Add spoc push/pull command

[saschagrunert]

What type of PR is this?

/kind feature

What this PR does / why we need it:

This command provides functionality to pull security profiles from OCI
registries, for example:

> ./build/spoc pull docker.io/saschagrunert/oras:latest
11:18:21.780411 Pulling profile from: docker.io/saschagrunert/oras:latest
11:18:21.780453 Verifying signature

Verification for index.docker.io/saschagrunert/oras:latest --
The following checks were performed on each of these signatures:
	- Existence of the claims in the transparency log was verified offline
	- The code-signing certificate was verified using trusted certificate authority certificates

[{"critical":{"identity":{"docker-reference":"index.docker.io/saschagrunert/oras"},"image":{"docker-manifest-digest":"sha256:8e88555d67c0871573a1fd161d1a9d9bea691959290232e90a83891d69e810c5"},"type":"cosign container image signature"},"optional":{"1.3.6.1.4.1.57264.1.1":"https://github.com/login/oauth","Bundle":{"SignedEntryTimestamp":"MEQCIHN8nkYyRN2YZSz7w9R4pswaPlDpaZRCAjcp5aCTVggCAiAXKuizJkZ+0MTubRqSzMwMzp7A+kDiFSeKmsxcv1QP1w==","Payload":{"body":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJlYTg1ODNjZjU2MzE1NDRiNDg5ZGRiZjNhMDY3ZGQwMDA4ZWMxNWM3NzRlMmJiYmM3NWUzOTYzOTg1YTJhMDBjIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUR0d282RnExbGN3bTd5ejc5SFhBNjJNRkpPc2JpazRwallVZkJFU2ErZi9RSWdQNDJxZXNNQ2R0bEFKNUtIQ3l0YzhWSWZWSFEvRERMcWhkRE1jY2FRN3dRPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTnZha05EUVdscFowRjNTVUpCWjBsVlQyRkVRVVUyTTBoQ1ltVktRVVJDZWtSbFJuSnBTVzlIZEZSbmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcE5kMDE2U1hkTlZFRjRUbnBSTkZkb1kwNU5hazEzVFhwSmQwMVVRWGxPZWxFMFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVV3YldkamVITnVTelkyU0V0WEt6QXlNU3Q1YVRFM0syOXJXVVJ6VjNsb1NsTTRWMk1LYmxGd1dVUlNlV1pqYVN0SFkzcHpiV2R6U0U5emVrSnBZazFRY0c5WmNGaFhhMVZFYzJVd01GQlVhRWxhY0ROYVMyRlBRMEZWWTNkblowWkVUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlV6T1VRMkNrOUNVM3BwVUdoMWFUbHdUazQwUmsxbVlqTmtaVk5CZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBsUldVUldVakJTUVZGSUwwSkNZM2RHV1VWVVl6SmtlV1JYTld4amJsSkJZMjFXYTJGSFJqQk1iVTUyWWxSQmMwSm5iM0pDWjBWRlFWbFBMd3BOUVVWQ1FrSTFiMlJJVW5kamVtOTJUREprY0dSSGFERlphVFZxWWpJd2RtSkhPVzVoVnpSMllqSkdNV1JIWjNkbldXOUhRMmx6UjBGUlVVSXhibXREQ2tKQlNVVm1RVkkyUVVoblFXUm5SR1JRVkVKeGVITmpVazF0VFZwSWFIbGFXbnBqUTI5cmNHVjFUalE0Y21ZclNHbHVTMEZNZVc1MWFtZEJRVUZaWWlzS2FHMDVaa0ZCUVVWQmQwSklUVVZWUTBsUlJEa3dWbEZYYzNGTlduUnNjVVJvY0VwUlRraFJWbXgzVFVoTGNXeEtSRTVVYW1sUVdFUnZibEU1YUZGSlp3cEVOQzlSVW5KaFlTODRiV1poUVZsMFkxZHFSRXBEYTBGVVprOXRlRWRsTlcxbU1tcE1jR1JHZW5semQwTm5XVWxMYjFwSmVtb3dSVUYzVFVSaFFVRjNDbHBSU1hoQlVFOTNSbWMzVVdWNFJVTlZXRFE1V0N0RGNsSnBibTU2U0d0WWNtSXdXa0o2UlhaamN6RmtiSFpaZGpSR2JHMURkbmRtVUd4M2NXdzBiRUlLVURCQk0zbEJTWGRRYW5aUFYwa3djak5pTkd4clFqWjFOalZ2U1dGU01XbDBVa2R0VTJkR1RuaDRjM0ZOZHpjeGNsVmtlRUY2TTNKWlZtZFdhakJ2T0FwV1R6QmFhMDEyWWdvdExTMHRMVVZPUkNCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2c9PSJ9fX19","integratedTime":1679307470,"logIndex":15859996,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d"}},"Issuer":"https://github.com/login/oauth","Subject":"sgrunert@redhat.com"}}]
11:18:24.793283 Creating file store in: /tmp/pull-1676121632
11:18:24.793286 Verifying reference: docker.io/saschagrunert/oras:latest
11:18:24.793308 Creating repository for index.docker.io/saschagrunert/oras
11:18:24.793335 Using tag: latest
11:18:24.793336 Copying profile from repository
11:18:26.119253 Reading profile
11:18:26.119324 Trying to unmarshal seccomp profile
11:18:26.119995 Got SeccompProfile: echo
11:18:26.119998 Saving profile in: /tmp/profile.yaml

Which successfully pulls the image into the local directory:

> cat /run/user/1000/profile.yaml | head
---
apiVersion: security-profiles-operator.x-k8s.io/v1beta1
kind: SeccompProfile
metadata:
	name: echo
spec:
	defaultAction: SCMP_ACT_ERRNO
	architectures:
	- SCMP_ARCH_X86_64
	syscalls:

Images can be pushed in the same way using spoc push, which also signs them
via sigstore:

> export USERNAME=saschagrunert
> export PASSWORD=my-pw
> ./build/spoc push docker.io/saschagrunert/oras:latest
11:17:40.037409 Pushing profile /run/user/1000/profile.yaml to: docker.io/saschagrunert/oras:latest
11:17:40.037430 Creating file store in: /run/user/1000/push-4212591343
11:17:40.037435 Adding profile to store: /run/user/1000/profile.yaml
11:17:40.037463 Packing files
11:17:40.037586 Verifying reference: docker.io/saschagrunert/oras:latest
11:17:40.037594 Using tag: latest
11:17:40.037598 Creating repository for index.docker.io/saschagrunert/oras
11:17:40.037602 Using username and password
11:17:40.037605 Copying profile to repository
11:17:41.708424 Signing container image
Generating ephemeral keys...
Retrieving signed certificate...

		Note that there may be personally identifiable information associated with this signed artifact.
		This may include the email address associated with the account with which you authenticate.
		This information will be used for signing this artifact and will be stored in public transparency logs and cannot be removed later.

By typing 'y', you attest that you grant (or have permission to grant) and agree to have this information stored permanently in transparency logs.
Your browser will now be opened to:
https://oauth2.sigstore.dev/auth/auth?access_type=online&client_id=sigstore&code_challenge=58LCHWGyhOt5tGJJeJ-B7CuToZEEYDgGflLYDOYxv7g&code_challenge_method=S256&nonce=2NH423dlp97y9YtbIaV2mV49xjY&redirect_uri=http%3A%2F%2Flocalhost%3A40989%2Fauth%2Fcallback&response_type=code&scope=openid+email&state=2NH41yRpWYjoFNumCx7hAbiqeHt
Successfully verified SCT...
tlog entry created with index: 15859996
Pushing signature to: index.docker.io/saschagrunert/oras

Which issue(s) this PR fixes:

Part of #1482

Does this PR have test?

Yes

Special notes for your reviewer:

None

Does this PR introduce a user-facing change?

Added `spoc push/pull` command to manage profiles in OCI registries.

[codecov-commenter]

Codecov Report

Merging #1551 (74d4ffe) into main (9d3d1da) will increase coverage by 2.63%.
The diff coverage is 88.88%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1551      +/-   ##
==========================================
+ Coverage   46.23%   48.86%   +2.63%     
==========================================
  Files          61       68       +7     
  Lines        6275     6620     +345     
==========================================
+ Hits         2901     3235     +334     
- Misses       3251     3262      +11     
  Partials      123      123              

[saschagrunert]

/hold

I’m considering to use ORAS, which also supports pushing.

[saschagrunert]

Finished the implementation with ORAS for spoc.

[saschagrunert]

@kubernetes-sigs/security-profiles-operator-maintainers PTAL

I'm going to follow-up on docs and integration in the SPOD

[saschagrunert]

/unhold

[saschagrunert]

/test pull-security-profiles-operator-build

[ccojocar]

Great work @saschagrunert ! Just left a few questions.

[ccojocar]

Can all these 3 types of profiles be stored in the same image simultaneously?

I am just wondering if we can use a generic type for profile here.

[saschagrunert]

Right now not, cause it works in the way that it expects a single profile.yaml in an artifact / image. I'm not sure if we really want to have multiple there to keep things simple.

[ccojocar]

Alright, this means one image for each profile.

Let's say if one wanted to have defence in depth for a binary, it will need to release at least 2 different images (e.g. one with seccomp and one with selinux) for the same binary which I think is fine but it would probably be nice to have the option to store in an image multiple profiles belonging to a binary. This could simplify a bit the lifecycle of security profiles. This would be nice to have in future, definitely not in this pull request.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ccojocar, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ccojocar,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment