Skip to content

Commit ea1c078

Browse files
BobyMCbobsBobyMCbobs
committed
feat: add sigstore-policy-tester extension
To enable verifying of every container image run through containerd
1 parent 95ddb77 commit ea1c078

File tree

6 files changed

+130
-0
lines changed

6 files changed

+130
-0
lines changed

‎Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ TARGETS += qlogic-firmware
9393
TARGETS += realtek-firmware
9494
TARGETS += spin
9595
TARGETS += stargz-snapshotter
96+
TARGETS += sigstore-policy-tester
9697
TARGETS += tailscale
9798
TARGETS += thunderbolt
9899
TARGETS += uinput

‎tools/sigstore-policy-tester/README.md

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# sigstore-policy-tester extension
2+
3+
## Installation
4+
5+
See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
6+
7+
## Usage
8+
9+
```yaml
10+
machine:
11+
files:
12+
- content: |
13+
[plugins]
14+
[plugins."io.containerd.image-verifier.v1.bindir"]
15+
bin_dir = "/usr/local/bin/containerd-image-verifier"
16+
max_verifiers = 10
17+
per_verifier_timeout = "10s"
18+
path: /etc/cri/conf.d/20-customization.part
19+
op: create
20+
- content: |
21+
apiVersion: policy.sigstore.dev/v1alpha1
22+
kind: ClusterImagePolicy
23+
metadata:
24+
name: system
25+
spec:
26+
images:
27+
- glob: "**"
28+
authorities:
29+
- keyless:
30+
url: https://fulcio.sigstore.dev
31+
identities:
32+
- issuer: https://accounts.google.com
33+
subject: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
34+
ctlog:
35+
url: https://rekor.sigstore.dev
36+
- keyless:
37+
identities:
38+
- issuer: https://accounts.google.com
39+
subjectRegExp: "@siderolabs\.com$"
40+
path: /etc/containers/sigstore/policy.yaml
41+
op: create
42+
```
43+
44+
**Important note: add all other identities and keys within the ClusterImagePolicy above for target container images**

‎tools/sigstore-policy-tester/manifest.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: v1alpha1
2+
metadata:
3+
name: sigstore-policy-tester
4+
version: "$VERSION"
5+
author: Sigstore Authors
6+
description: |
7+
Verify images signed against a policy.yaml
8+
compatibility:
9+
talos:
10+
version: ">= v0.12.0"

‎tools/sigstore-policy-tester/pkg.yaml

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: sigstore-policy-tester
2+
variant: scratch
3+
shell: /toolchain/bin/bash
4+
dependencies:
5+
- stage: base
6+
steps:
7+
- sources:
8+
- url: https://github.com/sigstore/policy-controller/archive/refs/tags/{{ .SIGSTORE_POLICY_TESTER_VERSION }}.tar.gz
9+
destination: sigstore-policy-controller.tar.gz
10+
sha256: f0a3545341b426a77452f58be10f01d194e157e8232bf512967fd36984dd096e
11+
sha512: fb542d15b0b269e505888e41ba7af456e489d7592dca459b193e02ab59cbadd64c9bdcf23ef0323143f8c0905c2aecafad705bd56a31905f3e63dd311d022be1
12+
- url: https://github.com/BobyMCbobs/containerd-image-verifier-sigstore/archive/refs/tags/{{ .CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION }}.tar.gz
13+
destination: containerd-image-verifier-sigstore.tar.gz
14+
sha256: e62231ad2a45027fe6c194345a00eddd9f7d65ad1e231a7ed182e534feee1d6d
15+
sha512: a7f315a03c52a23fabf8a1783f3ec38a2961a714bd00e56cc67bcce89155ddeed299dd080787c09bd50dc083da58df7addecf54f2e95b5119037de9752cf096e
16+
env:
17+
GOPATH: /go
18+
cachePaths:
19+
- /.cache/go-build
20+
- /go/pkg
21+
prepare:
22+
- |
23+
sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml
24+
- |
25+
mkdir -p ${GOPATH}/src/github.com/sigstore/policy-controller
26+
27+
tar -xzf sigstore-policy-controller.tar.gz --strip-components=1 -C ${GOPATH}/src/github.com/sigstore/policy-controller
28+
- |
29+
mkdir -p ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
30+
31+
tar -xzf containerd-image-verifier-sigstore.tar.gz --strip-components=1 -C ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
32+
build:
33+
- |
34+
export PATH=${PATH}:${TOOLCHAIN}/go/bin
35+
cd ${GOPATH}/src/github.com/sigstore/policy-controller
36+
37+
mkdir ./bin
38+
39+
CGO_ENABLED=0 go build -o ./bin/sigstore-policy-tester ./cmd/tester
40+
- |
41+
export PATH=${PATH}:${TOOLCHAIN}/go/bin
42+
cd ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
43+
44+
mkdir ./bin
45+
46+
CGO_ENABLED=0 go build -o ./bin/containerd-image-verifier-sigstore .
47+
install:
48+
- |
49+
cd ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
50+
mkdir -p /rootfs/usr/local/bin/
51+
cp -av bin/sigstore-policy-tester /rootfs/usr/local/bin/
52+
53+
- |
54+
cd ${GOPATH}/src/github.com/BobyMCbobs/containerd-image-verifier-sigstore
55+
mkdir -p /rootfs/usr/local/bin/containerd-image-verifier/
56+
cp -av bin/containerd-image-verifier-sigstore /rootfs/usr/local/bin/containerd-image-verifier/
57+
58+
test:
59+
- |
60+
mkdir -p /extensions-validator-rootfs
61+
cp -r /rootfs/ /extensions-validator-rootfs/rootfs
62+
cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
63+
/extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
64+
65+
finalize:
66+
- from: /rootfs
67+
to: /rootfs
68+
- from: /pkg/manifest.yaml
69+
to: /

‎tools/sigstore-policy-tester/vars.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
VERSION: "{{ .SIGSTORE_POLICY_TESTER_VERSION }}"
2+
CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION: "{{ .CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION }}"

‎tools/vars.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,7 @@
22
LIBNVME_VERSION: v1.11.1
33
# renovate: datasource=github-releases depName=linux-nvme/nvme-cli
44
NVME_CLI_VERSION: v2.11
5+
# renovate: datasource=github-releases depName=sigstore/policy-tester
6+
SIGSTORE_POLICY_TESTER_VERSION: v0.12.0
7+
# renovate: datasource=github-releases depName=sigstore/policy-tester
8+
CONTAINERD_IMAGE_VERIFIER_SIGSTORE_VERSION: v0.1.0

0 commit comments

Comments
 (0)