Skip to content

Commit 9d65413

Browse files
nicholasdillenicholasdille
committed
Final slides for 20230517
1 parent 656f85c commit 9d65413

File tree

15 files changed

+227
-48
lines changed

15 files changed

+227
-48
lines changed

‎060_security/11_artifacts/referrers.demo

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Referrers
2+
3+
# Prepare OCI 1.1 compliant registry
4+
REGISTRY=127.0.0.1:5000
5+
docker container run --detach --name registry --publish "${REGISTRY}:5000" ghcr.io/oras-project/registry:v1.0.0-rc.4
6+
regctl registry set "${REGISTRY}" --tls disabled
7+
8+
# Prepare test image
9+
REPOSITORY=ubuntu
10+
TAG=22.04
11+
IMAGE="${REGISTRY}/${REPOSITORY}:${TAG}"
12+
docker pull "${REPOSITORY}:${TAG}"
13+
docker tag "${REPOSITORY}:${TAG}" "${IMAGE}"
14+
docker push "${IMAGE}"
15+
16+
# Create and link SBOM
17+
trivy image "${IMAGE}" --format cyclonedx --output cyclonedx.json
18+
cat cyclonedx.json \
19+
| regctl artifact put --subject "${IMAGE}" \
20+
--artifact-type application/vnd.cyclonedx+json \
21+
--file-media-type application/vnd.cyclonedx+json \
22+
--annotation "created-by=trivy" \
23+
--annotation "org.opencontainers.artifact.created=$(date -Iseconds)" \
24+
--annotation "org.opencontainers.artifact.description=CycloneDX JSON SBOM"
25+
trivy referrer list "${IMAGE}"
26+
27+
# Create and link SARIF report
28+
trivy image "${IMAGE}" --format sarif \
29+
| regctl artifact put --subject "${IMAGE}" \
30+
--artifact-type application/json \
31+
--file-media-type application/json \
32+
--annotation "created-by=trivy" \
33+
--annotation "org.opencontainers.artifact.created=$(date -Iseconds)" \
34+
--annotation "org.opencontainers.artifact.description=SARIF JSON"
35+
trivy referrer list "${IMAGE}"
36+
37+
# Sign container image
38+
COSIGN_EXPERIMENTAL=1 cosign sign -y --registry-referrers-mode oci-1-1 "${IMAGE}"
39+
40+
# Sign SBOM
41+
SOURCE_CYCLONEDX="$(
42+
regctl artifact tree --filter-artifact-type application/vnd.cyclonedx+json "${IMAGE}" --format "{{json .}}" \
43+
| jq -r '.referrer | .[0].reference.Digest'
44+
)"
45+
COSIGN_EXPERIMENTAL=1 cosign sign -y --
46+
registry-referrers-mode oci-1-1 "${IMAGE}@${SOURCE_CYCLONEDX}"
47+
oras discover "${IMAGE}" --plain-http --output tree
48+
49+
# Sign SARIF
50+
SOURCE_SARIF="$(
51+
regctl artifact tree --filter-artifact-type application/sarif+json "${IMAGE}" --format "{{json .}}" \
52+
| jq -r '.referrer | .[0].reference.Digest'
53+
)"
54+
COSIGN_EXPERIMENTAL=1 cosign sign -y --registry-referrers-mode oci-1-1 "${IMAGE}@${SOURCE_SARIF}"

‎060_security/11_artifacts/run.sh

+7-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,13 @@ cat cyclonedx.json \
3535
# ./cyclonedx.json:application/vnd.cyclonedx+json
3636
#cosign attach sbom ...
3737
trivy image "${IMAGE}" --format sarif \
38-
| trivy referrer put
38+
| regctl artifact put --subject "${IMAGE}" \
39+
--artifact-type application/sarif+json \
40+
--file-media-type application/sarif+json \
41+
--annotation "created-by=trivy" \
42+
--annotation "org.opencontainers.artifact.created=$(date -Iseconds)" \
43+
--annotation "org.opencontainers.artifact.description=SARIF JSON"
44+
#| trivy referrer put
3945

4046
trivy referrer list "${IMAGE}"
4147
trivy referrer list "${IMAGE}" --format table

‎060_security/11_artifacts/slides.md

+29-6
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,34 @@
1-
## OCI artifacts
1+
## OCI artifacts and referrers
22

3-
XXX [](https://github.com/opencontainers/artifacts)
3+
Open Container Initiative (OCI) is responsible for multiple specifications:
44

5-
XXX OCI 1.1.0-rc.2 [](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc.2/spec.md)
5+
- Runtime <span style="color: grey;">(how to talk to container runtime)</span> [](https://github.com/opencontainers/runtime-spec)
6+
- Image <span style="color: grey;">(how to store a container image)</span> [](https://github.com/opencontainers/image-spec)
7+
- Distribution <span style="color: grey;">(how to talk to image registries)</span> [](https://github.com/opencontainers/distribution-spec)
8+
- Artifact <span style="color: grey;">(how to store arbitraty data in registries)</span> [](https://github.com/opencontainers/artifacts)
69

7-
XXX [](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc.2/spec.md#enabling-the-referrers-api)
10+
OCI is slowly replacing Docker media types
811

9-
XXX list [](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc.2/spec.md#listing-referrers)
12+
Version 1.1 is in the making
1013

11-
XXX https://github.com/aquasecurity/trivy-plugin-referrer
14+
Distribution spec 1.1.0-rc.2 [](https://github.com/opencontainers/distribution-spec/blob/v1.1.0-rc.2/spec.md) adds referrers
15+
16+
Referrers add relationships between digests
17+
18+
Implementations: [regclient](https://github.com/regclient/regclient/blob/main/docs/regctl.md#artifact-commands), [trivy](https://github.com/aquasecurity/trivy-plugin-referrer), [oras](https://oras.land/docs/cli/reference_types/#discovering-artifact-references), [distribution](https://github.com/oras-project/distribution)
19+
20+
---
21+
22+
## Demo [<i class="fa fa-comment-code"></i>](https://github.com/nicholasdille/container-slides/blob/master/060_security/11_artifacts/referrers.demo "referrers.demo")
23+
24+
Upload demo image
25+
26+
Link SBOM
27+
28+
Link SARIF report (repeat daily)
29+
30+
Sign image
31+
32+
Sign SBOM
33+
34+
Sign SARIF

‎120_kubernetes/kyverno/cosign.md

+7-5
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
1-
## Kyverno for<br/>image signature validation
1+
## Kyverno for Cosign
22

3-
XXX
3+
Kyverno can verfiy image signatures
44

5-
XXX kyverno for testing keyless image signatures
5+
Select images using wildcards
66

7-
---
7+
Specify multiple signatures
88

9-
## Demo
9+
Defines how many signatures must match
10+
11+
### Demo [<i class="fa fa-comment-code"></i>](https://github.com/nicholasdille/container-slides/blob/master/120_kubernetes/kyverno/cosign.demo "cosign.demo")
1012

1113
Verify Kubernetes control plane images [](https://www.cncf.io/blog/2023/05/01/kyverno-verify-kubernetes-control-plane-images/)
1214

‎170_supply_chain_security/activity.md

+17-7
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,31 @@
22

33
Health metrics for Open Source projects using `scorecard` [](https://github.com/ossf/scorecard)
44

5-
XXX
5+
Prerequisite for funding via *Secure Open Source* (SOS) Rewards [](https://sos.dev/)
6+
7+
### Checks (exerpt) [](https://github.com/ossf/scorecard#scorecard-checks)
8+
9+
Branch protection
10+
11+
Code Review in PRs
12+
13+
Dependency update tool
14+
15+
Signed releases
616

717
### Example
818

919
```bash
1020
scorecard --repo=github.com/moby/moby
1121
```
1222

13-
XXX https://github.com/ossf/scorecard#scorecard-checks
14-
15-
XXX https://sos.dev/
16-
1723
---
1824

1925
## Scorecard data
2026

21-
XXX [](https://github.com/ossf/scorecard#public-data)
27+
One million critical open source projects are scanned weekls [](https://github.com/ossf/scorecard#public-data)
28+
29+
Data is shared publicly
2230

2331
### REST API
2432

@@ -30,4 +38,6 @@ curl -s https://api.securityscorecards.dev/projects/${PROJECT} \
3038

3139
### Google BigQuery
3240

33-
XXX
41+
Use web-based [BigQuery Explorer](http://console.cloud.google.com/bigquery)
42+
43+
Use `bq` on the console (part of `gcloud`)

‎170_supply_chain_security/approaches.md

+8-4
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
Follow the [Open Source Security Foundation](https://openssf.org/) (OSSF) [Concise Guide for developing more secure software](https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Concise-Guide-for-Developing-More-Secure-Software.md#readme)
66

7-
XXX minimalism
7+
Keep it simple and stupid (KISS) [](https://en.wikipedia.org/wiki/KISS_principle)
88

99
Automated dependency updates
1010

@@ -24,16 +24,20 @@ Create provenence [](https://slsa.dev/provenance) (signed description of artifac
2424

2525
## Unmaintained dependencies
2626

27+
[XKCD 2347](https://xkcd.com/2347/) by [Randall Munroe, XKCD](https://xkcd.com/about/)
28+
29+
<!-- .element: style="font-size: smaller; float: right; writing-mode: vertical-rl; margin-top: 0.5em;" -->
30+
2731
![](images/xkcd-2347-dependency.png) <!-- .element: style="float: right; width: 40%;" -->
2832

29-
Let's say, you have done all of the above
33+
Let's say, you have done all of the above
3034

3135
How can you be sure that your dependencies are maintained?
3236

3337
Will a vulnerability be fixed quickly?
3438

35-
XXX risk!
39+
Every dependency is a risk - unmaintained even more so
3640

37-
### XXX
41+
### Choose wisely
3842

3943
Follow the [Open Source Security Foundation](https://openssf.org/) (OSSF) [Concise Guide for evaluating open source software](https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Concise-Guide-for-Evaluating-Open-Source-Software.md#readme)

‎170_supply_chain_security/cosign/cosign.demo

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Cosign
2+
3+
# Login for packages
4+
docker login
5+
6+
# Build container image
7+
cat <<EOF >Dockerfile
8+
FROM ubuntu:22.04
9+
EOF
10+
docker build --tag ghcr.io/nicholasdille/container-slides/ubuntu:22.04 --push .
11+
12+
# Check package
13+
https://github.com/users/nicholasdille/packages/container/package/container-slides%2Fubuntu
14+
15+
# Keyless signature
16+
COSIGN_EXPERIMENTAL=1 cosign sign ghcr.io/nicholasdille/container-slides/ubuntu:22.04
17+
18+
# Check manifest
19+
regctl manifest get ghcr.io/nicholasdille/container-slides/ubuntu:22.04
20+
21+
# View signature
22+
DIGEST=???
23+
regctl manifest get ghcr.io/nicholasdille/container-slides/ubuntu:sha256-${DIGEST}.sig
24+
25+
# Check signature
26+
https://search.sigstore.dev/
27+
28+
# Verify signature
29+
EMAIL=???
30+
COSIGN_EXPERIMENTAL=1 cosign verify ghcr.io/nicholasdille/container-slides/ubuntu:22.04 --certificate-oidc-issuer https://github.com/login/oauth --cer
31+
tificate-identity ${EMAIL}

‎170_supply_chain_security/cosign/slides.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ Check the supply chain of required tools
4040

4141
---
4242

43-
## Demo
43+
## Demo [<i class="fa fa-comment-code"></i>](https://github.com/nicholasdille/container-slides/blob/master/170_supply_chain_security/cosign/cosign.demo "cosign.demo")
4444

4545
Sign a container image
4646

‎170_supply_chain_security/cosign/traditional.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Traditional signatures
2+
3+
XXX PGP
4+
5+
XXX distribution of public key
6+
7+
XXX web of trust

‎170_supply_chain_security/sbom-operator/slides.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Prometheus can scrape <i class="fa fa-circle-4"></i> them and Grafana visualize
1818

1919
---
2020

21-
## Demo
21+
## Demo [<i class="fa fa-comment-code"></i>](https://github.com/nicholasdille/container-slides/blob/master/170_supply_chain_security/sbom-operator/sbom.demo "sbom.demo")
2222

2323
See SBoMs in [git](https://github.com/nicholasdille/sbom-store)
2424

‎170_supply_chain_security/sbom/formats.demo

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# SBOM formats
2+
3+
# CycloneDX
4+
syft ubuntu:22.04 --output cyclonedx-json --file ubuntu-22.04.cyclonedx.json
5+
6+
# SPDX
7+
syft ubuntu:22.04 --output spdx-json --file ubuntu-22.04.spdx.json
8+
9+
# Syft
10+
syft ubuntu:22.04 --output syft-json --file ubuntu-22.04.syft.json

‎170_supply_chain_security/sbom/sarif.md

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
## SARIF
2+
3+
OASIS [](https://www.oasis-open.org/) Static Analysis Results Interchange Format (SARIF) [](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif)
4+
5+
XXX junit?
6+
7+
---
8+
9+
## Demo: SARIF
10+
11+
Generate SARIF report using `trivy`
12+
13+
Generate SARIF report using `grype`

‎170_supply_chain_security/sbom/slides.md

+25-17
Original file line numberDiff line numberDiff line change
@@ -44,44 +44,52 @@ docker-setup --tags=sbom plan
4444

4545
---
4646

47-
## Demo
47+
## Demo [<i class="fa fa-comment-code"></i>](https://github.com/nicholasdille/container-slides/blob/master/170_supply_chain_security/sbom/sbom.demo "sbom.demo")
4848

4949
SBoM generation
5050

5151
SBoM scanning
5252

5353
---
5454

55-
## Distribution of SBOMs
55+
## SBOM Formats
5656

57-
<i class="fa-duotone fa-sparkles fa-6x"></i> <!-- .element: style="float: right;" -->
57+
### CycloneDX
5858

59-
No standard available yet
59+
Metadata
6060

61-
### What is out there
61+
Components
6262

63-
Download from website
63+
### SPDX
6464

65-
Release asset
65+
Packages and files
6666

67-
Separate container image with same digest and suffix
67+
Relationships (what is found where)
6868

69-
Manifest list (BuiltKit)
69+
### syft
70+
71+
Metadata (source, distro, descriptor)
7072

71-
OCI 1.1 referrer
73+
Artifacts and files
74+
75+
### Demo [<i class="fa fa-comment-code"></i>](https://github.com/nicholasdille/container-slides/blob/master/170_supply_chain_security/sbom/formats.demo "formats.demo")
7276

7377
---
7478

75-
## SARIF
79+
## Distribution of SBOMs
7680

77-
OASIS [](https://www.oasis-open.org/) Static Analysis Results Interchange Format (SARIF) [](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif)
81+
<i class="fa-duotone fa-sparkles fa-6x"></i> <!-- .element: style="float: right;" -->
7882

79-
XXX junit?
83+
No standard available yet
8084

81-
---
85+
### What is out there
86+
87+
Download from website
8288

83-
## Demo: SARIF
89+
Release asset
8490

85-
Generate SARIF report using `trivy`
91+
Separate container image with same digest and suffix
92+
93+
Manifest list (BuiltKit)
8694

87-
Generate SARIF report using `grype`
95+
OCI 1.1 referrer

‎170_supply_chain_security/vulnerabilities.md

+7-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Vulnerabilities
22

3-
![](images/tenor-this-is-fine-gif-24177057.gif) <!-- .element: style="float: right; width: 40%;" -->
3+
![](images/tenor-this-is-fine-gif-24177057.gif) <!-- .element: style="float: right; width: 35%;" -->
44

55
Tracked by<br/>*Common Vulnerabilities and Exposures* (CVE) [](https://de.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)
66

@@ -11,6 +11,10 @@ Scored by<br/>*Common Vulnerability Scoring System* (CVSS) [](https://nvd.nist.g
1111
- Scale 0-10
1212
- Low, medium, high, critical
1313

14-
Also scored by<br/>Exploit Prediction Scoring System (EPSS) [](https://www.first.org/epss/)
14+
Also scored by<br/>*Exploit Prediction Scoring System* (EPSS) [](https://www.first.org/epss/)
1515

16-
Explore dependencies using https://deps.dev/
16+
### Understand your dependencies [](https://deps.dev/)
17+
18+
How many indirect dependencies are there?
19+
20+
How many unfixed vulnerabilities are there?

0 commit comments

Comments
 (0)