Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement signed images verification #67

Closed
konstantina-gramatova opened this issue Sep 29, 2022 · 2 comments · Fixed by #215
Closed

Implement signed images verification #67

konstantina-gramatova opened this issue Sep 29, 2022 · 2 comments · Fixed by #215
Assignees
@dimitar-dimitrow
Labels
security Security improvement task Single unit of work
Milestone
M5

Comments

@konstantina-gramatova
Copy link
Contributor

All used container images must undergo a signature verification (if signed) based on the provided verification data. If the verification fails, running a container instance using such an image must be aborted with the appropriate error.

The verification has to be implemented integrating sigstore's Cosign.
If a global daemon's configuration is applicable, it has to be covered as well.
@konstantina-gramatova konstantina-gramatova added the task Single unit of work label Sep 29, 2022
@konstantina-gramatova konstantina-gramatova added this to the M3 milestone Sep 29, 2022
Closed
@e-grigorov e-grigorov added the security Security improvement label Oct 6, 2022
@dimitar-dimitrow dimitar-dimitrow self-assigned this Oct 11, 2022
@dimitar-dimitrow
Copy link
Contributor

dimitar-dimitrow commented Nov 17, 2022 •
edited
Loading

Signatures would be pulled only on creation and would be deleted with their corresponding container images. Keys for verification could be provided globally - through container-management configuration, per container - through container configuration. Per container keys are prioritized.

Image Signed Global Keys Per Container Keys No Keys
No Skip verification Skip verification Skip verification
Yes Perform Verification Perform Verification Skip verification

Skip verification - no verification is performed, container is created/started
Perform Verification - if verification fails, container is not created/started; if verification is successful, container is created/started.

@e-grigorov e-grigorov mentioned this issue Nov 17, 2022
Closed
@e-grigorov e-grigorov linked a pull request Nov 17, 2022 that will close this issue
Implement signed images verification #94
Closed
@dimitar-dimitrow dimitar-dimitrow mentioned this issue Feb 16, 2023
Closed
@k-gostev k-gostev removed this from the M3 milestone May 30, 2023
@dimitar-dimitrow dimitar-dimitrow added this to the M5 milestone Oct 30, 2023
@dimitar-dimitrow
Copy link
Contributor

The focus has changed to implement signed image verification with notation-go instead of sigstore/cosign, for more information check this comment.

@dimitar-dimitrow dimitar-dimitrow removed a link to a pull request Nov 22, 2023
Implement signed images verification #94
Closed
@dimitar-dimitrow dimitar-dimitrow linked a pull request Nov 22, 2023 that will close this issue
Implement signed images verification #215
Merged
dimitar-dimitrow added a commit to bosch-io/container-management that referenced this issue Nov 30, 2023
@dimitar-dimitrow
[eclipse-kanto#67] Implement signed images verification
66c331b 
Signed-off-by: Dimitar Dimitrov <dimitar.dimitrov3@bosch.com>
dimitar-dimitrow added a commit to bosch-io/container-management that referenced this issue Nov 30, 2023
@dimitar-dimitrow
[eclipse-kanto#67] Add env needed for notation init to libnet hook
ede3361 
Signed-off-by: Dimitar Dimitrov <dimitar.dimitrov3@bosch.com>
dimitar-dimitrow added a commit to bosch-io/container-management that referenced this issue Nov 30, 2023
@dimitar-dimitrow
[eclipse-kanto#67] Add env needed for notation init to the service file
07d4d28 
Signed-off-by: Dimitar Dimitrov <dimitar.dimitrov3@bosch.com>
@dimitar-dimitrow dimitar-dimitrow mentioned this issue Nov 30, 2023
Merged
dimitar-dimitrow added a commit to bosch-io/container-management that referenced this issue Dec 12, 2023
@dimitar-dimitrow
[eclipse-kanto#67] Addressing review comments
8305772 
Signed-off-by: Dimitar Dimitrov <dimitar.dimitrov3@bosch.com>
k-gostev pushed a commit that referenced this issue Dec 12, 2023
@dimitar-dimitrow
Implement signed images verification (#215)
e361ff5 
* [#67] Implement signed images verification
---------

Signed-off-by: Dimitar Dimitrov <dimitar.dimitrov3@bosch.com>
k-gostev pushed a commit that referenced this issue Apr 30, 2024
@dimitar-dimitrow @k-gostev
Implement signed images verification (#215)
8bd41e0 
* [#67] Implement signed images verification
---------

Signed-off-by: Dimitar Dimitrov <dimitar.dimitrov3@bosch.com>
dimitar-dimitrow added a commit that referenced this issue May 10, 2024
@k-gostev @daniel-milchev
@stoyan-zoubev @dimitar-dimitrow
Merge dev-m5 into main (#235)
a951f1c 
[#234] Merge `dev-m5` branch into `main`
* [#51] Improve containerd client unit tests (#203)
* [#201] Optimized, deterministic intermediate desired state feedback messages (#204)
* [#208] Add file flag to the CLI create command (#209)
* [#191] Container remains Stopped after container-management service restart (#214)
* [#210] Remove command should accept more than one container ID (#212)
* [#196] Starting of constantly restarting container fails (#216)
* [#67] Implement signed images verification (#215)
* [#91] Provide unit tests covering signed images verification (#220)
* [#213] Add quiet flag, to the list command. (#221)
* [#217] CLI Remove command improvements (#224)

---------

Signed-off-by: Daniel Milchev fixed-term.daniel.milchev@bosch.io
Signed-off-by: Stoyan Zoubev <Stoyan.Zoubev@bosch.com>
Signed-off-by: Kristiyan Gostev <kristiyan.gostev@bosch.com>
Signed-off-by: Dimitar Dimitrov <dimitar.dimitrov3@bosch.com>
Co-authored-by: Daniel Milchev <fixed-term.daniel.milchev@bosch.io>
Co-authored-by: Stoyan Zoubev <Stoyan.Zoubev@bosch.io>
Co-authored-by: Dimitar Dimitrov <dimitar.dimitrov3@bosch.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@dimitar-dimitrow dimitar-dimitrow

Labels
security Security improvement task Single unit of work
Projects
Eclipse Kanto
Status: Done
Milestone
M5
Development

Successfully merging a pull request may close this issue.

Implement signed images verification bosch-io/container-management
4 participants
@e-grigorov @konstantina-gramatova @dimitar-dimitrow @k-gostev