Skip to content

Commit 6f23195

Browse files
akashsinghalakashsinghal
committed
build: add release image signing
Signed-off-by: Akash Singhal <[email protected]>
1 parent fa9be71 commit 6f23195

File tree

3 files changed

+130
-0
lines changed

3 files changed

+130
-0
lines changed

‎.github/workflows/publish-dev-assets.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ jobs:
3737
az version
3838
# Key Vault:
3939
az account get-access-token --scope https://vault.azure.net/.default --output none
40+
- name: Prepare notation certificate
41+
run: |
42+
mkdir -p truststore/x509/ca/ratify-verify
43+
cp ./.well-known/pki-validation/ratify-verification.crt truststore/x509/ca/ratify-verify
4044
- name: prepare
4145
id: prepare
4246
run: |
@@ -138,6 +142,44 @@ jobs:
138142
cosign sign --yes ${{ steps.prepare.outputs.ref }}:${{ steps.prepare.outputs.version }}
139143
cosign sign --yes ${{ steps.prepare.outputs.chartrepo }}/ratify:${{ steps.prepare.outputs.semversionrolling }}
140144
cosign sign --yes ${{ steps.prepare.outputs.chartrepo }}/ratify:${{ steps.prepare.outputs.semversion }}
145+
- name: Verify with Notation
146+
uses: notaryproject/notation-action/verify@03242349f62aeddc995e12c6fbcea3b87697873f # v1.2.0
147+
with:
148+
target_artifact_reference: |-
149+
${{ steps.prepare.outputs.crdref }}:${{ steps.prepare.outputs.version }}
150+
${{ steps.prepare.outputs.baseref }}:${{ steps.prepare.outputs.version }}
151+
${{ steps.prepare.outputs.ref }}:${{ steps.prepare.outputs.version }}
152+
${{ steps.prepare.outputs.chartrepo }}/ratify:${{ steps.prepare.outputs.semversionrolling }}
153+
${{ steps.prepare.outputs.chartrepo }}/ratify:${{ steps.prepare.outputs.semversion }}
154+
trust_policy: ./.well-known/pki-validation/trustpolicy.json
155+
trust_store: truststore
156+
- name: Verify with Cosign
157+
run: |
158+
cosign verify \
159+
--certificate-identity-regexp "https://github.com/ratify-project/ratify/.github/workflows/publish-dev-assets.yml@*" \
160+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
161+
--certificate-github-workflow-repository ratify-project/ratify \
162+
${{ steps.prepare.outputs.crdref }}:${{ steps.prepare.outputs.version }}
163+
cosign verify \
164+
--certificate-identity-regexp "https://github.com/ratify-project/ratify/.github/workflows/publish-dev-assets.yml@*" \
165+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
166+
--certificate-github-workflow-repository ratify-project/ratify \
167+
${{ steps.prepare.outputs.baseref }}:${{ steps.prepare.outputs.version }}
168+
cosign verify \
169+
--certificate-identity-regexp "https://github.com/ratify-project/ratify/.github/workflows/publish-dev-assets.yml@*" \
170+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
171+
--certificate-github-workflow-repository ratify-project/ratify \
172+
${{ steps.prepare.outputs.ref }}:${{ steps.prepare.outputs.version }}
173+
cosign verify \
174+
--certificate-identity-regexp "https://github.com/ratify-project/ratify/.github/workflows/publish-dev-assets.yml@*" \
175+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
176+
--certificate-github-workflow-repository ratify-project/ratify \
177+
${{ steps.prepare.outputs.chartrepo }}/ratify:${{ steps.prepare.outputs.semversionrolling }}
178+
cosign verify \
179+
--certificate-identity-regexp "https://github.com/ratify-project/ratify/.github/workflows/publish-dev-assets.yml@*" \
180+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
181+
--certificate-github-workflow-repository ratify-project/ratify \
182+
${{ steps.prepare.outputs.chartrepo }}/ratify:${{ steps.prepare.outputs.semversion }}
141183
- name: clear
142184
if: always()
143185
run: |

‎.github/workflows/publish-package.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,34 @@ jobs:
1414
permissions:
1515
packages: write
1616
contents: read
17+
id-token: write
18+
environment: azure-publish
1719
steps:
1820
- name: Harden Runner
1921
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
2022
with:
2123
egress-policy: audit
2224
- name: Checkout
2325
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
26+
- name: Install Notation
27+
uses: notaryproject/notation-action/setup@03242349f62aeddc995e12c6fbcea3b87697873f # v1.2.0
28+
- name: Install cosign
29+
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
30+
- name: Az CLI login
31+
uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
32+
with:
33+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
34+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
35+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
36+
- name: Cache AAD tokens
37+
run: |
38+
az version
39+
# Key Vault:
40+
az account get-access-token --scope https://vault.azure.net/.default --output none
41+
- name: Prepare notation certificate
42+
run: |
43+
mkdir -p truststore/x509/ca/ratify-verify
44+
cp ./.well-known/pki-validation/ratify-verification.crt truststore/x509/ca/ratify-verify
2445
- name: prepare
2546
id: prepare
2647
run: |
@@ -83,6 +104,49 @@ jobs:
83104
--label org.opencontainers.image.revision=${{ github.sha }} \
84105
-t ${{ steps.prepare.outputs.ref }} \
85106
--push .
107+
- name: Sign with Notation
108+
uses: notaryproject/notation-action/sign@03242349f62aeddc995e12c6fbcea3b87697873f # v1.2.0
109+
with:
110+
plugin_name: azure-kv
111+
plugin_url: ${{ vars.AZURE_KV_PLUGIN_URL }}
112+
plugin_checksum: ${{ vars.AZURE_KV_CHECKSUM }}
113+
key_id: ${{ secrets.AZURE_KV_KEY_ID }}
114+
target_artifact_reference: |-
115+
${{ steps.prepare.outputs.crdref }}
116+
${{ steps.prepare.outputs.baseref }}
117+
${{ steps.prepare.outputs.ref }}
118+
signature_format: cose
119+
- name: Sign with Cosign
120+
run: |
121+
cosign sign --yes ${{ steps.prepare.outputs.crdref }}
122+
cosign sign --yes ${{ steps.prepare.outputs.baseref }}
123+
cosign sign --yes ${{ steps.prepare.outputs.ref }}
124+
- name: Verify with Notation
125+
uses: notaryproject/notation-action/verify@03242349f62aeddc995e12c6fbcea3b87697873f # v1.2.0
126+
with:
127+
target_artifact_reference: |-
128+
${{ steps.prepare.outputs.crdref }}
129+
${{ steps.prepare.outputs.baseref }}
130+
${{ steps.prepare.outputs.ref }}
131+
trust_policy: ./.well-known/pki-validation/trustpolicy.json
132+
trust_store: truststore
133+
- name: Verify with Cosign
134+
run: |
135+
cosign verify \
136+
--certificate-identity-regexp "https://github.com/ratify-project/ratify/.github/workflows/publish-package.yml@*" \
137+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
138+
--certificate-github-workflow-repository ratify-project/ratify \
139+
${{ steps.prepare.outputs.crdref }}
140+
cosign verify \
141+
--certificate-identity-regexp "https://github.com/ratify-project/ratify/.github/workflows/publish-package.yml@*" \
142+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
143+
--certificate-github-workflow-repository ratify-project/ratify \
144+
${{ steps.prepare.outputs.baseref }}
145+
cosign verify \
146+
--certificate-identity-regexp "https://github.com/ratify-project/ratify/.github/workflows/publish-package.yml@*" \
147+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
148+
--certificate-github-workflow-repository ratify-project/ratify \
149+
${{ steps.prepare.outputs.ref }}
86150
- name: clear
87151
if: always()
88152
run: |

‎.well-known/pki-validation/trustpolicy.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"version": "1.0",
3+
"trustPolicies": [
4+
{
5+
"name": "ratify-images",
6+
"registryScopes": [
7+
"ghcr.io/ratify-project/ratify",
8+
"ghcr.io/ratify-project/ratify-base",
9+
"ghcr.io/ratify-project/ratify-crds",
10+
"ghcr.io/ratify-project/ratify-dev",
11+
"ghcr.io/ratify-project/ratify-base-dev",
12+
"ghcr.io/ratify-project/ratify-crds-dev",
13+
"ghcr.io/ratify-project/ratify-chart-dev/ratify"
14+
],
15+
"signatureVerification": {
16+
"level" : "strict"
17+
},
18+
"trustStores": [ "ca:ratify-verify" ],
19+
"trustedIdentities": [
20+
"x509.subject: CN=ratify.dev,O=ratify-project,L=Seattle,ST=WA,C=US"
21+
]
22+
}
23+
]
24+
}

0 commit comments

Comments
 (0)