Supply Chain Security with cosign: Sign and Verify Artifacts

Introduction

Supply chain security is a critical aspect of modern DevOps practices. With the rise of software supply chain attacks, ensuring the integrity of the artifacts used in your applications has become paramount. Cosign, part of the Sigstore project, provides a robust solution for signing and verifying container images and other artifacts without requiring a key management system. This is achieved through keyless signing using OpenID Connect (OIDC) identities, making the process accessible and secure.

This tutorial will guide you through signing and verifying artifacts using Cosign. We will cover its core concepts, practical examples, and the best practices to ensure a secure software supply chain. By the end, you will understand how to implement Cosign effectively in your DevOps workflow, enhancing the security and trustworthiness of your deployments.

Prerequisites

To follow this tutorial, ensure you have the following:

Software Requirements:
- Docker installed on your machine.
- Go installed if you want to build Cosign from source.
- Cosign CLI tool installed. You can install it using:
```
brew install sigstore/tap/cosign
```
Cloud Subscriptions:
- An account with a container registry (e.g., Docker Hub, Google Container Registry).
Permissions:
- Access to your container registry for pushing and pulling images.
- OIDC identity provider configured (e.g., GitHub, Google).
Tools:
- A terminal or command line interface.

Core Concepts

Definitions

Cosign: A tool for signing and verifying container images and artifacts.
Sigstore: A project aimed at improving the security of the software supply chain.
Keyless Signing: A method where users can sign artifacts without managing private keys, leveraging OIDC tokens instead.
Attestations: Metadata that accompanies a signed artifact, providing additional context or validation.
Policy Enforcement: Mechanisms to ensure that only verified artifacts are deployed.

Architecture

Cosign operates by signing images with a private key that is never stored locally. Instead, it uses OIDC tokens to authenticate users at the time of signing.

When to Use

Use Cosign when:

You need a simple, secure method for signing container images.
You want to avoid the complexities of key management.
You require a way to validate the integrity of your deployments.

Limitations

Requires an OIDC provider for keyless signing.
Dependency on network connectivity for signing operations.

Pricing Notes

Cosign and Sigstore are open-source and free to use. Costs may arise from using hosting services or cloud providers for your containers and identities.

Syntax/Configuration

Installing Cosign

To install Cosign, run the following command:

brew install sigstore/tap/cosign

Signing an Image

The basic syntax for signing an image is:

cosign sign --key=<KEY> <IMAGE>

For keyless signing, use:

cosign sign --oidc-issuer=<OIDC_ISSUER> <IMAGE>

Verifying an Image

To verify a signed image, use:

cosign verify --key=<KEY> <IMAGE>

For keyless verification:

cosign verify --oidc-issuer=<OIDC_ISSUER> <IMAGE>

Parameters Table

Parameter	Description
`--key`	Path to the public key or OIDC issuer for signing.
`--oidc-issuer`	OIDC issuer URL for keyless signing and verification.
`<IMAGE>`	The name of the container image to sign or verify.

Practical Examples

1. Keyless Signing of a Docker Image

cosign sign --oidc-issuer=https://issuer.example.com docker.io/yourrepo/yourimage:latest

This command signs the Docker image without needing a key file.

2. Keyless Verification of a Docker Image

cosign verify --oidc-issuer=https://issuer.example.com docker.io/yourrepo/yourimage:latest

This command verifies the signature of the Docker image.

3. Signing an Image with Attestation

cosign sign --oidc-issuer=https://issuer.example.com --attest docker.io/yourrepo/yourimage:latest

This command includes an attestation during signing.

4. Verifying an Image with Attestation

cosign verify --oidc-issuer=https://issuer.example.com --attest docker.io/yourrepo/yourimage:latest

Checks the attestation along with the signature.

5. Listing Signed Artifacts

cosign list tags docker.io/yourrepo/yourimage

This command lists all the signed tags for the specified image.

6. Revoke a Signature

cosign revoke --key=<KEY> --reason="Compromised key" docker.io/yourrepo/yourimage:latest

This command revokes a previously issued signature.

7. Enforcing Policy with Cosign

To enforce a policy, you can create a policy file (policy.yaml):

- match:
    repo: "docker.io/yourrepo/yourimage"
  validate:
    signature:
      issuer: "https://issuer.example.com"

Then apply the policy:

cosign policy enforce policy.yaml

8. Automating Signing in CI/CD

In a CI/CD pipeline, you can automate signing with a script:

#!/bin/bash
set -e
IMAGE="docker.io/yourrepo/yourimage:latest"
cosign sign --oidc-issuer=https://issuer.example.com $IMAGE

Real-World Scenarios

Scenario 1: CI/CD Integration

Integrate Cosign into your CI/CD pipeline to automatically sign images after successful builds. This ensures that only verified images are deployed to production.

Scenario 2: Policy Enforcement in Kubernetes

Use Cosign to enforce signing policies in Kubernetes. Ensure that only images with valid signatures are allowed to run in your clusters, enhancing security.

Scenario 3: Attestation for Compliance

For organizations needing compliance, use attestations to record metadata about builds, ensuring traceability and accountability for every artifact deployed.

Best Practices

Use OIDC Providers: Leverage OIDC for keyless signing to simplify security management.
Automate Signing: Integrate Cosign into your CI/CD pipelines for automated signing.
Enforce Policies: Implement policies to restrict which images can be deployed based on signature validation.
Regularly Review Attestations: Ensure that attestations are reviewed periodically to maintain compliance.
Monitor Revoked Signatures: Keep track of revoked signatures to prevent the use of compromised artifacts.

Common Errors

Error: failed to get signature
- Cause: The image has not been signed.
- Fix: Ensure the image is signed before verification.
Error: signature verification failed
- Cause: The signature does not match the image.
- Fix: Verify the image with the correct public key or OIDC issuer.
Error: unable to connect to issuer
- Cause: Network issues or incorrect OIDC issuer URL.
- Fix: Check your network connection and verify the issuer URL.
Error: attestation not found
- Cause: The image was signed without an attestation.
- Fix: Sign the image again with the attestation option.

Related Services/Tools

Tool/Service	Description	Comparison
Docker	Containerization platform	Works with Cosign for image signing
Notary	Tool for signing Docker images	Requires key management, unlike Cosign
Trivy	Vulnerability scanner for container images	Can complement Cosign by scanning signed images
Kyverno	Policy engine for Kubernetes	Can enforce policies on images based on signatures

Automation Script

#!/bin/bash
# Script to sign Docker images using Cosign
set -e

# Variables
IMAGE="docker.io/yourrepo/yourimage:latest"
OIDC_ISSUER="https://issuer.example.com"

# Sign the image
cosign sign --oidc-issuer=$OIDC_ISSUER $IMAGE

# Verify the image
cosign verify --oidc-issuer=$OIDC_ISSUER $IMAGE

echo "Image signed and verified successfully!"

Conclusion

Incorporating Cosign into your DevOps practices significantly enhances the security of your software supply chain by enabling easy signing and verification of artifacts. By adopting keyless signing, leveraging OIDC identities, and implementing policy enforcement, organizations can ensure that only trusted artifacts are deployed.

For next steps, consider exploring the official Cosign and Sigstore documentation to deepen your understanding and discover additional features.