proxy: Policy verification of OCI Image before pulling #2029

RishabhSaini · 2023-06-29T22:20:29Z

Helps address the lack of policy verification in rpm-ostree:
coreos/rpm-ostree#4272

An Image pull triggered by rpm-ostree rebase will look to verify the policy by default as a part of OpenImage

The other route taken here adds a new API call
#1829

RishabhSaini · 2023-06-29T22:26:13Z

The above change causes the following output if a container image signed by sigstore is given the wrong key:

[root@cosa-devsh ~]# rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ahgencer/silverblue:pr-3
Pulling manifest: ostree-image-signed:docker://ghcr.io/ahgencer/silverblue:pr-3
error: Creating importer: Failed to invoke skopeo proxy method OpenImage: remote error: cryptographic signature verification failed: invalid signature when validating ASN.1 encoded signature

cgwalters

Yeah, OK I think this makes sense to just do by default.

Are there cases where we want the equivalent of skopeo inspect --insecure-policy? Hmm...perhaps not.

cgwalters · 2023-06-30T08:28:14Z

As a procedural note I've created experimental-image-proxy label to track PRs to this subsystem.

RishabhSaini · 2023-06-30T13:03:56Z

Rebasing to sync the branch

RishabhSaini · 2023-06-30T14:16:03Z

Unsure why the CI is failing "timed out". The tests for ostree-rs-ext passed on the previous run and work locally on my end. Would the owners kindly re-rerun the ostree-rs-ext test as I suspect it was a flake

cgwalters · 2023-06-30T14:57:26Z

There's a "Re-run" button next to the check...I clicked it, but so far not seeing a change?
Anyways you should be able to force it with git commit --amend --allow-empty or so and re-pushing

mtrmac · 2023-06-30T16:55:59Z

FWIW we do see the ostree-rs-ext timing out fairly frequently. Either it takes just a few minutes, or it times out after 30.

cmd/skopeo/proxy.go

cgwalters · 2023-07-04T09:29:50Z

FWIW we do see the ostree-rs-ext timing out fairly frequently. Either it takes just a few minutes, or it times out after 30.

Ah, dang. OK, I'm reopening ostreedev/ostree-rs-ext#322 (comment)

Signed-off-by: RishabhSaini <rsaini@redhat.com>

RishabhSaini · 2023-07-04T16:59:32Z

Updated

cgwalters · 2023-07-04T20:10:40Z

cmd/skopeo/proxy.go

@@ -266,6 +268,23 @@ func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (replyBuf,
 		return ret, err
 	}

+	unparsedTopLevel := image.UnparsedInstance(imgsrc, nil)
+	policy, err := signature.DefaultPolicy(h.sysctx)


While I think this is OK for now, maybe it makes sense to cache this in the future?

Ideally, cache the PolicyContext (as long as it is used from a single thread).

(Right now that does not make a difference, but a branch caching the imported keys in a native format inside a PolicyContext is floating around.)

cgwalters · 2023-07-06T15:43:57Z

I was thinking more about this and one problem, and this is basically what motivated #1829 is that basically well I kind of originally painted us into a corner in having e.g. ostree-unverified-image...which kind of promises to ignore the container signature policy. This PR changes it to enforce the policy.

But then...in practice the policy does default to being unset except for a few special base images in e.g. RHEL. So...we may mostly be OK here.

I also think issue 1829 is still highly relevant in that we do want to drop the ultra-hacky code in https://github.com/ostreedev/ostree-rs-ext/blob/main/lib/src/container/skopeo.rs#L10

Anyways...I think we're probably OK. I want to do some more testing of this PR myself. To be clear did you do the whole thing with setting up e.g. cosign and requiring it in the container policy?

RishabhSaini · 2023-07-06T18:04:25Z

Did you do the whole thing with setting up e.g. cosign and requiring it in the container policy?

Yes, I have tested this system by singing and uploading a signed container image to my registry using cosign and skopeo. Then rebasing from the remote registry behaves appropriately.

cgwalters · 2023-07-10T15:15:14Z

cmd/skopeo/proxy.go

+	if err != nil {
+		return ret, err
+	}
+	allowed, err := policyContext.IsRunningImageAllowed(context.Background(), unparsedTopLevel)


Here'd what we want is a new API like IsRunningImageSigned and it would fail if the signature policy is insecureAcceptAnything for ostreedev/ostree-rs-ext#79

mtrmac

A late review I’m afraid.

mtrmac · 2023-07-11T20:23:33Z

cmd/skopeo/proxy.go

@@ -266,6 +268,23 @@ func (h *proxyHandler) openImageImpl(args []any, allowNotFound bool) (replyBuf,
 		return ret, err
 	}

+	unparsedTopLevel := image.UnparsedInstance(imgsrc, nil)
+	policy, err := signature.DefaultPolicy(h.sysctx)


Was there a specific reason not to use opts.global.getPolicyContext here?

That would also immediately handle --insecure-policy per #2029 (review) .

mtrmac · 2023-07-11T20:24:00Z

cmd/skopeo/proxy.go

+	policyContext, err := signature.NewPolicyContext(policy)
+	if err != nil {
+		return ret, err
+	}


policyContext.Destroy is required by the API when done.

mtrmac · 2023-07-11T20:24:57Z

cmd/skopeo/proxy.go

+	if !allowed || err != nil {
+		return ret, err
+	}
+	if !allowed && err == nil {


This is dead code AFAICS. The code has already returned ret, nil above.

mtrmac · 2023-07-18T18:30:45Z

A late review I’m afraid.

Should be resolved by #2048.

Follow-up fixes to #2029

RishabhSaini force-pushed the sig branch 2 times, most recently from 92beea2 to 1cf4feb Compare June 29, 2023 23:23

cgwalters approved these changes Jun 30, 2023

View reviewed changes

cgwalters added the experimental-image-proxy Issues related to experimental-image-proxy label Jun 30, 2023

cgwalters mentioned this pull request Jun 30, 2023

proxy: Change the imgid to uint64 #1777

Merged

RishabhSaini force-pushed the sig branch from 1cf4feb to 6627744 Compare June 30, 2023 12:55

mtrmac reviewed Jun 30, 2023

View reviewed changes

cmd/skopeo/proxy.go Show resolved Hide resolved

mtrmac added the kind/feature A request for, or a PR adding, new functionality label Jun 30, 2023

RishabhSaini force-pushed the sig branch from 6627744 to 01c6eb6 Compare July 4, 2023 14:38

proxy: Policy verification of OCI Image before pulling

4de3a90

Signed-off-by: RishabhSaini <rsaini@redhat.com>

RishabhSaini force-pushed the sig branch from 01c6eb6 to 4de3a90 Compare July 4, 2023 14:43

RishabhSaini requested a review from mtrmac July 4, 2023 15:41

cgwalters approved these changes Jul 4, 2023

View reviewed changes

cgwalters reviewed Jul 4, 2023

View reviewed changes

cgwalters merged commit 71a15da into containers:main Jul 4, 2023

RishabhSaini mentioned this pull request Jul 6, 2023

Image signature not getting verified for container-native builds signed with Cosign coreos/rpm-ostree#4272

Open

cgwalters reviewed Jul 10, 2023

View reviewed changes

mtrmac reviewed Jul 11, 2023

View reviewed changes

This was referenced Jul 11, 2023

Check for unsigned images containers/image#2035

Open

test that we support image signatures ostreedev/ostree-rs-ext#163

Closed

cgwalters added a commit that referenced this pull request Jul 19, 2023

Merge pull request #2048 from mtrmac/proxy-policy

f2be411

Follow-up fixes to #2029

github-actions bot added the locked - please file new issue/PR label Oct 17, 2023

github-actions bot locked as resolved and limited conversation to collaborators Oct 17, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

proxy: Policy verification of OCI Image before pulling #2029

proxy: Policy verification of OCI Image before pulling #2029

RishabhSaini commented Jun 29, 2023

RishabhSaini commented Jun 29, 2023

cgwalters left a comment

cgwalters commented Jun 30, 2023

RishabhSaini commented Jun 30, 2023

RishabhSaini commented Jun 30, 2023 •

edited

Loading

cgwalters commented Jun 30, 2023

mtrmac commented Jun 30, 2023

cgwalters commented Jul 4, 2023

RishabhSaini commented Jul 4, 2023

cgwalters Jul 4, 2023

mtrmac Jul 11, 2023

cgwalters commented Jul 6, 2023

RishabhSaini commented Jul 6, 2023

cgwalters Jul 10, 2023

mtrmac left a comment

mtrmac Jul 11, 2023

mtrmac Jul 11, 2023

mtrmac Jul 11, 2023

mtrmac commented Jul 18, 2023

proxy: Policy verification of OCI Image before pulling #2029

proxy: Policy verification of OCI Image before pulling #2029

Conversation

RishabhSaini commented Jun 29, 2023

RishabhSaini commented Jun 29, 2023

cgwalters left a comment

Choose a reason for hiding this comment

cgwalters commented Jun 30, 2023

RishabhSaini commented Jun 30, 2023

RishabhSaini commented Jun 30, 2023 • edited Loading

cgwalters commented Jun 30, 2023

mtrmac commented Jun 30, 2023

cgwalters commented Jul 4, 2023

RishabhSaini commented Jul 4, 2023

cgwalters Jul 4, 2023

Choose a reason for hiding this comment

mtrmac Jul 11, 2023

Choose a reason for hiding this comment

cgwalters commented Jul 6, 2023

RishabhSaini commented Jul 6, 2023

cgwalters Jul 10, 2023

Choose a reason for hiding this comment

mtrmac left a comment

Choose a reason for hiding this comment

mtrmac Jul 11, 2023

Choose a reason for hiding this comment

mtrmac Jul 11, 2023

Choose a reason for hiding this comment

mtrmac Jul 11, 2023

Choose a reason for hiding this comment

mtrmac commented Jul 18, 2023

RishabhSaini commented Jun 30, 2023 •

edited

Loading