Chapter 3. Verifying signed artifacts in an offline environment

Procedure

1. In the signing environment, do the following steps:

   1. Sign an image by using cosign:

      cosign sign IMAGE_NAME:TAG

      Copy to Clipboard Toggle word wrap

      $ cosign sign -y ttl.sh/rhtas/example-image:1h

      Copy to Clipboard Toggle word wrap

   2. Get the Trust Root URL.

      1. For RHTAS deployments on Red Hat Enterprise Linux:

         $ export BASE_HOSTNAME=BASE_HOSTNAME_OF_RHTAS_SERVICE
         $ export TUF_SERVER_URL=https://tuf.${BASE_HOSTNAME}

         Copy to Clipboard Toggle word wrap

      2. For RHTAS deployments on Red Hat OpenShift Container Platform:

         $ export TUF_SERVER_URL="$(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)"

         Copy to Clipboard Toggle word wrap

   3. Create a clone of the Trust Root locally:

      $ export TUF_REPOSITORY="${HOME}/repository"
      $ tuftool clone --allow-root-download --metadata-dir "${TUF_REPOSITORY}" --targets-dir "${TUF_REPOSITORY}/targets" --metadata-url "${TUF_SERVER_URL}" --targets-url "${TUF_SERVER_URL}/targets"

      Copy to Clipboard Toggle word wrap

   4. Create a compressed archive file of the Trust Root:

      $ tar -czvf repository.tar.gz "${TUF_REPOSITORY}"
      $ sha256sum repository.tar.gz

      Copy to Clipboard Toggle word wrap

      Make note of the checksum output for use later in the offline environment.

   5. Copy the compressed archive file to the offline environment.

      Important

      You must copy the Trust Root compressed archive file every time you update The Update Framework (TUF) metadata files or when you rotate any RHTAS component keys and certificates.

2. In the offline environment, do the following steps:

   1. Change directory to where you copied the compressed archive file of the Trust Root.

   2. Verify the checksum by using the checksum value from the signing environment:

      $ echo "SHA256_CHECKSUM repository.tar.gz" > checksum.txt
      $ sha256sum --check checksum.txt || echo "Archive integrity compromised, don't continue with the procedure\!"

      Copy to Clipboard Toggle word wrap
      Important

      Only continue if the integrity check is successful.

   3. Expand the compressed archive file:

      $ tar -xzvf repository.tar.gz

      Copy to Clipboard Toggle word wrap

3. Initialize cosign:

   $ cd repository/
   $ cosign initialize --mirror=file://$(pwd)/ --root=$(pwd)/1.root.json

   Copy to Clipboard Toggle word wrap

4. Verify the signed artifacts:

   $ export IMAGE="IMAGE_NAME:TAG"
   $ export SIGNING_EMAIL_ADDR=SIGNING_EMAIL_ADDRESS
   $ export SIGNING_OIDC_ISSUER=OIDC_ISSUER_URL
   $ cosign verify --certificate-identity="${SIGNING_EMAIL_ADDR}" --certificate-oidc-issuer="${SIGNING_OIDC_ISSUER}" "${IMAGE}"

   Copy to Clipboard Toggle word wrap