feat: verify scheduler image signatures before run (#109)

* feat: verify scheduler image signatures before run

* chore: rebuild manpages

Author: dottorblaster

.github/workflows/go.yml

@@ -165,3 +165,6 @@ jobs:
 
     - name: Test
       run: go test -tags containers_image_openpgp -timeout 20m -v ./...
+
+    - name: E2E signature verification (network)
+      run: go test -tags 'containers_image_openpgp e2e' -timeout 5m -v ./internal/verify/...

cmd/schedctl/run.go

@@ -11,6 +11,7 @@ import (
 	"schedctl/internal/output"
 	"schedctl/internal/podman"
 	"schedctl/internal/schedulers"
+	"schedctl/internal/verify"
 )
 
 func NewRunCmd() *cli.Command {
@@ -41,12 +42,26 @@ Examples:
 				Local:    true,
 				Category: categoryProcess,
 			},
+			&cli.StringFlag{
+				Name:     "trust-policy",
+				Usage:    "path to a YAML trust policy for image signature verification",
+				Sources:  cli.EnvVars("SCHEDCTL_TRUST_POLICY"),
+				Local:    true,
+				Category: categoryProcess,
+			},
+			&cli.BoolFlag{
+				Name:     "allow-unsigned",
+				Usage:    "skip signature verification (NOT recommended; images run with elevated caps and load eBPF)",
+				Sources:  cli.EnvVars("SCHEDCTL_ALLOW_UNSIGNED"),
+				Local:    true,
+				Category: categoryProcess,
+			},
 		},
 		Action: runAction,
 	}
 }
 
-func runAction(_ context.Context, cmd *cli.Command) error {
+func runAction(ctx context.Context, cmd *cli.Command) error {
 	args := cmd.Args().Slice()
 	if len(args) == 0 {
 		return fmt.Errorf("exactly one scheduler ID required")
@@ -57,6 +72,8 @@ func runAction(_ context.Context, cmd *cli.Command) error {
 	driver := cmd.String("driver")
 	attach := cmd.Bool("attach")
 	version := cmd.String("version")
+	trustPolicyPath := cmd.String("trust-policy")
+	allowUnsigned := cmd.Bool("allow-unsigned")
 
 	result, err := schedulers.GetScheduler(schedulerID, version)
 	if err != nil {
@@ -74,27 +91,50 @@ func runAction(_ context.Context, cmd *cli.Command) error {
 		_, _ = output.Out("With arguments: %v\n", containerArgs)
 	}
 
+	imageRef := result.ImageURI
+	if allowUnsigned {
+		_, _ = output.Out("WARNING: --allow-unsigned set; skipping signature verification for %s\n", result.ImageURI)
+	} else {
+		policy, err := verify.LoadPolicy(trustPolicyPath)
+		if err != nil {
+			return fmt.Errorf("trust policy: %w", err)
+		}
+		verified, err := verify.Image(ctx, result.ImageURI, policy)
+		if err != nil {
+			return fmt.Errorf(
+				"image signature verification failed for %s: %w (pass --allow-unsigned to override)",
+				result.ImageURI, err,
+			)
+		}
+		signer := "unknown"
+		if len(verified.Signers) > 0 {
+			signer = verified.Signers[0].Describe()
+		}
+		_, _ = output.Out("Verified %s (signer: %s)\n", verified.ImageRef, signer)
+		imageRef = verified.ImageRef
+	}
+
 	if driver == constants.CONTAINERD {
 		client, err := containerd.NewClient()
 		if err != nil {
 			panic(err)
 		}
 		defer client.Close()
 
-		err = containerd.Run(client, result.ImageURI, schedulerID, attach, true, containerArgs)
+		err = containerd.Run(client, imageRef, schedulerID, attach, true, containerArgs)
 		if err != nil {
 			return err
 		}
 	}
 
 	if driver == constants.PODMAN {
-		err := podman.Run(result.ImageURI, schedulerID, attach, containerArgs)
+		err := podman.Run(imageRef, schedulerID, attach, containerArgs)
 		if err != nil {
 			panic(err)
 		}
 
 		if !attach {
-			_, _ = output.Out("Container %s started successfully\n", result.ImageURI)
+			_, _ = output.Out("Container %s started successfully\n", imageRef)
 		}
 	}
 

cmd/schedctl/run_test.go

@@ -51,3 +51,30 @@ func TestRunCmdAttachFlagIsCategorized(t *testing.T) {
 	assert.True(t, ok, "attach flag should be a *cli.BoolFlag")
 	assert.NotEmpty(t, attachFlag.Category, "attach flag should be assigned to a category for help output")
 }
+
+func TestRunCmdHasTrustPolicyFlag(t *testing.T) {
+	runCmd := cmd.NewRunCmd()
+
+	flag := lookupFlag(runCmd.Flags, "trust-policy")
+	assert.NotNil(t, flag, "run command should have 'trust-policy' flag")
+
+	stringFlag, ok := flag.(*cli.StringFlag)
+	assert.True(t, ok, "trust-policy flag should be a StringFlag")
+	assert.True(t, stringFlag.Local, "trust-policy flag should be local to the run command")
+	assert.Contains(t, stringFlag.Sources.EnvKeys(), "SCHEDCTL_TRUST_POLICY",
+		"trust-policy flag should read SCHEDCTL_TRUST_POLICY env var")
+}
+
+func TestRunCmdHasAllowUnsignedFlag(t *testing.T) {
+	runCmd := cmd.NewRunCmd()
+
+	flag := lookupFlag(runCmd.Flags, "allow-unsigned")
+	assert.NotNil(t, flag, "run command should have 'allow-unsigned' flag")
+
+	boolFlag, ok := flag.(*cli.BoolFlag)
+	assert.True(t, ok, "allow-unsigned flag should be a BoolFlag")
+	assert.False(t, boolFlag.Value, "allow-unsigned should default to false (verification on by default)")
+	assert.True(t, boolFlag.Local, "allow-unsigned flag should be local to the run command")
+	assert.Contains(t, boolFlag.Sources.EnvKeys(), "SCHEDCTL_ALLOW_UNSIGNED",
+		"allow-unsigned flag should read SCHEDCTL_ALLOW_UNSIGNED env var")
+}

dist/man/schedctl-run.1

@@ -9,8 +9,10 @@ schedctl-run \- Run a specific scheduler
 schedctl-run
 
 .EX
+[--allow-unsigned]
 [--attach|-a]
 [--driver|-d]=[value]
+[--trust-policy]=[value]
 [--version]=[value]
 .EE
 
@@ -37,10 +39,16 @@ schedctl run SCHEDULER [-- ARGS...]
 
 
 .SH GLOBAL OPTIONS
+\fB--allow-unsigned\fP: skip signature verification (NOT recommended; images run with elevated caps and load eBPF)
+
+.PP
 \fB--attach, -a\fP: attach to the current process instead of detaching
 
 .PP
 \fB--driver, -d\fP="": container runtime to use: containerd, podman (default: "podman")
 
+.PP
+\fB--trust-policy\fP="": path to a YAML trust policy for image signature verification
+
 .PP
 \fB--version\fP="": scheduler version (image tag) to run, e.g. v1.0.0

dist/man/schedctl.1

@@ -35,9 +35,15 @@ list available schedulers
 .SH run
 Run a specific scheduler
 
+.PP
+\fB--allow-unsigned\fP: skip signature verification (NOT recommended; images run with elevated caps and load eBPF)
+
 .PP
 \fB--attach, -a\fP: attach to the current process instead of detaching
 
+.PP
+\fB--trust-policy\fP="": path to a YAML trust policy for image signature verification
+
 .PP
 \fB--version\fP="": scheduler version (image tag) to run, e.g. v1.0.0
 

go.mod

@@ -7,11 +7,15 @@ require (
 	github.com/containerd/containerd/v2 v2.2.0
 	github.com/containers/podman/v5 v5.8.2
 	github.com/google/go-containerregistry v0.21.5
+	github.com/sigstore/cosign/v2 v2.6.3
+	github.com/sigstore/rekor v1.5.1
+	github.com/sigstore/sigstore v1.10.5
 	github.com/stretchr/testify v1.11.1
 	github.com/tmc/scp v0.0.0-20170824174625-f7b48647feef
 	github.com/urfave/cli-docs/v3 v3.1.0
 	github.com/urfave/cli/v3 v3.8.0
 	golang.org/x/crypto v0.50.0
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
@@ -54,14 +58,14 @@ require (
 	github.com/spf13/pflag v1.0.10 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
-	go.opentelemetry.io/otel v1.39.0 // indirect
-	go.opentelemetry.io/otel/metric v1.39.0 // indirect
-	go.opentelemetry.io/otel/trace v1.39.0 // indirect
+	go.opentelemetry.io/otel v1.41.0 // indirect
+	go.opentelemetry.io/otel/metric v1.41.0 // indirect
+	go.opentelemetry.io/otel/trace v1.41.0 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.43.0
 	golang.org/x/text v0.36.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect
 	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -73,7 +77,10 @@ require (
 	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
 	github.com/containerd/plugin v1.0.0 // indirect
@@ -82,31 +89,68 @@ require (
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
 	github.com/containers/ocicrypt v1.2.1 // indirect
 	github.com/containers/psgo v1.9.1-0.20250826150930-4ae76f200c86 // indirect
+	github.com/coreos/go-oidc/v3 v3.17.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.6.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
 	github.com/cyphar/filepath-securejoin v0.5.2 // indirect
+	github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
+	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
 	github.com/disiqueira/gotree/v3 v3.0.2 // indirect
 	github.com/docker/cli v29.4.0+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker v28.5.2+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.4 // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/go-chi/chi/v5 v5.2.5 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-openapi/analysis v0.24.3 // indirect
+	github.com/go-openapi/errors v0.22.7 // indirect
+	github.com/go-openapi/jsonpointer v0.22.5 // indirect
+	github.com/go-openapi/jsonreference v0.21.5 // indirect
+	github.com/go-openapi/loads v0.23.3 // indirect
+	github.com/go-openapi/runtime v0.29.3 // indirect
+	github.com/go-openapi/spec v0.22.4 // indirect
+	github.com/go-openapi/strfmt v0.26.0 // indirect
+	github.com/go-openapi/swag v0.25.5 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
+	github.com/go-openapi/swag/conv v0.25.5 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.5 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
+	github.com/go-openapi/swag/loading v0.25.5 // indirect
+	github.com/go-openapi/swag/mangling v0.25.5 // indirect
+	github.com/go-openapi/swag/netutils v0.25.5 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.5 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
+	github.com/go-openapi/validate v0.25.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/godbus/dbus/v5 v5.1.1-0.20241109141217-c266b19b28e9 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/certificate-transparency-go v1.3.2 // indirect
 	github.com/google/go-intervals v0.0.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/in-toto/attestation v1.1.2 // indirect
+	github.com/in-toto/in-toto-golang v0.9.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect
 	github.com/jinzhu/copier v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.4.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/kr/fs v0.1.0 // indirect
+	github.com/letsencrypt/boulder v0.20260223.0 // indirect
 	github.com/manifoldco/promptui v0.9.0 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mattn/go-sqlite3 v1.14.32 // indirect
@@ -120,35 +164,53 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 // indirect
 	github.com/nxadm/tail v1.4.11 // indirect
+	github.com/oklog/ulid/v2 v2.1.1 // indirect
 	github.com/opencontainers/cgroups v0.0.5 // indirect
 	github.com/opencontainers/runc v1.3.4 // indirect
 	github.com/opencontainers/runtime-tools v0.9.1-0.20250523060157-0ea5ed0382a2 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/sftp v1.13.9 // indirect
 	github.com/proglottis/gpgme v0.1.5 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
+	github.com/sassoftware/relic v7.2.1+incompatible // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.10.0 // indirect
+	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/sigstore/fulcio v1.8.5 // indirect
 	github.com/sigstore/protobuf-specs v0.5.0 // indirect
-	github.com/sigstore/sigstore v1.10.4 // indirect
+	github.com/sigstore/rekor-tiles/v2 v2.0.1 // indirect
+	github.com/sigstore/sigstore-go v1.1.4 // indirect
+	github.com/sigstore/timestamp-authority/v2 v2.0.3 // indirect
 	github.com/skeema/knownhosts v1.3.2 // indirect
 	github.com/smallstep/pkcs7 v0.1.1 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
 	github.com/sylabs/sif/v2 v2.22.0 // indirect
+	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
+	github.com/theupdateframework/go-tuf v0.7.0 // indirect
+	github.com/theupdateframework/go-tuf/v2 v2.3.0 // indirect
+	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
+	github.com/transparency-dev/formats v0.0.0-20251017110053-404c0d5b696c // indirect
+	github.com/transparency-dev/merkle v0.0.2 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/vbatts/tar-split v0.12.2 // indirect
 	github.com/vbauerster/mpb/v8 v8.10.2 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.podman.io/common v0.67.1 // indirect
 	go.podman.io/image/v5 v5.39.2 // indirect
 	go.podman.io/storage v1.62.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.1 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/mod v0.35.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/term v0.42.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
 	tags.cncf.io/container-device-interface v1.0.1 // indirect
 )