Skip to content

Commit 3066da4

Browse files
BobyMCbobsBobyMCbobs
committed
feat: add sigstore-policy-tester extension
To enable verifying of every container image run through containerd
1 parent 95ddb77 commit 3066da4

File tree

7 files changed

+142
-0
lines changed

7 files changed

+142
-0
lines changed

‎Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ TARGETS += qlogic-firmware
9393
TARGETS += realtek-firmware
9494
TARGETS += spin
9595
TARGETS += stargz-snapshotter
96+
TARGETS += containerd-image-verifier-sigstore
9697
TARGETS += tailscale
9798
TARGETS += thunderbolt
9899
TARGETS += uinput

‎tools/containerd-image-verifier-sigstore/10-containerd-image-verifier.part

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[plugins]
2+
[plugins."io.containerd.image-verifier.v1.bindir"]
3+
bin_dir = "/usr/local/bin/containerd-image-verifier"
4+
max_verifiers = 10
5+
per_verifier_timeout = "10s"

‎tools/containerd-image-verifier-sigstore/README.md

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# containerd-image-verifier-sigstore extension
2+
3+
## Installation
4+
5+
See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
6+
7+
## Usage
8+
9+
```yaml
10+
machine:
11+
files:
12+
- content: |
13+
apiVersion: policy.sigstore.dev/v1alpha1
14+
kind: ClusterImagePolicy
15+
metadata:
16+
name: system
17+
spec:
18+
images:
19+
- glob: "**"
20+
authorities:
21+
- keyless:
22+
url: https://fulcio.sigstore.dev
23+
identities:
24+
- issuer: https://accounts.google.com
25+
subject: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
26+
ctlog:
27+
url: https://rekor.sigstore.dev
28+
path: /var/local/etc/containers/sigstore/kubernetes.yaml
29+
op: create
30+
- content: |
31+
apiVersion: policy.sigstore.dev/v1alpha1
32+
kind: ClusterImagePolicy
33+
metadata:
34+
name: system
35+
spec:
36+
images:
37+
- glob: "**"
38+
authorities:
39+
- keyless:
40+
identities:
41+
- issuer: https://accounts.google.com
42+
subjectRegExp: "@siderolabs\.com$"
43+
path: /var/local/etc/containers/sigstore/siderolabs.yaml
44+
op: create
45+
```
46+
47+
**Important note: add all other identities and keys within the ClusterImagePolicy above for target container images**

‎tools/containerd-image-verifier-sigstore/manifest.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: v1alpha1
2+
metadata:
3+
name: containerd-image-verifier-sigstore
4+
version: "$VERSION"
5+
author: Caleb Woodbine
6+
description: |
7+
Verify images signed with Sigstore against ClusterImagePolicy declarations
8+
compatibility:
9+
talos:
10+
version: ">= v1.9.0"

‎tools/containerd-image-verifier-sigstore/pkg.yaml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: containerd-image-verifier-sigstore
2+
variant: scratch
3+
shell: /toolchain/bin/bash
4+
dependencies:
5+
- stage: base
6+
steps:
7+
- sources:
8+
- url: https://github.com/sigstore/policy-controller/archive/refs/tags/{{ .SIGSTORE_POLICY_TESTER_VERSION }}.tar.gz
9+
destination: sigstore-policy-controller.tar.gz
10+
sha256: f0a3545341b426a77452f58be10f01d194e157e8232bf512967fd36984dd096e
11+
sha512: fb542d15b0b269e505888e41ba7af456e489d7592dca459b193e02ab59cbadd64c9bdcf23ef0323143f8c0905c2aecafad705bd56a31905f3e63dd311d022be1
12+
- url: https://github.com/BobyMCbobs/containerd-image-verifier-sigstore/archive/refs/tags/{{ .CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION }}.tar.gz
13+
destination: containerd-image-verifier-sigstore.tar.gz
14+
sha256: aaa04e076733dcc08a20d7636be588846dfbf371f55fb23e82d3c0440779972c
15+
sha512: cf62552a2842536fd07337eb7cdfb36afa6c795c99cb4eebdcaef0251848f4db2a763af21731d81af9fb6b46ccd4d604ca37c8ef7eaaad0d017722bb66cd2a4e
16+
env:
17+
GOPATH: /go
18+
cachePaths:
19+
- /.cache/go-build
20+
- /go/pkg
21+
prepare:
22+
- |
23+
sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml
24+
- |
25+
mkdir -p ${GOPATH}/src/github.com/sigstore/policy-controller
26+
27+
tar -xzf sigstore-policy-controller.tar.gz --strip-components=1 -C ${GOPATH}/src/github.com/sigstore/policy-controller
28+
- |
29+
mkdir -p ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
30+
31+
tar -xzf containerd-image-verifier-sigstore.tar.gz --strip-components=1 -C ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
32+
build:
33+
- |
34+
export PATH=${PATH}:${TOOLCHAIN}/go/bin
35+
cd ${GOPATH}/src/github.com/sigstore/policy-controller
36+
37+
mkdir ./bin
38+
39+
CGO_ENABLED=0 go build -o ./bin/sigstore-policy-tester ./cmd/tester
40+
- |
41+
export PATH=${PATH}:${TOOLCHAIN}/go/bin
42+
cd ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
43+
44+
mkdir ./bin
45+
46+
CGO_ENABLED=0 go build -ldflags="-X 'main.DefaultPolicyDirPath=/var/local/etc/containers/sigstore/'" -o ./bin/containerd-image-verifier-sigstore .
47+
install:
48+
- |
49+
cd ${GOPATH}/src/github.com/sigstore/policy-controller
50+
mkdir -p /rootfs/usr/local/bin/
51+
cp -av bin/sigstore-policy-tester /rootfs/usr/local/bin/
52+
53+
- |
54+
cd ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
55+
mkdir -p /rootfs/usr/local/bin/containerd-image-verifier/
56+
cp -av bin/containerd-image-verifier-sigstore /rootfs/usr/local/bin/containerd-image-verifier/
57+
58+
- |
59+
mkdir -p /rootfs/etc/cri/conf.d
60+
61+
cp /pkg/10-containerd-image-verifier.part /rootfs/etc/cri/conf.d/
62+
test:
63+
- |
64+
mkdir -p /extensions-validator-rootfs
65+
cp -r /rootfs/ /extensions-validator-rootfs/rootfs
66+
cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
67+
/extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
68+
69+
finalize:
70+
- from: /rootfs
71+
to: /rootfs
72+
- from: /pkg/manifest.yaml
73+
to: /

‎tools/containerd-image-verifier-sigstore/vars.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
VERSION: "{{ .SIGSTORE_POLICY_TESTER_VERSION }}"
2+
CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION: "{{ .CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION }}"

‎tools/vars.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,7 @@
22
LIBNVME_VERSION: v1.11.1
33
# renovate: datasource=github-releases depName=linux-nvme/nvme-cli
44
NVME_CLI_VERSION: v2.11
5+
# renovate: datasource=github-releases depName=sigstore/policy-tester
6+
SIGSTORE_POLICY_TESTER_VERSION: v0.12.0
7+
# renovate: datasource=github-releases depName=sigstore/policy-tester
8+
CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION: v0.2.0

0 commit comments

Comments
 (0)