How to test verifying image signatures?

Solution In Progress - Updated -

Environment

  • OpenShift Container Platform
    • 3.6 or later

Issue

Resolution

Here is a steps for the usage.

1. Generate gpg key

1-1. Run rngd to make random digits faster

  # yum install rng-tools
  # rngd -r /dev/urandom     # We run rngd because to makes random digits faster.

1-2. Generate gpg key

  # gpg --gen-key
  // if it is just for a test, you don't need to care the input //

  # gpg --list-key foo@example.com
  pub   1024D/A6E57A17 2017-12-18 [expires: 2020-12-17]
  uid                  Kenjiro <foo@example.com>

2. Push the signed image

NOTE: There are several ways to sign your image. We introduce a way by using skopeo's copy.

2-1. Add cluster image-singer role to the user

  // Run as cluster-admin //
  # oc adm policy add-cluster-role-to-user system:image-signer <USER_NAME>

2-2. Sign image by skopeo

IMPORTANT: Replace foo@example.com with e-mail address you input by step-1.
IMPORTANT: Replace demo1 with a name of your project.

  # skopeo --debug --tls-verify=false copy --sign-by foo@example.com --dest-creds "`oc whoami`":"`oc whoami -t`" --dest-tls-verify=false docker://docker.io/openshift/origin-pod:latest atomic:docker-registry.default.svc:5000/demo1/signed:latest

  // Please make sure you don't get any error //
  ..
  DEBU[0003] Got body: {"kind":"ImageSignature","apiVersion":"v1","metadata":{"name":"sha256:7681e742c15d20c28d3f6a165e548ba351d041ea9c7f564e5b056ebe19db7380@f93f76ca5ec1d19cf54b8eb2bc5da925","selfLink":"/oapi/v1/imagesignatures/sha256%3A7681e742c15d20c28d3f6a165e548ba351d041ea9c7f564e5b056ebe19db7380%40f93f76ca5ec1d19cf54b8eb2bc5da925","uid":"7711432d-e393-11e7-8f2a-001a4a40dca2","creationTimestamp":"2017-12-18T01:33:35Z"},"type":"atomic","content":"owFNkD9LA0EQxS/xbySCKURIY9hCC02ym8veXa4TRPwAWmi3tzsXF3N3YW8TjCG9ZQrBNoUERGzsRAtr0/gFLLXURhCszCESu2HmzZvfvP7ilJHOZb6Hg+Hr6Upq9NjzjEM7/9FFXEktOWsgt4ukgFBL3UlqEfFjUEUFPigIOSB30qrLWKtOSYDPWg1ditvcpRjjsoAgIuVY1kMQboNpiDXqbSIZsDr88wxYKP3xrChkPZG4KD5iFWq5tuUQsKsVTqioYF5xhOlbjFgUaNXxmEmJwFUCrMZtn1pVoB6mFnhAasKzTQcnx3SnmbAyHQWSF3gUaiZDUIWEiumWgkQUNbWMwt+nuYKxWE12cImUcFFAG43dZDAmZEETuYQSk1rYIbTXO9uZNnJpY3YmnYRoLGSW/qL9XDYGd9cHJ5n0+tVlqj+/cf7U2N26fTAGN/fZudXsW35v+53vfz1frOVHLz8="}
  DEBU[0003] Got content-type: application/json
  • Once the image copy was succeeded, you can see the image by oc get istag
  # oc get istag
  NAME            DOCKER REF                                                                                                              UPDATED          IMAGENAME
  signed:latest   docker-registry.default.svc:5000/demo1/signed@sha256:7681e742c15d20c28d3f6a165e548ba351d041ea9c7f564e5b056ebe19db7380   19 minutes ago   sha256:7681e742c15d20c28d3f6a165e548ba351d041ea9c7f564e5b056ebe19db7380

3. Execute oc adm verify-image-signature

3-1. Add system:image-auditor to cluster role

  // Run as cluster-admin //
  # oc adm policy add-cluster-role-to-user system:image-auditor <USER>

3-2. Run oc adm verify-image-signature (finally!)

NOTE: Please check sha256:xxxx by oc get istag
NOTE: Replace demo1 with your project.

  # oc adm verify-image-signature sha256:7681e742c15d20c28d3f6a165e548ba351d041ea9c7f564e5b056ebe19db7380 --expected-identity=docker-registry.default.svc:5000/demo1/signed:latest --public-key ~/.gnupg/pubring.gpg
  image "sha256:7681e742c15d20c28d3f6a165e548ba351d041ea9c7f564e5b056ebe19db7380" identity is now confirmed (signed by GPG key "09FAA6A0A6E57A17")

Root Cause

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments