835 - Keyless Support for SBOM Attestations #910

spiffcs · 2022-03-23T15:54:06Z

Summary:

Update the syft attest command to use the cosign keyless workflow.

Users should be able to run syft attest -o syft-json alpine:latest and generate an In-Toto Attestation serialized as a DSSE envelope defined here, which is signed by github, google, or microsoft OIDC providers. They should only be able to UPLOAD attestation for images they own.

Users in this case will not have to bring their own key. Instead, ephemeral keys and certificates will be generated and signed automatically by the fulcio root CA. These signatures are then stored in the rekor transparency log which provides an attestation as to when the signature was created. The new feature supports Oauth flows through the browser. Device flows have not been tested and will be updated in follow up PR.

To test the new functionality on this branch you can run:
go run cmd/syft/main.go attest -o syft-json <IMAGE YOU HAVE WRITE ACCESS TO>
COSIGN_EXPERIMENTAL=1 cosign verify-attestation <IMAGE YOU HAVE WRITE ACCESS TO>

Documentation

Update README
Update ETUI to show progress for attestation flows

Signed-off-by: Christopher Phillips christopher.phillips@anchore.com

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

github-actions · 2022-03-23T18:54:12Z

Benchmark Test Results

Benchmark results from the latest changes vs base branch

name                                                       old time/op    new time/op    delta
ImagePackageCatalogers/ruby-gemspec-cataloger-2              1.14ms ± 0%    1.33ms ± 5%  +16.51%  (p=0.016 n=4+5)
ImagePackageCatalogers/python-package-cataloger-2            3.01ms ± 0%    3.13ms ± 8%   +4.18%  (p=0.016 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     940µs ± 1%    1063µs ± 6%  +13.04%  (p=0.008 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         631µs ± 1%     706µs ± 7%  +11.95%  (p=0.008 n=5+5)
ImagePackageCatalogers/dpkgdb-cataloger-2                     737µs ± 0%     912µs ± 5%  +23.68%  (p=0.008 n=5+5)
ImagePackageCatalogers/rpmdb-cataloger-2                      641µs ± 1%     780µs ± 7%  +21.74%  (p=0.008 n=5+5)
ImagePackageCatalogers/java-cataloger-2                      13.5ms ± 0%    15.3ms ±11%  +13.68%  (p=0.016 n=4+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.17ms ± 1%    1.29ms ± 4%  +10.21%  (p=0.008 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2          2.08µs ± 1%    2.31µs ± 6%  +10.96%  (p=0.008 n=5+5)
ImagePackageCatalogers/dotnet-deps-cataloger-2               1.26ms ± 1%    1.36ms ± 6%   +8.00%  (p=0.008 n=5+5)

name                                                       old alloc/op   new alloc/op   delta
ImagePackageCatalogers/ruby-gemspec-cataloger-2               185kB ± 0%     185kB ± 0%     ~     (p=0.548 n=5+5)
ImagePackageCatalogers/python-package-cataloger-2             900kB ± 0%     898kB ± 0%   -0.19%  (p=0.008 n=5+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     197kB ± 0%     197kB ± 0%   -0.18%  (p=0.008 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         141kB ± 0%     141kB ± 0%     ~     (p=0.421 n=5+5)
ImagePackageCatalogers/dpkgdb-cataloger-2                     177kB ± 0%     176kB ± 0%     ~     (p=0.056 n=5+5)
ImagePackageCatalogers/rpmdb-cataloger-2                      165kB ± 0%     164kB ± 0%   -0.07%  (p=0.008 n=5+5)
ImagePackageCatalogers/java-cataloger-2                      3.30MB ± 0%    3.30MB ± 0%     ~     (p=0.222 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                     1.24MB ± 0%    1.24MB ± 0%     ~     (p=0.056 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2            672B ± 0%      672B ± 0%     ~     (all equal)
ImagePackageCatalogers/dotnet-deps-cataloger-2                351kB ± 0%     352kB ± 0%   +0.13%  (p=0.008 n=5+5)

name                                                       old allocs/op  new allocs/op  delta
ImagePackageCatalogers/ruby-gemspec-cataloger-2               3.70k ± 0%     3.70k ± 0%     ~     (all equal)
ImagePackageCatalogers/python-package-cataloger-2             14.9k ± 0%     14.9k ± 0%     ~     (p=0.286 n=4+5)
ImagePackageCatalogers/php-composer-installed-cataloger-2     4.99k ± 0%     4.98k ± 0%     ~     (p=0.206 n=5+5)
ImagePackageCatalogers/javascript-package-cataloger-2         2.76k ± 0%     2.76k ± 0%     ~     (all equal)
ImagePackageCatalogers/dpkgdb-cataloger-2                     3.99k ± 0%     3.99k ± 0%     ~     (all equal)
ImagePackageCatalogers/rpmdb-cataloger-2                      4.06k ± 0%     4.06k ± 0%     ~     (all equal)
ImagePackageCatalogers/java-cataloger-2                       52.6k ± 0%     52.6k ± 0%     ~     (p=0.548 n=5+5)
ImagePackageCatalogers/apkdb-cataloger-2                      4.87k ± 0%     4.87k ± 0%     ~     (p=1.000 n=5+5)
ImagePackageCatalogers/go-module-binary-cataloger-2            15.0 ± 0%      15.0 ± 0%     ~     (all equal)
ImagePackageCatalogers/dotnet-deps-cataloger-2                6.72k ± 0%     6.72k ± 0%     ~     (all equal)

* main: (31 commits) reduce noise of log output (#976) add version info and remove double config call (#977) Rename syft-id to package-id (#970) update to cyclonedx-go 0.5.2 (#971) refactor command package to remove globals and add dependency injection fix: #953 Derive language from pURL - https://github.com/anchore/syft… (#957) Fix typo in CPE-parsing error (#966) Preserve syft IDs on SBOM decode (#963) Update GitHub format package_url and correlator (#961) Ensure SPDXIDs are valid (#955) Auto-PR needs to run go mod tidy (#958) Add workflow for automatic PR for new stereoscope updates (#954) Minor readme update to correct format information (#948) Update spdx22json to only take uppercase checksum algorithm (#946) add additional vendors for springframework (#945) Add digest property to parent and nested java package metadata (#941) Update write permissions and log into ghcr.io for release (#942) Retry auth URL lookup without docker credentialhelper workaround (#939) Ensure that all cyclonedx components have bom-refs (#914) Additionally publish docker images to GHCR (#934) ... Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

wagoodman · 2022-05-06T15:23:59Z

cmd/syft/cli/attest/attest.go

+		return nil, err
+	}
+
+	log.Infof("tlog entry created with index: %v", *entry.LogIndex)


nit: should this be debug? or if it's worthy information, should this information be elevated to the ETUI with upload progress (even if infinite spinner)?

cc @luhring on this one. I'm on the fence about including this in the default output. I'll demote it to debug for now, but if we come up with a good reason in this thread to why it should stick around I can elevate it into the ETUI

Does cosign show this? I don't remember for sure but I thought it does — since it's a convenient way to find the Rekor entry that was just created (i.e. after you run this, you can use a Rekor client to just to a lookup by index)

wagoodman · 2022-05-06T15:25:00Z

cmd/syft/cli/attest/attest.go

+	if err != nil {
+		return err
+	}
+
 	bus.Publish(partybus.Event{
 		Type: event.Exit,
 		Value: func() error {
 			_, err := os.Stdout.Write(signedPayload)


if we're uploading should we be outputting the signed payload to the screen? or suppress this?

I think we should still be publishing the payload to the screen on upload so the user is able to inspect what was uploaded, but I can also see how suppressing is gives a cleaner execution and we don't pollute the screen since payloads are large and noticeably indecipherable on first glance

cc @luhring for input

Yeah no strong opinion, but I think I'd lean toward not outputting it for now for the "clean feel" reason

removed output on upload

wagoodman · 2022-05-06T15:25:18Z

cmd/syft/cli/options/fulcio.go

+	"github.com/spf13/viper"
+)
+
+const DefaultFulcioURL = "https://fulcio.sigstore.dev"


nit: this can be unexported

wagoodman · 2022-05-06T15:25:49Z

cmd/syft/cli/options/fulcio.go

+		"identity token to use for certificate from fulcio")
+
+	cmd.Flags().BoolVar(&o.InsecureSkipFulcioVerify, "insecure-skip-verify", false,
+		"skip verifying fulcio published to the SCT (this should only be used for testing).")


What's the SCT? The docs should probably reflect the full name.

Also I used SCT incorrectly here so double good call out.

SCT is “Signed Certificate Timestamp”. We need this flag so that we don't have to setup a root CA for fulcio during testing. Fulcio returns a “Signed Certificate Timestamp”.

See here if you want the deep dive:
https://blog.chainguard.dev/a-fulcio-deep-dive/

wagoodman · 2022-05-06T15:26:52Z

cmd/syft/cli/attest/attest.go

 	}

-	sv, err := sign.SignerFromKeyOpts(ctx, "", "", ko)
+	sv, err := sign.SignerFromKeyOpts(ctx, "", "", *ko)


should nil check ko first

It's small so I updated it to pass by value instead of pointer here.

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* main: feat: add initial dotnet-support (#951) unblock timeout for power-user select CLI tests (#985) golang cataloger - main module version as is (#986) Fix `github-json` output option (#967) read Go main module version as is - (devel) (#981) reduce logging severity for non-Go binaries (#983) golang.org/x/crypto upgrade (#979)

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

developer-guy · 2022-05-11T19:16:23Z

This PR will also fix #990, by default, it'll attach attestation to an image requested to generate an attestation.
cc: @Dentrax @luhring

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

spiffcs added 15 commits March 22, 2022 12:26

wip

06be3a6

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

clean up and consolodate validation functions

bfb3827

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update tests with new path and new launcher

ce069ae

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update docker-compose for e2e testing

26a8ffe

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

wip

f101e9a

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

wip

ab4998c

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

wip

e49bdbc

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

master election working for trillian

8afc1fb

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

ct_server up and running

a9a5920

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update hard values for local testing

56410ec

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

dex issues

8e18b90

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

x509 CT server failure from fulcio

4443d4f

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

local flow works

3259c71

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

add skeleton flags for keyless workflow wip

f3c7ab5

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update options to sane defaults

659e1da

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

spiffcs force-pushed the 835-keyless-attestation-upgrade branch from 6050fad to 659e1da Compare March 23, 2022 18:48

spiffcs marked this pull request as draft March 24, 2022 15:30

spiffcs added 2 commits May 2, 2022 11:27

update keyless options to new cmd format

37ca6b2

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

spiffcs force-pushed the 835-keyless-attestation-upgrade branch from ecdbf62 to 4d302eb Compare May 2, 2022 19:23

update ko with new injected values

ebc96d3

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

spiffcs force-pushed the 835-keyless-attestation-upgrade branch from 4d302eb to ebc96d3 Compare May 2, 2022 19:28

spiffcs added 3 commits May 2, 2022 15:40

update log to use syft logging package

b0b3907

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

static touchups

dbf4f87

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update injected options

ebded6f

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

spiffcs marked this pull request as ready for review May 3, 2022 16:39

spiffcs marked this pull request as draft May 3, 2022 16:44

spiffcs added 2 commits May 3, 2022 15:17

wip

9acebc1

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update to upload attestation

e599636

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

wagoodman reviewed May 6, 2022

View reviewed changes

spiffcs and others added 17 commits May 6, 2022 11:29

pass by value for ko

52a9aff

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update nil check for tlog entry; privatize defaults

f595e3a

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

remove dead code

48234e1

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

remove default docs and prescribed default since optional flag

e58f5f5

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

remove replace flag add initial comments

a1732be

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update flag description

47c8ff0

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

s/_/-/g <- for all flag options

5cc1704

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

refacor cli test

c624f6c

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

remove replace from binding

667b977

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

added ETUI entries for keyless path

5585a82

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

don't upload keyed workflow

d1a5d68

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update linter

659685d

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

add specific flag now no longer default

f68493a

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update comment with inputs and outputs

02196db

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

remove output on upload

e5bb6df

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

update attestation upload etui

a24372e

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

wagoodman approved these changes May 6, 2022

View reviewed changes

commit new changes for static analysis

5d58aa3

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

spiffcs merged commit d2d532f into main May 6, 2022

spiffcs deleted the 835-keyless-attestation-upgrade branch May 6, 2022 22:06

spiffcs mentioned this pull request May 7, 2022

Keyless Attestation Support #835

Closed

developer-guy mentioned this pull request May 11, 2022

support attaching attestation right after generate it #990

Closed

GijsCalis pushed a commit to GijsCalis/syft that referenced this pull request Feb 19, 2024

835 - Keyless Support for SBOM Attestations (anchore#910)

401a46d

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

835 - Keyless Support for SBOM Attestations #910

835 - Keyless Support for SBOM Attestations #910

spiffcs commented Mar 23, 2022 •

edited

Loading

github-actions bot commented Mar 23, 2022 •

edited

Loading

wagoodman May 6, 2022

spiffcs May 6, 2022

luhring May 6, 2022

wagoodman May 6, 2022

spiffcs May 6, 2022

spiffcs May 6, 2022

luhring May 6, 2022

spiffcs May 6, 2022

wagoodman May 6, 2022

wagoodman May 6, 2022

spiffcs May 6, 2022

wagoodman May 6, 2022

spiffcs May 6, 2022

developer-guy commented May 11, 2022

835 - Keyless Support for SBOM Attestations #910

835 - Keyless Support for SBOM Attestations #910

Conversation

spiffcs commented Mar 23, 2022 • edited Loading

Summary:

Documentation

github-actions bot commented Mar 23, 2022 • edited Loading

Benchmark Test Results

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

developer-guy commented May 11, 2022

spiffcs commented Mar 23, 2022 •

edited

Loading

github-actions bot commented Mar 23, 2022 •

edited

Loading