Chapter 2. Secrets for signing data in Tekton Chains

Procedure

1. Edit the TektonConfig CR by running the following command:

   $ oc edit TektonConfig config

2. In the TektonConfig CR, set the generateSigningSecret value to true:

   Example of creating an ECDSA cosign key pair by using the TektonConfig CR

   apiVersion: operator.tekton.dev/v1
   kind: TektonConfig
   metadata:
     name: config
   spec:
   # ...
     chain:
       disabled: false
       generateSigningSecret: true
   # ...

   generateSigningSecret

   The default value is false. Setting the value to true generates the ecdsa key pair.

3. After a few minutes, extract the public key from the secret and store it, so that you can use it to verify artifact attestations. Run the following command to extract the key:

   $ oc extract -n openshift-pipelines secret/signing-secrets --keys=cosign.pub

   The OpenShift Pipelines Operator generates an ecdsa type cosign key pair and stores it in the signing-secrets secret in the openshift-pipelines namespace. The secret includes the following files:

   • cosign.key: The private key
   • cosign.password: The password for decrypting the private key

   • cosign.pub The public key

     If a signing-secrets secret already exists, the Operator does not overwrite the secret.

     The cosign.pub file in your current directory has the public key extracted from the secret.

     Warning

     If you set the generateSigningSecret field from true to false, the Red Hat OpenShift Pipelines Operator overrides and empties any value in the signing-secrets secret.

     The Red Hat OpenShift Pipelines Operator does not offer the following security functions:

   • Key rotation
   • Auditing key usage
   • Proper access control to the key

Procedure

1. Generate the cosign.key and cosign.pub key pairs by running the following command:

   $ cosign generate-key-pair k8s://openshift-pipelines/signing-secrets

   Cosign prompts you for a password and then creates a Kubernetes secret.

2. Store the encrypted cosign.key private key and the cosign.password decryption password in the signing-secrets Kubernetes secret. Ensure that you store the private key as an encrypted Privacy Enhanced Mail (PEM) file of the ENCRYPTED COSIGN PRIVATE KEY type.

Procedure

1. Generate a public/private key pair by running the following command:

   $ skopeo generate-sigstore-key --output-prefix <mykey>

   <mykey>

   Replace <mykey> with a key name of your choice.

   Skopeo prompts you for a passphrase for the private key and then creates the key files named <mykey>.private and <mykey>.pub.

2. Encode the <mykey>.pub file by using the base64 tool and running the following command:

   $ base64 -w 0 <mykey>.pub > b64.pub

3. Encode the <mykey>.private file by using the base64 tool and running the following command:

   $ base64 -w 0 <mykey>.private > b64.private

4. Encode the passphrase using the base64 tool by running the following command:

   $ echo -n '<passphrase>' | base64 -w 0 > b64.passphrase

   <passphrase>

   Replace <passphrase> with the passphrase that you used for the key pair.

5. Create the signing-secrets secret in the openshift-pipelines namespace by running the following command:

   $ oc create secret generic signing-secrets -n openshift-pipelines

6. Edit the signing-secrets secret by running the following command:

   $ oc edit secret -n openshift-pipelines signing-secrets

   Add the encoded keys in the data of the secret in the following way:

   apiVersion: v1
   data:
     cosign.key: <Encoded <mykey>.private>
     cosign.password: <Encoded passphrase>
     cosign.pub: <Encoded <mykey>.pub>
   immutable: true
   kind: Secret
   metadata:
     name: signing-secrets
   # ...
   type: Opaque

   <Encoded <mykey>.private>

   Replace with the content of the b64.private file.

   <Encoded passphrase>

   Replace with the content of the b64.passphrase file.

   <Encoded <mykey>.pub>

   Replace with the content of the b64.pub file.

Procedure

1. Delete the signing-secret secret by running the following command:

   $ oc delete secret signing-secrets -n openshift-pipelines

2. Re-create the key pairs and store them in the secret using your preferred signing scheme.