Chapter 4. Signing a container image

Procedure

1. In your CLI, run this command: cosign generate-key-pair.
2. When prompted, enter a new password for the key-pair. Make sure your password is memorable and strong.

Procedure

1. Download the ec binary file from the OpenShift cluster:

   1. Log in to the OpenShift web console. From the home page, click the ? icon in the upper right, then select Command Line Tools.
   2. From the ec download section, click the link for your platform.

   3. Open a terminal, decompress the .gz file, and set the execute bit on the ec binary file:

      Examples for Linux and macOS

      • $ gunzip ec-amd64.gz
      • $ chmod +x ec-amd64

   4. Move the ec binary file to a directory within your $PATH environment:

      Example

      $ sudo mv ec-amd64 /usr/local/bin/ec

2. Configure your shell environment for container image signing and verification.

   1. Open a terminal and run the tas-env-variables.sh script from the sigstore-ocp directory:

      Example

      cd sigstore-ocp
      source tas-env-variables.sh

   2. (Optional) Set the environment variables manually:

      Example

      export OPENSHIFT_APPS_SUBDOMAIN=apps.$(oc get dns cluster -o jsonpath='{ .spec.baseDomain }')
      export OIDC_AUTHENTICATION_REALM=sigstore
      export FULCIO_URL=https://fulcio.$OPENSHIFT_APPS_SUBDOMAIN
      export OIDC_ISSUER_URL=https://keycloak-keycloak-system.$OPENSHIFT_APPS_SUBDOMAIN/auth/realms/$OIDC_AUTHENTICATION_REALM
      export REKOR_URL=https://rekor.$OPENSHIFT_APPS_SUBDOMAIN
      export TUF_URL=https://tuf.$OPENSHIFT_APPS_SUBDOMAIN

      Example

      $ source ./tas-env-vars.sh

3. Initialize The Update Framework (TUF) system:

   Example

   cosign initialize --mirror=$TUF_URL --root=$TUF_URL/root.json

4. Sign your container image:

   Syntax

   cosign sign -y --fulcio-url=$FULCIO_URL --rekor-url=$REKOR_URL --oidc-issuer=$OIDC_ISSUER_URL IMAGE_NAME

   Example

   cosign sign -y --fulcio-url=$FULCIO_URL --rekor-url=$REKOR_URL --oidc-issuer=$OIDC_ISSUER_URL example-hello-world@sha256:2788a47fd0ef1ece30898c1e608050ea71036d3329b9772dbb3d1f69313f745c

   In the web browser that opens, sign the container image with an email address.

5. Create a predicate.json file:

   Example

   {
     "builder": {
       "id": "https://localhost/dummy-id"
     },
     "buildType": "https://example.com/tekton-pipeline",
     "invocation": {},
     "buildConfig": {},
     "metadata": {
       "completeness": {
         "parameters": false,
         "environment": false,
         "materials": false
       },
       "reproducible": false
     },
     "materials": []
   }

6. Associate the predicate.json file with your container image:

   Syntax

   cosign attest -y --predicate ./predicate.json \
   --type slsaprovenance IMAGE_NAME:TAG

   Example

   $ cosign attest -y --predicate ./predicate.json \
   --type slsaprovenance example.io/hello-world:latest

7. Verify that the container image has at least one attestation and signature:

   Syntax

   cosign tree IMAGE_NAME:TAG

   Example

   $ cosign tree example.io/hello-world:latest
   📦 Supply Chain Security Related artifacts for an image: example.io/hello-world@sha256:7de5fa822a9d1e507c36565ee0cf50c08faa64505461c844a3ce3944d23efa35
   └── 💾 Attestations for an image tag: example.io/hello-world:sha256-7de5fa822a9d1e507c36565ee0cf50c08faa64505461c844a3ce3944d23efa35.att
      └── 🍒 sha256:40d94d96a6d3ab3d94b429881e1b470ae9a3cac55a3ec874051bdecd9da06c2e
   └── 🔐 Signatures for an image tag: example.io/hello-world:sha256-7de5fa822a9d1e507c36565ee0cf50c08faa64505461c844a3ce3944d23efa35.sig
      └── 🍒 sha256:f32171250715d4538aec33adc40fac2343f5092631d4fc2457e2116a489387b7

8. Verify the container image with Enterprise Contract:

   Syntax

   ec validate image --image IMAGE_NAME:TAG \
   --certificate-identity-regexp 'SIGNER_EMAIL_ADDR' \
   --certificate-oidc-issuer-regexp 'keycloak-keycloak-system' \
   --output yaml --show-successes

   Example

   $ ec validate image --image example.io/hello-world:latest \
   --certificate-identity 'jdoe@example.com' \
   --certificate-oidc-issuer 'keycloak-keycloak-system' \
   --output yaml --show-successes
   
   success: true
   successes:
     - metadata:
         code: builtin.attestation.signature_check
       msg: Pass
     - metadata:
         code: builtin.attestation.syntax_check
       msg: Pass
     - metadata:
         code: builtin.image.signature_check
       msg: Pass
   ec-version: v0.1.2427-499ef12
   effective-time: "2024-01-21T19:57:51.338191Z"
   key: ""
   policy: {}
   success: true

   Enterprise Contract generates a pass/fail report with details about any security violations. When you add the --info flag, the report includes more details and possible solutions for any violations.