Enable signing using a custom sigstore instance #9
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,4 +20,3 @@ jobs: | |
| uses: softprops/action-gh-release@v1 | ||
| with: | ||
| generate_release_notes: true | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -33,90 +33,145 @@ display_success() { | |
| buildkite-agent annotate --style success "$message<br />" --context "$ctx" | ||
| } | ||
|
|
||
| # if the supplied image reference does not contain a digest, | ||
| # try getting the local image digest to use it instead, and | ||
| # if that fails, warn then continue using the supplied image reference | ||
| use_image_digest() { | ||
| if [[ $image != *"@sha256:"* ]]; then | ||
| echo "--- :docker: Getting the local image digest for ${image}" | ||
|
|
||
| local digest | ||
| digest=$(docker inspect --format='{{index .RepoDigests 0}}' "${image}") | ||
|
|
||
| local status=$? | ||
| if [[ $status -ne 0 ]]; then | ||
| display_error "docker inspect" "Failed to get the local image digest, will continue using supplied image reference ${image}" | ||
| else | ||
| display_success "docker inspect" "Will continue using ${digest}" | ||
| image="${digest}" | ||
| fi | ||
| fi | ||
| } | ||
|
|
||
| # Common parameters | ||
| ################### | ||
|
|
||
| # image is a required parameter | ||
| image=${BUILDKITE_PLUGIN_COSIGN_IMAGE} | ||
| if [[ -z "${image}" ]]; then | ||
| fail_with_message "cosign" "Image not specified" | ||
| fi | ||
| use_image_digest | ||
|
|
||
| # flags for the cosign sign command | ||
| sign_flags=("-y" "--output-signature" "out.sig") | ||
|
|
||
| is_keyless=${BUILDKITE_PLUGIN_COSIGN_KEYLESS:-true} | ||
|
|
||
| # Hook functions | ||
| ################ | ||
|
|
||
| # if provided, initialise cosign with a custom TUF configuration | ||
| cosign_init() { | ||
| echo "--- :key: Init cosign" | ||
|
|
||
| # flags for the cosign initialize command | ||
| local init_flags=() | ||
|
|
||
| if [[ "${is_keyless}" == true ]]; then | ||
| local tuf_mirror_url=${BUILDKITE_PLUGIN_COSIGN_KEYLESS_CONFIG_TUF_MIRROR_URL} | ||
| local tuf_root_url=${BUILDKITE_PLUGIN_COSIGN_KEYLESS_CONFIG_TUF_ROOT_URL} | ||
| else | ||
| local tuf_mirror_url=${BUILDKITE_PLUGIN_COSIGN_KEYED_CONFIG_TUF_MIRROR_URL} | ||
| local tuf_root_url=${BUILDKITE_PLUGIN_COSIGN_KEYED_CONFIG_TUF_ROOT_URL} | ||
| fi | ||
|
|
||
| if [[ -n "${tuf_mirror_url}" ]]; then | ||
| init_flags+=("--mirror" "${tuf_mirror_url}") | ||
| fi | ||
|
|
||
| if [[ -n "${tuf_root_url}" ]]; then | ||
| init_flags+=("--root" "${tuf_root_url}") | ||
| fi | ||
|
|
||
| if [ ${#init_flags[@]} -gt 0 ]; then | ||
| rm -rf ~/.sigstore | ||
|
There was a problem hiding this comment. Does this mean this plugin can only run serially on a given host? Is there a variable one can set to control this directory? Would be ideal if it were unique per plugin run. There was a problem hiding this comment. good point, thanks! looks like that's not directly exposed/customisable by
similarly, i made the waiting for the build (using this plugin) to complete and i'll share results back There was a problem hiding this comment. yep, looks like that worked: There was a problem hiding this comment. fwiw, I used @prezha's In other words: @prezha's change appears to prevent cosign from stepping on other cosign processes. There was a problem hiding this comment. thanks @sfox-equinix for checking and confirming! @JAORMX is there anything additional you think should be addressed? |
||
|
|
||
| cosign initialize "${init_flags[@]}" | ||
|
|
||
| local status=$? | ||
| if [[ $status -ne 0 ]]; then | ||
| fail_with_message "cosign" "Failed to initialise" | ||
| fi | ||
| display_success "cosign" "Successfully initialised" | ||
| else | ||
| display_success "cosign" "Initialisation not required, skipping" | ||
| fi | ||
| } | ||
|
|
||
| setup_keyless() { | ||
| echo "--- :key: Setup cosign keyless signing" | ||
|
|
||
| local rekor_url=${BUILDKITE_PLUGIN_COSIGN_KEYLESS_CONFIG_REKOR_URL} | ||
|
There was a problem hiding this comment. thanks @tenyo ! the default values for the public-good sigstore instance are baked into the cosign binary (that we download and use while plugin is run), and i think we should relay on those in cosign, rather than having our own hardcoded values, that might change at some point - eg, this comment:
so, for rekor, it's defined here then used as the flag's default value here for eg, tuf, it's here, etc. |
||
| if [[ -n "${rekor_url}" ]]; then | ||
| sign_flags+=("--rekor-url" "${rekor_url}") | ||
| fi | ||
|
|
||
| local fulcio_url=${BUILDKITE_PLUGIN_COSIGN_KEYLESS_CONFIG_FULCIO_URL} | ||
|
There was a problem hiding this comment. Same for this - maybe these are set automatically by There was a problem hiding this comment. same as above - for fulcio, it's defined here |
||
| if [[ -n "${fulcio_url}" ]]; then | ||
| sign_flags+=("--fulcio-url" "${fulcio_url}") | ||
| fi | ||
|
|
||
| local oidc_issuer=${BUILDKITE_PLUGIN_COSIGN_KEYLESS_CONFIG_OIDC_ISSUER} | ||
| if [[ -n "${oidc_issuer}" ]]; then | ||
| sign_flags+=("--oidc-issuer" "${oidc_issuer}") | ||
| fi | ||
|
|
||
| local oidc_provider=${BUILDKITE_PLUGIN_COSIGN_KEYLESS_CONFIG_OIDC_PROVIDER:-"buildkite-agent"} | ||
| if [[ -n "${oidc_provider}" ]]; then | ||
| sign_flags+=("--oidc-provider" "${oidc_provider}") | ||
| fi | ||
| } | ||
|
|
||
| setup_keyed() { | ||
| echo "--- :key: Setup cosign keyed signing" | ||
|
|
||
| local rekor_url=${BUILDKITE_PLUGIN_COSIGN_KEYED_CONFIG_REKOR_URL} | ||
| if [[ -n "${rekor_url}" ]]; then | ||
| sign_flags+=("--rekor-url" "${rekor_url}") | ||
| fi | ||
|
|
||
| local key=${BUILDKITE_PLUGIN_COSIGN_KEYED_CONFIG_KEY:-} | ||
| if [[ -z "${key}" ]]; then | ||
| fail_with_message "cosign" "Key not specified" | ||
| fi | ||
|
|
||
| if [[ ! -f "${key}" ]]; then | ||
| fail_with_message "cosign" "Key file not found in path ${key}" | ||
| fi | ||
|
|
||
| sign_flags+=("--key" "${key}") | ||
| } | ||
|
|
||
| # sign the image | ||
| cosign_sign() { | ||
| echo "--- :key: Signing image with cosign" | ||
|
|
||
| rm -f out.sig | ||
|
|
||
| cosign sign \ | ||
| "${sign_flags[@]}" \ | ||
| "${image}" | ||
|
|
||
| local status=$? | ||
| if [[ $status -ne 0 ]]; then | ||
| fail_with_message "cosign" "Failed to sign image" | ||
| fi | ||
|
|
||
| local signature | ||
| signature=$(cat out.sig) | ||
|
|
||
| display_success "cosign" "Successfully signed image" | ||
| cat <<EOF | buildkite-agent annotate --style success --context "cosign-signature" | ||
| ### Signed image | ||
| \`\`\` | ||
|
|
@@ -129,11 +184,18 @@ $signature | |
| \`\`\` | ||
| EOF | ||
|
|
||
| rm -f out.sig | ||
| } | ||
|
|
||
| # Main | ||
| ####### | ||
|
|
||
| cosign_init | ||
|
|
||
| if [[ "${is_keyless}" == true ]]; then | ||
| setup_keyless | ||
| else | ||
| setup_keyed | ||
| fi | ||
|
|
||
| cosign_sign | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am wondering if we need to delete the whole directory. It would be unfortunate if there are other important things in there. The documentation for
cosign initializeseems to claim that it updates the tuf thing:It looks like it gets overwritten:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
it is not expected to find
~/.sigstore/there - this is more to ensure that there isn't onedocs suggest removing the whole dir and so that's probably a good idea:
https://docs.sigstore.dev/system_config/public_deployment/#usage and https://docs.sigstore.dev/system_config/public_deployment/#revert-back-to-production