "$SLSA" "${CERT_ARGS[@]}"
+set -e
+pause