Verify Artifacts

verify images

Karmada has introduced cosign to verify the released images since version v1.7. The specific operation is as follows:

Prerequisites

You need to install the following tools:

Verify image signature

Verify image with cosign CLI

Karmada introduced the cosign verification tool since release 1.7. For a list of published mirrors, see karmada mirrors.

Select an image from these images and verify its signature using cosign verify command：

  1. cosign verify docker.io/karmada/karmada-aggregated-apiserver:latest \
  2.   --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  3.   --certificate-identity-regexp=^https://github.com/karmada-io/karmada/.*$ | jq

If the echo is as follows, the verification is successful:

  1. Verification for index.docker.io/karmada/karmada-aggregated-apiserver:latest --
  2. The following checks were performed on each of these signatures:
  3.   - The cosign claims were validated
  4.   - Existence of the claims in the transparency log was verified offline
  5.   - The code-signing certificate was verified using trusted certificate authority certificates
  6. [
  7.   {
  8.     "critical": {
  9.       "identity": {
  10.         "docker-reference": "index.docker.io/karmada/karmada-aggregated-apiserver"
  11.       },
  12.       "image": {
  13.         "docker-manifest-digest": "sha256:c6d85e111e1ca4da234e87fb48f8ff170c918a0e6893d9ac9e888a4e7cc0056f"
  14.       },
  15.       "type": "cosign container image signature"
  16.     },
  17.     "optional": {
  18.       "1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com",
  19.       "1.3.6.1.4.1.57264.1.2": "push",
  20.       "1.3.6.1.4.1.57264.1.3": "e5277b6317ac1a4717f5fac4057caf51a5d248fc",
  21.       "1.3.6.1.4.1.57264.1.4": "latest image to DockerHub",
  22.       "1.3.6.1.4.1.57264.1.5": "karmada-io/karmada",
  23.       "1.3.6.1.4.1.57264.1.6": "refs/heads/master",
  24.       "Bundle": {
  25.         "SignedEntryTimestamp": "MEYCIQD4R9XlhgQkjVAg4XuW857iqkNrSxbQB9k3x4Ie8IshgAIhAILn8m+eOAjYxxcpFU42ghoiiuMnyY+Xda2CBE5WZruq",
  26.         "Payload": {
  27.        ...

When you are done validating an image, you can specify that image in your Pod manifest by a digest value, for example：

  1. registry-url/image-name@sha256:c6d85e111e1ca4da234e87fb48f8ff170c918a0e6893d9ac9e888a4e7cc0056f

For more information, please refer to k8s image pull policy chapter how to specify the image summary to pull the image.

Use the admission controller to verify the image signature

The image verification process can also be implemented using the sigstore policy-controller controller during deployment. Here are some resources to help you get started with policy-controller:

SBOM

An SBOM, or Software Bill of Materials, is an inventory of all components within a software resource, such as third-party libraries or modules. It has emerged as a key building block in software security and supply chain risk management.

Starting with release v1.10.2, the SBOM for Karmada projects will be available in Karmada’s release Assets. Integrated with different tools, we can get the information on:

  • List of Components and Dependencies
  • Version Information
  • Licenses
  • Dependency Trees/Graphs

Below are two examples of using tools to parse karmada’s SBOM.

Prerequisites

You need to install the following tools:

And then, unzip sbom.tar.gz and get the SBOM in it.

  1. $ tar -zxvf sbom.tar.gz
  2. sbom-karmada.spdx

View the structure of the information contained in the SBOM

Using bom document outline, SBOM contents can be rendered to see how the information they contain is structured.

  1. $ bom document outline sbom-karmada.spdx
  2.                _      
  3.  ___ _ __   __| |_  __
  4. / __| '_ \ / _` \ \/ /
  5. \__ \ |_) | (_| |>  < 
  6. |___/ .__/ \__,_/_/\_\
  7.     |_|               
  9.  📂 SPDX Document /github/workspace
  10.   │ 
  11.   │ 📦 DESCRIBES 1 Packages
  12.   │ 
  13.   ├ /github/workspace
  14.   │  │ 🔗 2 Relationships
  15.   │  ├ CONTAINS PACKAGE go.mod
  16.   │  │  │ 🔗 1 Relationships
  17.   │  │  └ CONTAINS PACKAGE github.com/karmada-io/karmada
  18.   │  │  │  │ 🔗 186 Relationships
  19.   │  │  │  ├ DEPENDS_ON PACKAGE github.com/go-task/slim-sprig@0.0.0-20230315185526-52ccab3ef572
  20.   │  │  │  ├ DEPENDS_ON PACKAGE sigs.k8s.io/structured-merge-diff/v4@4.4.1
  21.   │  │  │  ├ DEPENDS_ON PACKAGE k8s.io/apimachinery@0.29.4
  22.   │  │  │  ├ DEPENDS_ON PACKAGE k8s.io/kube-openapi@0.0.0-20231010175941-2dd684a91f00
  23. ......

Scan SBOM for vulnerabilities

Trivy can take SBOM as an input and scan for vulnerabilities.

  1. $ trivy sbom sbom-karmada.spdx
  2. 2024-07-01T17:00:36+08:00       INFO    Need to update DB
  3. 2024-07-01T17:00:36+08:00       INFO    Downloading DB...       repository="ghcr.io/aquasecurity/trivy-db:2"
  4. 49.28 MiB / 49.28 MiB [-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 1.26 MiB p/s 39s
  5. 2024-07-01T17:01:17+08:00       INFO    Vulnerability scanning is enabled
  6. 2024-07-01T17:01:17+08:00       INFO    Detected SBOM format    format="spdx-tv"
  7. 2024-07-01T17:01:17+08:00       INFO    Number of language-specific files       num=3
  8. 2024-07-01T17:01:17+08:00       INFO    [gobinary] Detecting vulnerabilities...
  9. 2024-07-01T17:01:17+08:00       INFO    [gomod] Detecting vulnerabilities...
  10. 2024-07-01T17:01:17+08:00       INFO    [pip] Detecting vulnerabilities...

If the echo is as above, it shows that software components and dependencies in the Karmada project filesystem have no known security vulnerabilities. If you wish to ignore vulnerabilities that don’t have a fixed version, you can add --ignore-unfixed, e.g.

  1. $ trivy sbom sbom-karmada.spdx --ignore-unfixed

Verify artifacts with SLSA attestations

Prerequisites

You need to install the following tools:

CLI

A single attestation (karmada-cli.intoto.jsonl) from each release is provided since release 1.10.3. This can be used with slsa-verifier to verify that a CLI binary was generated using Karmada workflows on GitHub and ensures it was cryptographically signed.

  1. slsa-verifier verify-artifact karmadactl-darwin-arm64.tgz \
  2.   --provenance-path karmada-cli.intoto.jsonl \
  3.   --source-uri github.com/karmada-io/karmada \
  4.   --source-tag v1.10.3

If you only want to verify up to the major or minor version of the source repository tag (instead of the full tag), use the —source-versioned-tag, with which you can verify the semantic versions:

  1. slsa-verifier verify-artifact karmadactl-darwin-arm64.tgz \
  2.   --provenance-path karmada-cli.intoto.jsonl \
  3.   --source-uri github.com/karmada-io/karmada \
  4.   --source-tag v1 # You can use v1.10 for minor version verification

The payload is a non-forgeable provenance which is base64 encoded and can be viewed by passing the —print-provenance option to the commands above:

  1. slsa-verifier verify-artifact karmadactl-darwin-arm64.tgz \
  2.   --provenance-path karmada-cli.intoto.jsonl \
  3.   --source-uri github.com/karmada-io/karmada \
  4.   --source-tag v1.10.3 \
  5.   --print-provenance | jq

SBOM

A single attestation (karmada-sbom.intoto.jsonl) from each release is provided along with the sbom (sbom.tar.gz) since release 1.10.3. This can be used with slsa-verifier to verify that the SBOM was generated using Karmada workflows on GitHub and ensures it was cryptographically signed.

  1. slsa-verifier verify-artifact sbom.tar.gz \
  2.   --provenance-path karmada-sbom.intoto.jsonl \
  3.   --source-uri github.com/karmada-io/karmada \
  4.   --source-tag v1.10.3

Crds

A single attestation (karmada-crds.intoto.jsonl) from each release is provided along with the crds (crds.tar.gz) since release 1.10.3. This can be used with slsa-verifier to verify that the crds were generated using Karmada workflows on GitHub and ensures it was cryptographically signed.

  1. slsa-verifier verify-artifact crds.tar.gz \
  2.   --provenance-path karmada-crds.intoto.jsonl \
  3.   --source-uri github.com/karmada-io/karmada \
  4.   --source-tag v1.10.3

Charts

A single attestation (karmada-charts.intoto.jsonl) from each release is provided since release 1.10.3. This can be used with slsa-verifier to verify that the charts were generated using Karmada workflows on GitHub and ensures it was cryptographically signed.

  1. slsa-verifier verify-artifact karmada-chart-v1.10.3.tgz \
  2.   --provenance-path karmada-charts.intoto.jsonl \
  3.   --source-uri github.com/karmada-io/karmada \
  4.   --source-tag v1.10.3
  5. slsa-verifier verify-artifact karmada-operator-chart-v1.10.3.tgz \
  6.   --provenance-path karmada-charts.intoto.jsonl \
  7.   --source-uri github.com/karmada-io/karmada \
  8.   --source-tag v1.10.3