Chapter 3. Verifying signed artifacts in an offline environment

Procedure

1. In the signing environment, do the following steps:

   1. Sign an image by using cosign:

      cosign sign IMAGE_NAME:TAG

      $ cosign sign -y ttl.sh/rhtas/example-image:1h

   2. Get the Trust Root URL.

      1. For RHTAS deployments on Red Hat Enterprise Linux:

         $ export BASE_HOSTNAME=BASE_HOSTNAME_OF_RHTAS_SERVICE
         $ export TUF_SERVER_URL=https://tuf.${BASE_HOSTNAME}

      2. For RHTAS deployments on Red Hat OpenShift Container Platform:

         $ export TUF_SERVER_URL="$(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)"

   3. Create a clone of the Trust Root locally:

      $ export TUF_REPOSITORY="${HOME}/repository"
      $ tuftool clone --allow-root-download --metadata-dir "${TUF_REPOSITORY}" --targets-dir "${TUF_REPOSITORY}/targets" --metadata-url "${TUF_SERVER_URL}" --targets-url "${TUF_SERVER_URL}/targets"

   4. Create a compressed archive file of the Trust Root:

      $ tar -czvf repository.tar.gz "${TUF_REPOSITORY}"
      $ sha256sum repository.tar.gz

      Make note of the checksum output for use later in the offline environment.

   5. Copy the compressed archive file to the offline environment.

      Important

      You must copy the Trust Root compressed archive file every time you update The Update Framework (TUF) metadata files or when you rotate any RHTAS component keys and certificates.

2. In the offline environment, do the following steps:

   1. Change directory to where you copied the compressed archive file of the Trust Root.

   2. Verify the checksum by using the checksum value from the signing environment:

      $ echo "SHA256_CHECKSUM repository.tar.gz" > checksum.txt
      $ sha256sum --check checksum.txt || echo "Archive integrity compromised, don't continue with the procedure\!"

      Important

      Only continue if the integrity check is successful.

   3. Expand the compressed archive file:

      $ tar -xzvf repository.tar.gz

3. Initialize cosign:

   $ cd repository/
   $ cosign initialize --mirror=file://$(pwd)/ --root=$(pwd)/1.root.json

4. Verify the signed artifacts:

   $ export IMAGE="IMAGE_NAME:TAG"
   $ export SIGNING_EMAIL_ADDR=SIGNING_EMAIL_ADDRESS
   $ export SIGNING_OIDC_ISSUER=OIDC_ISSUER_URL
   $ cosign verify --certificate-identity="${SIGNING_EMAIL_ADDR}" --certificate-oidc-issuer="${SIGNING_OIDC_ISSUER}" "${IMAGE}"