From 650a6fe4b670a9b11d3b2cd4e69d6a2ce3c123d5 Mon Sep 17 00:00:00 2001 From: Bence Csati Date: Tue, 8 Oct 2024 15:03:12 +0200 Subject: [PATCH 1/4] feat: add image and chart signing Signed-off-by: Bence Csati --- .github/workflows/artifacts.yaml | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml index 1f921b674..af6fa2278 100644 --- a/.github/workflows/artifacts.yaml +++ b/.github/workflows/artifacts.yaml @@ -66,6 +66,9 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1 + - name: Set up Cosign + uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0 + - name: Set image name id: image-name run: echo "value=ghcr.io/${{ github.repository }}" >> "$GITHUB_OUTPUT" @@ -88,7 +91,6 @@ jobs: org.opencontainers.image.authors=Kube logging authors org.opencontainers.image.documentation=https://kube-logging.dev/docs/ - # Multiple exporters are not supported yet # See https://github.com/moby/buildkit/pull/2760 - name: Determine build output @@ -120,6 +122,19 @@ jobs: outputs: ${{ steps.build-output.outputs.value }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }} # push: ${{ inputs.publish }} + - name: Sign image with GitHub OIDC Token + if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization + env: + DIGEST: ${{ steps.build.outputs.digest }} + TAGS: ${{ steps.meta.outputs.tags }} + run: | + images="" + for tag in ${TAGS}; do + images+="${tag}@${DIGEST} " + done + + cosign sign --yes ${images} + - name: Set image ref id: image-ref run: echo "value=${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT" @@ -176,6 +191,9 @@ jobs: with: version: v3.12.0 + - name: Set up Cosign + uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0 + - name: Set chart name id: chart-name run: echo "value=${{ github.event.repository.name }}" >> "$GITHUB_OUTPUT" @@ -205,6 +223,12 @@ jobs: helm package charts/${{ steps.chart-name.outputs.value }} --version ${{ steps.version.outputs.value }} --app-version ${{ steps.version.outputs.value }} echo "package=${{ steps.chart-name.outputs.value }}-${{ steps.version.outputs.value }}.tgz" >> "$GITHUB_OUTPUT" + - name: Sign chart with GitHub OIDC Token + if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization + env: + PACKAGE: ${{ steps.build.outputs.package }} + run: cosign sign-blob --yes $PACKAGE + - name: Upload chart as artifact uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: From a6d10681ff2b802769a75257e898bbe8b1945978 Mon Sep 17 00:00:00 2001 From: Bence Csati Date: Wed, 9 Oct 2024 13:02:18 +0200 Subject: [PATCH 2/4] feat: verify signed image and chart Signed-off-by: Bence Csati --- .github/workflows/artifacts.yaml | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml index af6fa2278..9866d93ac 100644 --- a/.github/workflows/artifacts.yaml +++ b/.github/workflows/artifacts.yaml @@ -135,6 +135,13 @@ jobs: cosign sign --yes ${images} + - name: Verify signed image with cosign + if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization + run: | + cosign verify "${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }}" \ + --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/artifacts.yaml@${{ github.ref }}" \ + --certificate-oidc-issuer "https://token.actions.githubusercontent.com" + - name: Set image ref id: image-ref run: echo "value=${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT" @@ -227,7 +234,19 @@ jobs: if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization env: PACKAGE: ${{ steps.build.outputs.package }} - run: cosign sign-blob --yes $PACKAGE + run: | + cosign sign-blob --yes $PACKAGE \ + --bundle "$PACKAGE.cosign.bundle" + + - name: Verify signed chart with cosign + if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization + env: + PACKAGE: ${{ steps.build.outputs.package }} + run: | + cosign verify-blob $PACKAGE \ + --bundle "$PACKAGE.cosign.bundle" \ + --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/artifacts.yaml@${{ github.ref }}" \ + --certificate-oidc-issuer "https://token.actions.githubusercontent.com" - name: Upload chart as artifact uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 From 88d6aae27aa972c35ff496469314332dc8ceda10 Mon Sep 17 00:00:00 2001 From: Bence Csati Date: Wed, 9 Oct 2024 14:48:42 +0200 Subject: [PATCH 3/4] chore: upload bundle Signed-off-by: Bence Csati --- .github/workflows/artifacts.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml index 9866d93ac..c365118ae 100644 --- a/.github/workflows/artifacts.yaml +++ b/.github/workflows/artifacts.yaml @@ -248,6 +248,13 @@ jobs: --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/artifacts.yaml@${{ github.ref }}" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" + - name: Upload bundle as artifact + if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 + with: + name: "[${{ github.job }}] Cosign bundle" + path: ${{ steps.build.outputs.package }}.cosign.bundle + - name: Upload chart as artifact uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: From b7331dac99950bc7f00782b4adff1a1b9024ef9b Mon Sep 17 00:00:00 2001 From: Bence Csati Date: Wed, 9 Oct 2024 17:04:17 +0200 Subject: [PATCH 4/4] fix: verify chart as oci artifact instead of blob Signed-off-by: Bence Csati --- .github/workflows/artifacts.yaml | 52 +++++++++++++++----------------- 1 file changed, 25 insertions(+), 27 deletions(-) diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml index c365118ae..884771910 100644 --- a/.github/workflows/artifacts.yaml +++ b/.github/workflows/artifacts.yaml @@ -137,10 +137,15 @@ jobs: - name: Verify signed image with cosign if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization + env: + DIGEST: ${{ steps.build.outputs.digest }} + TAGS: ${{ steps.meta.outputs.tags }} run: | - cosign verify "${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }}" \ + for tag in ${TAGS}; do + cosign verify "${tag}@${DIGEST}" \ --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/artifacts.yaml@${{ github.ref }}" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" + done - name: Set image ref id: image-ref @@ -230,31 +235,6 @@ jobs: helm package charts/${{ steps.chart-name.outputs.value }} --version ${{ steps.version.outputs.value }} --app-version ${{ steps.version.outputs.value }} echo "package=${{ steps.chart-name.outputs.value }}-${{ steps.version.outputs.value }}.tgz" >> "$GITHUB_OUTPUT" - - name: Sign chart with GitHub OIDC Token - if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization - env: - PACKAGE: ${{ steps.build.outputs.package }} - run: | - cosign sign-blob --yes $PACKAGE \ - --bundle "$PACKAGE.cosign.bundle" - - - name: Verify signed chart with cosign - if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization - env: - PACKAGE: ${{ steps.build.outputs.package }} - run: | - cosign verify-blob $PACKAGE \ - --bundle "$PACKAGE.cosign.bundle" \ - --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/artifacts.yaml@${{ github.ref }}" \ - --certificate-oidc-issuer "https://token.actions.githubusercontent.com" - - - name: Upload bundle as artifact - if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 - with: - name: "[${{ github.job }}] Cosign bundle" - path: ${{ steps.build.outputs.package }}.cosign.bundle - - name: Upload chart as artifact uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 with: @@ -270,11 +250,29 @@ jobs: if: inputs.publish && inputs.release - name: Helm push - run: helm push ${{ steps.build.outputs.package }} oci://${{ steps.oci-registry-name.outputs.value }} + id: push + run: | + helm push ${{ steps.build.outputs.package }} oci://${{ steps.oci-registry-name.outputs.value }} &> push-metadata.txt + echo "digest=$(awk '/Digest: /{print $2}' push-metadata.txt)" >> "$GITHUB_OUTPUT" env: HELM_REGISTRY_CONFIG: ~/.docker/config.json if: inputs.publish && inputs.release + - name: Sign chart with GitHub OIDC Token + if: ${{ inputs.publish && inputs.release && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization + env: + DIGEST: ${{ steps.push.outputs.digest }} + run: cosign sign --yes "${{ steps.oci-chart-name.outputs.value }}@${DIGEST}" + + - name: Verify signed chart with cosign + if: ${{ inputs.publish && inputs.release && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization + env: + DIGEST: ${{ steps.push.outputs.digest }} + run: | + cosign verify "${{ steps.oci-chart-name.outputs.value }}@${DIGEST}" \ + --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/artifacts.yaml@${{ github.ref }}" \ + --certificate-oidc-issuer "https://token.actions.githubusercontent.com" + - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0 with: