Chapter 3. Verifying signed artifacts in an offline environment

Procedure

1. In the signing environment, do the following steps:

   1. Sign an image by using cosign:

      cosign sign IMAGE_NAME:TAG

      $ cosign sign -y ttl.sh/rhtas/example-image:1h

   2. Get the Trust Root URL.

      1. For RHTAS deployments on Red Hat Enterprise Linux:

         $ export BASE_HOSTNAME=BASE_HOSTNAME_OF_RHTAS_SERVICE
         $ export TUF_SERVER_URL=https://tuf.${BASE_HOSTNAME}

      2. For RHTAS deployments on Red Hat OpenShift Container Platform:

         $ export TUF_SERVER_URL="$(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)"

   3. Create a clone of the Trust Root locally:

      $ export TUF_REPOSITORY="${HOME}/repository"
      $ tuftool clone --allow-root-download --metadata-dir "${TUF_REPOSITORY}" --targets-dir "${TUF_REPOSITORY}/targets" --metadata-url "${TUF_SERVER_URL}" --targets-url "${TUF_SERVER_URL}/targets"

   4. Create a compressed archive file of the Trust Root:

      $ tar -czvf repository.tar.gz "${TUF_REPOSITORY}"
      $ sha256sum repository.tar.gz > checksum.txt

   5. Copy the compressed archive file and the checksum file to the offline environment.

      Important

      You must copy the Trust Root compressed archive file and the checksum file every time you update The Update Framework (TUF) metadata files or when you rotate any RHTAS component keys and certificates.

2. In the offline environment, do the following steps:

   1. Change directory to where you copied the compressed archive file of the Trust Root.

   2. Verify the checksum by using the checksum value from the signing environment:

      $ sha256sum --check checksum.txt || echo "Archive integrity compromised, don't continue with the procedure\!"

      Important

      Only continue if the integrity check is successful.

   3. Expand the compressed archive file:

      $ tar -xzvf repository.tar.gz

3. Verify the signed artifacts:

   $ cd repository/
   $ export IMAGE="IMAGE_NAME:TAG"
   $ export SIGNING_EMAIL_ADDR=SIGNING_EMAIL_ADDRESS
   $ export SIGNING_OIDC_ISSUER=OIDC_ISSUER_URL
   $ export TRUSTED_ROOT=$(pwd)/targets/*.trusted_root.json
   $ cosign verify --certificate-identity="${SIGNING_EMAIL_ADDR}" --certificate-oidc-issuer="${SIGNING_OIDC_ISSUER}" --trusted-root ${TRUSTED_ROOT} "${IMAGE}"

   Replace IMAGE_NAME:TAG, SIGNING_EMAIL_ADDRESS, and OIDC_ISSUER_URL with your relevant information.