Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[docs] update getting-started to work with cosign 2.1 #803

Merged
merged 2 commits into from
Nov 13, 2023
Merged

[docs] update getting-started to work with cosign 2.1 #803

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d543e00
update getting-started to work with cosign 2.1
NissesSenap Oct 26, 2023
00e464c
Update getting-started.md
NissesSenap Nov 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 35 additions & 24 deletions getting-started.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,17 @@ There's a reusable [action](./actions/setup/README.md) that you can use as is.
# Prerequisites

You need to install `yq`. You can do this like so:
```

```shell
go install github.com/mikefarah/yq/v4@latest
```

You also need [ko](https://ko.build/) a tool for building lighter, more secure container images.
```

```shell
go install github.com/google/ko@latest
```

There are further install options on the [ko website](https://ko.build/).

# Running locally on KinD
Expand All @@ -35,6 +39,7 @@ cloning the repo):
```

Or by downloading a release version of the script

```shell
curl -fLo /tmp/setup-kind.sh https://github.com/sigstore/scaffolding/releases/download/v0.6.4/setup-kind.sh
chmod u+x /tmp/setup-kind.sh
Expand All @@ -61,15 +66,17 @@ b1e3f3238f7a registry:2 "/entrypoint.sh /etc…" 15 m
```

So that's the running version of the registry, so first kill and then remove it:

```shell
docker rm -f b1e3f3238f7a
```

# Install sigstore-scaffolding pieces

## From the release

```shell
curl -Lo /tmp/setup-scaffolding-from-release.sh https://github.com/sigstore/scaffolding/releases/download/v0.6.4/setup-scaffolding-from-release.sh
curl -Lo /tmp/setup-scaffolding-from-release.sh https://github.com/sigstore/scaffolding/releases/download/v0.6.9/setup-scaffolding-from-release.sh
chmod u+x /tmp/setup-scaffolding-from-release.sh
/tmp/setup-scaffolding-from-release.sh
```
Expand Down Expand Up @@ -171,7 +178,7 @@ kubectl -n kourier-system port-forward service/kourier-internal 8080:80 &

Add the following entries to your `/etc/hosts` file

```
```txt
127.0.0.1 rekor.rekor-system.svc
127.0.0.1 fulcio.fulcio-system.svc
127.0.0.1 ctlog.ctlog-system.svc
Expand All @@ -183,7 +190,7 @@ Add the following entries to your `/etc/hosts` file
Instead of having to specify these in various flags when calling cosign and long
URLs, let's create some up front:

```
```shell
export REKOR_URL=http://rekor.rekor-system.svc:8080
export FULCIO_URL=http://fulcio.fulcio-system.svc:8080
export FULCIO_GRPC_URL=http://fulcio-grpc.fulcio-system.svc:8080
Expand All @@ -206,17 +213,20 @@ Let's first run a quick smoke test that does a cosign sign followed by making
sure that the rekor entry is created for it.

1) Get TUF root from the tuf-system namespace

```shell
kubectl -n tuf-system get secrets tuf-root -ojsonpath='{.data.root}' | base64 -d > ./root.json
```

2) Initialize cosign with our root.

```shell
cosign initialize --mirror $TUF_MIRROR --root ./root.json
```

An example invocation of this on my machine looked like this:
```

```shell
vaikas@villes-mbp scaffolding % cosign initialize --mirror $TUF_MIRROR --root ./root.json
Root status:
{
Expand Down Expand Up @@ -259,7 +269,7 @@ Root status:
If you have an image that you want to play with, great, you can also create
one easily like this (that gets then uploaded to our local registry):

```
```shell
KO_DOCKER_REPO=registry.local:5001/sigstore
pushd $(mktemp -d)
go mod init example.com/demo
Expand All @@ -278,13 +288,14 @@ popd

Then let's sign it (or change $demoimage to something else).

```
COSIGN_EXPERIMENTAL=1 cosign sign --rekor-url $REKOR_URL --fulcio-url $FULCIO_URL --force --allow-insecure-registry $demoimage --identity-token `curl -s $ISSUER_URL`
```shell
cosign sign --rekor-url $REKOR_URL --fulcio-url $FULCIO_URL --yes --allow-insecure-registry $demoimage --identity-token $(curl -s $ISSUER_URL)
```

An example invocation from my local instance is like so:
```
vaikas@villes-mbp scaffolding % COSIGN_EXPERIMENTAL=1 cosign sign --rekor-url $REKOR_URL --fulcio-url $FULCIO_URL --force --allow-insecure-registry $demoimage --identity-token `curl -s $ISSUER_URL`

```shell
vaikas@villes-mbp scaffolding % cosign sign --rekor-url $REKOR_URL --fulcio-url $FULCIO_URL --yes --allow-insecure-registry $demoimage --identity-token $(curl -s $ISSUER_URL)
Generating ephemeral keys...
Retrieving signed certificate...

Expand All @@ -298,14 +309,14 @@ Pushing signature to: registry.local:5001/sigstore/demo

Then let's verify the signature.

```
COSIGN_EXPERIMENTAL=1 cosign verify --rekor-url $REKOR_URL --allow-insecure-registry $demoimage
```shell
cosign verify --rekor-url $REKOR_URL --allow-insecure-registry $demoimage --certificate-identity=https://kubernetes.io/namespaces/default/serviceaccounts/default --certificate-oidc-issuer=https://kubernetes.default.svc.cluster.local
```

An example invocation from my local instance is like so:

```
vaikas@villes-mbp scaffolding % COSIGN_EXPERIMENTAL=1 cosign verify --rekor-url $REKOR_URL --allow-insecure-registry $demoimage
```shell
vaikas@villes-mbp scaffolding % cosign verify --rekor-url $REKOR_URL --allow-insecure-registry $demoimage --certificate-identity=https://kubernetes.io/namespaces/default/serviceaccounts/default --certificate-oidc-issuer=https://kubernetes.default.svc.cluster.local
**Warning** Missing fallback target fulcio.crt.pem, skipping

Verification for registry.local:5001/sigstore/demo@sha256:b6cfc6e87706304be13f607b238d905db1096619c0217c82f4151117e0112025 --
Expand All @@ -321,16 +332,16 @@ And the `**Warning**` is just letting us know that there's no custom metadata
on TUF, and we fallback on the hard-coded names, and that's one of the ones we
expect for Fulcio (and the other is the one we use: fulcio_v1.crt.pem)

```
```shell
echo -n 'foobar test attestation' > ./predicate-file
COSIGN_EXPERIMENTAL=1 cosign attest --predicate ./predicate-file --fulcio-url $FULCIO_URL --rekor-url $REKOR_URL --allow-insecure-registry --force $demoimage --identity-token `curl -s $ISSUER_URL`
cosign attest --predicate ./predicate-file --fulcio-url $FULCIO_URL --rekor-url $REKOR_URL --allow-insecure-registry --yes $demoimage --identity-token $(curl -s $ISSUER_URL)
```

An example invocation from my local instance:

```
```shell
vaikas@villes-mbp scaffolding % echo -n 'foobar test attestation' > ./predicate-file
COSIGN_EXPERIMENTAL=1 cosign attest --predicate ./predicate-file --fulcio-url $FULCIO_URL --rekor-url $REKOR_URL --allow-insecure-registry --force $demoimage --identity-token `curl -s $ISSUER_URL`
cosign attest --predicate ./predicate-file --fulcio-url $FULCIO_URL --rekor-url $REKOR_URL --allow-insecure-registry --yes $demoimage --identity-token $(curl -s $ISSUER_URL)

Generating ephemeral keys...
Retrieving signed certificate...
Expand All @@ -345,14 +356,14 @@ tlog entry created with index: 1

And then finally let's verify the attestation we just created:

```
COSIGN_EXPERIMENTAL=1 cosign verify-attestation --rekor-url $REKOR_URL --allow-insecure-registry $demoimage
```shell
cosign verify-attestation --rekor-url $REKOR_URL --allow-insecure-registry $demoimage --certificate-identity=https://kubernetes.io/namespaces/default/serviceaccounts/default --certificate-oidc-issuer=https://kubernetes.default.svc.cluster.local
```

An example invocation from my local instance:

```
vaikas@villes-mbp scaffolding % COSIGN_EXPERIMENTAL=1 cosign verify-attestation --rekor-url $REKOR_URL --allow-insecure-registry $demoimage
```shell
vaikas@villes-mbp scaffolding % cosign verify-attestation --rekor-url $REKOR_URL --allow-insecure-registry $demoimage --certificate-identity=https://kubernetes.io/namespaces/default/serviceaccounts/default --certificate-oidc-issuer=https://kubernetes.default.svc.cluster.local
**Warning** Missing fallback target fulcio.crt.pem, skipping

Verification for registry.local:5001/sigstore/demo@sha256:b6cfc6e87706304be13f607b238d905db1096619c0217c82f4151117e0112025 --
Expand All @@ -367,7 +378,7 @@ Certificate issuer URL: https://kubernetes.default.svc

And you can inspect the `payload` of the attestation by base64 decoding the payload, so for me:

```
```shell
vaikas@villes-mbp scaffolding % echo 'eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInByZWRpY2F0ZVR5cGUiOiJjb3NpZ24uc2lnc3RvcmUuZGV2L2F0dGVzdGF0aW9uL3YxIiwic3ViamVjdCI6W3sibmFtZSI6InJlZ2lzdHJ5LmxvY2FsOjUwMDAvc2lnc3RvcmUvZGVtbyIsImRpZ2VzdCI6eyJzaGEyNTYiOiJiNmNmYzZlODc3MDYzMDRiZTEzZjYwN2IyMzhkOTA1ZGIxMDk2NjE5YzAyMTdjODJmNDE1MTExN2UwMTEyMDI1In19XSwicHJlZGljYXRlIjp7IkRhdGEiOiJmb29iYXIgdGVzdCBhdHRlc3RhdGlvbiIsIlRpbWVzdGFtcCI6IjIwMjItMDgtMDdUMDM6NTU6NDhaIn19' | base64 -d
{"_type":"https://in-toto.io/Statement/v0.1","predicateType":"cosign.sigstore.dev/attestation/v1","subject":[{"name":"registry.local:5001/sigstore/demo","digest":{"sha256":"b6cfc6e87706304be13f607b238d905db1096619c0217c82f4151117e0112025"}}],"predicate":{"Data":"foobar test attestation","Timestamp":"2022-08-07T03:55:48Z"}}%
```
Expand Down
Loading