Add cosign in compose #1508

djdongjin · 2022-11-15T16:39:11Z

Similar to ##556, #606, #628, this PR adds cosign support to compose:

Support cosign in compose run, compose up, compose push, compose pull.
Refactor cosign related functions to its own package, so they can be used by both nerdctl and nerdctl compose.
Add tests.
Update doc.
Figure how to add --experimental for cosign support in compose commands.
Rebase.

I'm more towards the below method from #607 discussion, since it's less error-prone than cli args and more flexibile (my understanding is we should provide the capability to sign/verify individual images per services and cannot assume user will use the same pair for all images in a compose yaml).

services:
  foo:
    image: bar
    x-nerdctl-verify: cosign
    x-nerdctl-cosign-public-key: /path/to/cosign.pub
    x-nerdctl-sign: cosign
    x-nerdctl-cosign-private-key: /path/to/cosign.key

A running example:

➜  compose-cosign cat docker-compose.yml
services:
  svc0:
    build: .
    image: docker.io/djdongjin95/svc0_image
    x-nerdctl-verify: cosign
    x-nerdctl-cosign-public-key: ./cosign.pub
    x-nerdctl-sign: cosign
    x-nerdctl-cosign-private-key: ./cosign.key
    ports:
    - 8080:80
  svc1:
    build: .
    image: docker.io/djdongjin95/svc1_image
    ports:
    - 8081:80

# compose push
➜  compose-cosign sudo env "COSIGN_PASSWORD="$COSIGN_PASSWORD"" nerdctl compose push
WARN[0000] build.config should be relative path, got "/home/ec2-user/tmp/compose-cosign"
...
elapsed: 0.2 s                                                                    total:  9.3 Ki (46.2 KiB/s)
INFO[0001] cosign: WARNING: Image reference docker.io/djdongjin95/svc0_image uses a tag, not a digest, to identify the image to sign.
INFO[0001] cosign:
INFO[0001] cosign: This can lead you to sign a different image than the intended one. Please use a
INFO[0001] cosign: digest (example.com/ubuntu@sha256:abc123...) rather than tag
INFO[0001] cosign: (example.com/ubuntu:latest) for the input to cosign. The ability to refer to
INFO[0001] cosign: images by tag will be removed in a future release.
INFO[0001] cosign: Pushing signature to: index.docker.io/djdongjin95/svc0_image
WARN[0001] build.config should be relative path, got "/home/ec2-user/tmp/compose-cosign"
INFO[0001] Pushing image docker.io/djdongjin95/svc1_image
...
elapsed: 0.2 s                                                                    total:  9.3 Ki (46.3 KiB/s)

# compose pull
➜  compose-cosign sudo env "COSIGN_PASSWORD="$COSIGN_PASSWORD"" nerdctl compose pull
WARN[0000] build.config should be relative path, got "/home/ec2-user/tmp/compose-cosign"
INFO[0000] Pulling image docker.io/djdongjin95/svc0_image
INFO[0000] cosign:
INFO[0000] cosign: [{"critical":{"identity":{"docker-reference":"index.docker.io/djdongjin95/svc0_image"},"image":{"docker-manifest-digest":"sha256:4329abc3143b1545835de17e1302c8313a9417798b836022f4c8c8dc8b10a3e9"},"type":"cosign container image signature"},"optional":null}]
INFO[0000] cosign:
INFO[0000] cosign: Verification for index.docker.io/djdongjin95/svc0_image@sha256:4329abc3143b1545835de17e1302c8313a9417798b836022f4c8c8dc8b10a3e9 --
INFO[0000] cosign: The following checks were performed on each of these signatures:
INFO[0000] cosign:   - The cosign claims were validated
INFO[0000] cosign:   - The signatures were verified against the specified public key
docker.io/djdongjin95/svc0_image@sha256:4329abc3143b1545835de17e1302c8313a9417798b836022f4c8c8dc8b10a3e9: resolved       |++++++++++++++++++++++++++++++++++++++|
manifest-sha256:4329abc3143b1545835de17e1302c8313a9417798b836022f4c8c8dc8b10a3e9:                         done           |++++++++++++++++++++++++++++++++++++++|
config-sha256:abcd9b97b24c8f2f763d937a726a62e39c1ef39574a6c24cc779bea8e08c2519:                           done           |++++++++++++++++++++++++++++++++++++++|
elapsed: 0.3 s                                                                                            total:  1.7 Ki (5.8 KiB/s)
WARN[0000] build.config should be relative path, got "/home/ec2-user/tmp/compose-cosign"
...
elapsed: 0.2 s                                                                    total:   0.0 B (0.0 B/s)

# pulled images
➜  compose-cosign sudo nerdctl images
REPOSITORY                TAG       IMAGE ID        CREATED           PLATFORM       SIZE        BLOB SIZE
djdongjin95/svc0_image    <none>    4329abc3143b    15 seconds ago    linux/amd64    24.5 MiB    9.4 MiB
djdongjin95/svc1_image    latest    4329abc3143b    15 seconds ago    linux/amd64    24.5 MiB    9.4 MiB

# compose up
➜  compose-cosign sudo env "COSIGN_PASSWORD="$COSIGN_PASSWORD"" nerdctl compose up
...
INFO[0000] Ensuring image docker.io/djdongjin95/svc0_image
INFO[0000] cosign:
INFO[0000] cosign: [{"critical":{"identity":{"docker-reference":"index.docker.io/djdongjin95/svc0_image"},"image":{"docker-manifest-digest":"sha256:4329abc3143b1545835de17e1302c8313a9417798b836022f4c8c8dc8b10a3e9"},"type":"cosign container image signature"},"optional":null}]
INFO[0000] cosign:
INFO[0000] cosign: Verification for index.docker.io/djdongjin95/svc0_image@sha256:4329abc3143b1545835de17e1302c8313a9417798b836022f4c8c8dc8b10a3e9 --
INFO[0000] cosign: The following checks were performed on each of these signatures:
INFO[0000] cosign:   - The cosign claims were validated
INFO[0000] cosign:   - The signatures were verified against the specified public key
INFO[0000] Ensuring image docker.io/djdongjin95/svc1_image
INFO[0000] Creating container compose-cosign_svc1_1
INFO[0000] Creating container compose-cosign_svc0_1
INFO[0001] Attaching to logs

# compose run
➜  compose-cosign sudo env "COSIGN_PASSWORD="$COSIGN_PASSWORD"" nerdctl compose run svc0 -- echo "hello"
...
INFO[0000] Ensuring image docker.io/djdongjin95/svc0_image
INFO[0000] cosign:
INFO[0000] cosign: [{"critical":{"identity":{"docker-reference":"index.docker.io/djdongjin95/svc0_image"},"image":{"docker-manifest-digest":"sha256:4329abc3143b1545835de17e1302c8313a9417798b836022f4c8c8dc8b10a3e9"},"type":"cosign container image signature"},"optional":null}]
INFO[0000] cosign:
INFO[0000] cosign: Verification for index.docker.io/djdongjin95/svc0_image@sha256:4329abc3143b1545835de17e1302c8313a9417798b836022f4c8c8dc8b10a3e9 --
INFO[0000] cosign: The following checks were performed on each of these signatures:
INFO[0000] cosign:   - The cosign claims were validated
INFO[0000] cosign:   - The signatures were verified against the specified public key
INFO[0000] Creating container compose-cosign_svc0_run_a516dddd5769
hello
INFO[0000] Stopping containers (forcibly)
INFO[0000] Stopping container compose-cosign_svc0_run_a516dddd5769

Signed-off-by: Jin Dong jindon@amazon.com

djdongjin · 2022-11-16T02:42:46Z

cc @AkihiroSuda @developer-guy @Dentrax @ktock. I think the functionality should work now, but thanks for any comments&suggestions as I don't have much experience with cosign :)

Also any suggestion on how to check experimental (from cmd) for compose cosign? In compose the cosign feature is visible till in pkg (i.e., not in cmd). One way might be passing experimental to related Options (e.g., PullOptions, UpOptions, etc), but it'll change every compose Options struct (pull, push, up, run).

Thanks!

(I'll update related docs after the implementation looks okay :))

AkihiroSuda · 2022-11-16T05:49:14Z

Thanks!

One way might be passing experimental to related Options (e.g., PullOptions, UpOptions, etc)

Yes, should be added in Options

AkihiroSuda · 2022-11-16T07:13:26Z

cmd/nerdctl/compose_run_linux_test.go

+	// 4. compose run
+	const sttyPartialOutput = "speed 38400 baud"
+	// unbuffer(1) emulates tty, which is required by `nerdctl run -t`.
+	// unbuffer(1) can be installed with `apt-get install expect`.


Any reason to check the TTY functionality here?

I followed compose run testcases in the same folder. Seems they all use this scenario. Should I change to something else? thanks.

Just "echo hi" should suffice, unless the cosign stuff relates to tty

I tested echo hi but seems have some issue in test(below, maybe due to some unimplemented feature in compose run as mentioned in #1340).

If it's okay I'll keep this test consistent with other compose run testcases (i.e., use unbuffer) in this file.

time="2022-11-17T01:49:58Z" level=fatal msg="error while creating container nerdctl-compose-test2565186661_svc0_run_6af98b73d3b0: exit status 2"

pkg/cosignutil/cosignutil.go

cmd/nerdctl/compose.go

developer-guy · 2022-11-16T18:28:46Z

If people are going to try that feature in lima VM, they will fail as we did not add cosign binary into the VM image yet 👇

#680

Signed-off-by: Jin Dong <jindon@amazon.com> Add compose cosign test Signed-off-by: Jin Dong <jindon@amazon.com> Fix naming bug Signed-off-by: Jin Dong <jindon@amazon.com> Add compose cosign test [pass] Signed-off-by: Jin Dong <jindon@amazon.com> Add compose experimental flag Signed-off-by: Jin Dong <jindon@amazon.com> Refactor cosign func Signed-off-by: Jin Dong <jindon@amazon.com> Add compose cosign doc Signed-off-by: Jin Dong <jindon@amazon.com>

Signed-off-by: Jin Dong <jindon@amazon.com>

djdongjin · 2022-11-17T01:02:26Z

If people are going to try that feature in lima VM, they will fail as we did not add cosign binary into the VM image yet 👇

#680

Thanks for pointing this out! This will be the same for cosign support in other commands right? (e.g. nerdctl push|run|pull)? If so, maybe we can just track the cosign support for lima as a whole in #679/#680.

AkihiroSuda

Thanks

djdongjin changed the title ~~Add cosign in compose run, up, pull, push~~ Add cosign in compose Nov 15, 2022

djdongjin marked this pull request as ready for review November 16, 2022 02:28

AkihiroSuda reviewed Nov 16, 2022

View reviewed changes

pkg/cosignutil/cosignutil.go Show resolved Hide resolved

AkihiroSuda reviewed Nov 16, 2022

View reviewed changes

pkg/cosignutil/cosignutil.go Show resolved Hide resolved

ktock reviewed Nov 16, 2022

View reviewed changes

pkg/cosignutil/cosignutil.go Outdated Show resolved Hide resolved

cmd/nerdctl/compose.go Outdated Show resolved Hide resolved

djdongjin force-pushed the compose-cosign branch from 069aa92 to 2a47031 Compare November 16, 2022 17:08

djdongjin added 2 commits November 16, 2022 18:46

Fix keyless mode in compose up|run

cfa27df

Signed-off-by: Jin Dong <jindon@amazon.com>

djdongjin force-pushed the compose-cosign branch from 48d64ef to cfa27df Compare November 16, 2022 18:47

AkihiroSuda added area/compose area/cosign cosign labels Nov 17, 2022

AkihiroSuda added this to the v1.0.1 milestone Nov 18, 2022

AkihiroSuda approved these changes Nov 18, 2022

View reviewed changes

AkihiroSuda merged commit 2ae985b into containerd:main Nov 18, 2022

developer-guy mentioned this pull request Dec 6, 2022

feat: add cosign binary to nerdctl-full #680

Open

AkihiroSuda mentioned this pull request Apr 15, 2023

Add Cosign keyless mode required args for nerdctl pull and run #2185

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add cosign in compose #1508

Add cosign in compose #1508

djdongjin commented Nov 15, 2022 •

edited

Loading

djdongjin commented Nov 16, 2022

AkihiroSuda commented Nov 16, 2022

AkihiroSuda Nov 16, 2022

djdongjin Nov 16, 2022

AkihiroSuda Nov 16, 2022

djdongjin Nov 17, 2022

developer-guy commented Nov 16, 2022

djdongjin commented Nov 17, 2022

AkihiroSuda left a comment

Add cosign in compose #1508

Add cosign in compose #1508

Conversation

djdongjin commented Nov 15, 2022 • edited Loading

djdongjin commented Nov 16, 2022

AkihiroSuda commented Nov 16, 2022

AkihiroSuda Nov 16, 2022

Choose a reason for hiding this comment

djdongjin Nov 16, 2022

Choose a reason for hiding this comment

AkihiroSuda Nov 16, 2022

Choose a reason for hiding this comment

djdongjin Nov 17, 2022

Choose a reason for hiding this comment

developer-guy commented Nov 16, 2022

djdongjin commented Nov 17, 2022

AkihiroSuda left a comment

Choose a reason for hiding this comment

djdongjin commented Nov 15, 2022 •

edited

Loading