Chapter 5. Attesting and validating a container image

Procedure

1. Create a SLSA provenance predicate.json file; for example:

   echo '{
    "builder": {
      "id": "https://localhost/dummy-id"
    },
    "buildType": "https://localhost/dummy-type",
    "invocation": {},
    "buildConfig": {},
    "metadata": {
      "buildStartedOn": "2023-09-25T16:26:44Z",
      "buildFinishedOn": "2023-09-25T16:28:59Z",
      "completeness": {
        "parameters": false,
        "environment": false,
        "materials": false
      },
      "reproducible": false
    },
    "materials": []
   }
   ' > predicate.json

2. Sign and attest the predicate.json file you just created; for example:

   cosign attest -y --fulcio-url=$FULCIO_URL \
      --rekor-url=$REKOR_URL \
      --oidc-issuer=$OIDC_ISSUER_URL \
      --predicate predicate.json \
      --type slsaprovenance $IMAGE

   Keycloak opens to automatically authenticate you based on your login when you signed your container image.

3. Verify the signature and attestation with Enterprise Contract, for example:

   ec validate image --image $IMAGE \
      --certificate-identity-regexp '.*' \
      --certificate-oidc-issuer-regexp '.*' \
      --output yaml --show-successes