Conversation
dosubot
bot
added
the
size:M
If the upstream image is tampered with we should automatically fail the image build and prevent any futher security breaches. This is not foolproof as the implementation grabs the public key from a git repository instead of locally, but it will ensure that the key from the git repository did sign the image. Fixes: ublue-os#25 Co-authored-by: XLion <xlion@xlion.tw> Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
Venefilyn
force-pushed
the
feat/verify-upstream
branch
from
3f4e9f6 to
a42a285
Compare
dosubot
bot
added
size:S
| # This can fail through a key mismatch or upstream image not being signed. | ||
| # | ||
| # We find the upstream image by checking the 'FROM' field. | ||
| - name: Verify upstream container image |
There was a problem hiding this comment.
I'm hesitating to do this in the workflow.
If we are doing this in the workflow, we could reuse our cosign verify action that RJ made. https://github.com/EyeCantCU/cosign-action/blob/main/verify/action.yml
That said, it hasn't been updated in months.
There was a problem hiding this comment.
I feel like we could make this owned by the org or some org at least to reduce bus factor. Can check with the repo maintainer maybe?
There was a problem hiding this comment.
We can put this in the org but someone should check to see if this should live in the sigstore space? Surely we can't be the only one who needs this? cc @EyeCantCU
There was a problem hiding this comment.
Hey all. The actions there are still up to date and leverage the latest version of cosign. There hasn't been much of a reason to expand on what's there. I'll check in with folks at sigstore and see if they want to host these actions in their org. If not, we can move them in org
There was a problem hiding this comment.
Awesome, thanks @EyeCantCU! Would reduce bus factor for sure :D
There was a problem hiding this comment.
Any news here @EyeCantCU? Think this PR here sounds worthwhile.
5 participants
If the upstream image is tampered with we should automatically fail the
image build and prevent any futher security breaches.
This is not foolproof as the implementation grabs the public key from a
git repository instead of locally, but it will ensure that the key from
the git repository did sign the image.
Fixes: #25
Co-authored-by: XLion xlion@xlion.tw
Signed-off-by: Freya Gustavsson freya@venefilyn.se