Chapter 5. Attesting and validating a container image

Procedure

1. Create a SLSA provenance predicate.json file; for example:

   echo '{
    "builder": {
      "id": "https://localhost/dummy-id"
    },
    "buildType": "https://localhost/dummy-type",
    "invocation": {},
    "buildConfig": {},
    "metadata": {
      "buildStartedOn": "2023-09-25T16:26:44Z",
      "buildFinishedOn": "2023-09-25T16:28:59Z",
      "completeness": {
        "parameters": false,
        "environment": false,
        "materials": false
      },
      "reproducible": false
    },
    "materials": []
   }
   ' > predicate.json

   Copy to Clipboard Toggle word wrap

2. Sign and attest the predicate.json file you just created; for example:

   cosign attest -y --fulcio-url=$FULCIO_URL \
      --rekor-url=$REKOR_URL \
      --oidc-issuer=$OIDC_ISSUER_URL \
      --predicate predicate.json \
      --type slsaprovenance $IMAGE

   Copy to Clipboard Toggle word wrap

   Keycloak opens to automatically authenticate you based on your login when you signed your container image.

3. Verify the signature and attestation with Enterprise Contract, for example:

   ec validate image --image $IMAGE \
      --certificate-identity-regexp '.*' \
      --certificate-oidc-issuer-regexp '.*' \
      --output yaml --show-successes

   Copy to Clipboard Toggle word wrap