Skip to content

Commit 941918c

Browse files
CopilotMossaka
Copilot
and
Mossaka
authored
feat: add cosign signing for docker images in release pipeline (#89)
* Initial plan * feat: add cosign signing for docker images in release pipeline Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> * docs: add cosign verification instructions to release template Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> * refactor: use anchore/sbom-action for secure sbom generation Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> * docs: improve cosign installation instructions with security notes Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> * docs: emphasize package manager installation for cosign Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> * chore: pin github actions to commit hashes Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> * docs: move image verification to dedicated doc file Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
1 parent f2c3a6b commit 941918c

4 files changed

Lines changed: 133 additions & 0 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ on:
99
permissions:
1010
contents: write # Required for creating releases
1111
packages: write # Required for pushing to GHCR
12+
id-token: write # Required for cosign keyless signing
1213

1314
jobs:
1415
build-and-release:
@@ -55,7 +56,11 @@ jobs:
5556
- name: Set up Docker Buildx
5657
uses: docker/setup-buildx-action@v3
5758

59+
- name: Install cosign
60+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
61+
5862
- name: Build and push Squid image
63+
id: build_squid
5964
uses: docker/build-push-action@v5
6065
with:
6166
context: ./containers/squid
@@ -66,7 +71,27 @@ jobs:
6671
cache-from: type=gha
6772
cache-to: type=gha,mode=max
6873

74+
- name: Sign Squid image with cosign
75+
run: |
76+
cosign sign --yes \
77+
ghcr.io/${{ github.repository }}/squid@${{ steps.build_squid.outputs.digest }}
78+
79+
- name: Generate SBOM for Squid image
80+
uses: anchore/sbom-action@d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5 # v0.17.0
81+
with:
82+
image: ghcr.io/${{ github.repository }}/squid@${{ steps.build_squid.outputs.digest }}
83+
format: spdx-json
84+
output-file: squid-sbom.spdx.json
85+
86+
- name: Attest SBOM for Squid image
87+
run: |
88+
cosign attest --yes \
89+
--predicate squid-sbom.spdx.json \
90+
--type spdxjson \
91+
ghcr.io/${{ github.repository }}/squid@${{ steps.build_squid.outputs.digest }}
92+
6993
- name: Build and push Agent image
94+
id: build_agent
7095
uses: docker/build-push-action@v5
7196
with:
7297
context: ./containers/agent
@@ -77,6 +102,25 @@ jobs:
77102
cache-from: type=gha
78103
cache-to: type=gha,mode=max
79104

105+
- name: Sign Agent image with cosign
106+
run: |
107+
cosign sign --yes \
108+
ghcr.io/${{ github.repository }}/agent@${{ steps.build_agent.outputs.digest }}
109+
110+
- name: Generate SBOM for Agent image
111+
uses: anchore/sbom-action@d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5 # v0.17.0
112+
with:
113+
image: ghcr.io/${{ github.repository }}/agent@${{ steps.build_agent.outputs.digest }}
114+
format: spdx-json
115+
output-file: agent-sbom.spdx.json
116+
117+
- name: Attest SBOM for Agent image
118+
run: |
119+
cosign attest --yes \
120+
--predicate agent-sbom.spdx.json \
121+
--type spdxjson \
122+
ghcr.io/${{ github.repository }}/agent@${{ steps.build_agent.outputs.digest }}
123+
80124
- name: Install pkg for binary creation
81125
run: npm install -g pkg
82126

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ sudo awf --help
3131

3232
**Note:** Verify checksums after download by downloading `checksums.txt` from the release page.
3333

34+
**Docker Image Verification:** All published container images are cryptographically signed with cosign. See [docs/image-verification.md](docs/image-verification.md) for verification instructions.
35+
3436
### Basic Usage
3537

3638
```bash

‎docs/RELEASE_TEMPLATE.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,3 +83,17 @@ Published to GitHub Container Registry:
8383
- `ghcr.io/{{REPOSITORY}}/agent:{{VERSION_NUMBER}}`
8484
- `ghcr.io/{{REPOSITORY}}/squid:latest`
8585
- `ghcr.io/{{REPOSITORY}}/agent:latest`
86+
87+
### Image Verification
88+
89+
All container images are cryptographically signed with [cosign](https://github.com/sigstore/cosign) for authenticity verification.
90+
91+
```bash
92+
# Verify image signature
93+
cosign verify \
94+
--certificate-identity-regexp 'https://github.com/{{REPOSITORY}}/.*' \
95+
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
96+
ghcr.io/{{REPOSITORY}}/squid:{{VERSION_NUMBER}}
97+
```
98+
99+
For detailed instructions including SBOM verification, see [docs/image-verification.md](https://github.com/{{REPOSITORY}}/blob/{{VERSION}}/docs/image-verification.md).

‎docs/image-verification.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# Docker Image Verification
2+
3+
All published Docker images are signed with [cosign](https://github.com/sigstore/cosign) using keyless signing. You can verify the signatures to ensure image authenticity and integrity.
4+
5+
## Installing Cosign
6+
7+
### Package Managers (Recommended)
8+
9+
```bash
10+
# Homebrew (macOS/Linux)
11+
brew install cosign
12+
13+
# Debian/Ubuntu
14+
sudo apt update && sudo apt install -y cosign
15+
```
16+
17+
See the [official installation guide](https://docs.sigstore.dev/cosign/installation/) for all installation options.
18+
19+
### Direct Download
20+
21+
```bash
22+
# Quick install for testing (verify checksums from GitHub release page for production)
23+
curl -sSfL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 -o cosign
24+
chmod +x cosign
25+
sudo mv cosign /usr/local/bin/
26+
```
27+
28+
## Verifying Image Signatures
29+
30+
All images are signed using GitHub Actions OIDC tokens, ensuring they come from the official repository.
31+
32+
### Verify Squid Image
33+
34+
```bash
35+
cosign verify \
36+
--certificate-identity-regexp 'https://github.com/githubnext/gh-aw-firewall/.*' \
37+
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
38+
ghcr.io/githubnext/gh-aw-firewall/squid:latest
39+
```
40+
41+
### Verify Agent Image
42+
43+
```bash
44+
cosign verify \
45+
--certificate-identity-regexp 'https://github.com/githubnext/gh-aw-firewall/.*' \
46+
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
47+
ghcr.io/githubnext/gh-aw-firewall/agent:latest
48+
```
49+
50+
## Verifying SBOM Attestations
51+
52+
Images include Software Bill of Materials (SBOM) attestations for supply chain transparency.
53+
54+
```bash
55+
cosign verify-attestation \
56+
--certificate-identity-regexp 'https://github.com/githubnext/gh-aw-firewall/.*' \
57+
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
58+
--type spdxjson \
59+
ghcr.io/githubnext/gh-aw-firewall/squid:latest
60+
```
61+
62+
## What Gets Signed
63+
64+
- **Image Signatures**: Cryptographic signatures proving the image was built by the official GitHub Actions workflow
65+
- **SBOM Attestations**: Software Bill of Materials in SPDX JSON format, listing all dependencies and components
66+
- **Transparency Log**: All signatures are recorded in Sigstore's Rekor transparency log
67+
68+
## Security Benefits
69+
70+
- **Image Authenticity**: Verify images come from the official repository
71+
- **Supply Chain Security**: SBOM attestations provide transparency about image contents
72+
- **Keyless Signing**: Uses GitHub Actions OIDC tokens (no secret keys to manage)
73+
- **Reproducible Builds**: GitHub Actions pinned to commit hashes prevent supply chain attacks

0 commit comments

Comments
 (0)