Knative Security and Disclosure Information

This page describes Knative security and disclosure information.

Knative threat model

Code Signature Verification

All platforms

Our releases from 1.9 are signed with cosign. You can use the following steps to verify our binaries.

  1. Download the files you want, and the checksums.txt, checksum.txt.pem and checksums.txt.sig files from the releases page:

    1. # this example verifies the 1.10.0 kn cli from the knative/client repository
    2. wget https://github.com/knative/client/releases/download/knative-v1.10.0/checksums.txt
    3. wget https://github.com/knative/client/releases/download/knative-v1.10.0/kn-darwin-amd64
    4. wget https://github.com/knative/client/releases/download/knative-v1.10.0/checksums.txt.sig
    5. wget https://github.com/knative/client/releases/download/knative-v1.10.0/checksums.txt.pem

  2. Verify the signature:

    1. cosign verify-blob \
    2. --certificate-identity=signer@knative-releases.iam.gserviceaccount.com \
    3. --certificate-oidc-issuer=https://accounts.google.com \
    4. --cert checksums.txt.pem \
    5. --signature checksums.txt.sig \
    6. checksums.txt

  3. If the signature is valid, you can then verify the SHA256 sums match with the downloaded binary:

    1. sha256sum --ignore-missing -c checksums.txt

Note

Knative images are signed in KEYLESS mode. To learn more about keyless signing, please refer to Keyless Signatures Our signing identity(Subject) for our releases is signer@knative-releases.iam.gserviceaccount.com and the Issuer is https://accounts.google.com

Apple macOS

In addition to signing our binaries with cosign, we notarize our macOS binaries. You can use the codesign utility to verify our binaries from 1.9 release. You should expect an output that looks like this. The expected TeamIdentifier is 7R64489VHL

  1. codesign --verify -d --verbose=2 ~/Downloads/kn-quickstart-darwin-amd64
  3. Executable=/Users/REDACTED/Downloads/kn-quickstart-darwin-amd64
  4. Identifier=kn-quickstart-darwin-amd64
  5. ...
  6. Authority=Developer ID Application: Mahamed Ali (7R64489VHL)
  7. Authority=Developer ID Certification Authority
  8. Authority=Apple Root CA
  9. Timestamp=3 Oct 2022 at 22:50:07
  10. ...
  11. TeamIdentifier=7R64489VHL

Report a vulnerability

We’re extremely grateful for security researchers and users that report vulnerabilities to the Knative Open Source Community. All reports are thoroughly investigated by a set of community volunteers.

To make a report, please email the private security@knative.team list with the security details and the details expected for all Knative bug reports.

When Should I Report a Vulnerability?

  • You think you discovered a potential security vulnerability in Knative
  • You are unsure how a vulnerability affects Knative
  • You think you discovered a vulnerability in another project that Knative depends on
    • For projects with their own vulnerability reporting and disclosure process, please report it directly there

When Should I NOT Report a Vulnerability?

  • You need help tuning Knative components for security
  • You need help applying security related updates
  • Your issue is not security related

Vulnerability response

Security working group