mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-08-19 08:28:19 +00:00
CCv0: Refactor signature verification PoC changes
Removes signature verficiation files and related code Fixes: #4111 Signed-off-by: Georgina Kinge <Georgina.Kinge@ibm.com> Co-authored-by: Megan Wright <megan.wright@ibm.com>
This commit is contained in:
Georgina Kinge
parent
b08ea1fd99
commit
a1e16ff6e0
@ -86,6 +86,7 @@ Commands:
|
||||
- build_qemu: Checkout, patch, build and install QEMU
|
||||
- configure: Configure Kata to use rootfs and enable debug
|
||||
- connect_to_ssh_demo_pod: Ssh into the ssh demo pod, showing that the decryption succeeded
|
||||
- copy_files_to_guest Copies signature verification files to guest
|
||||
- create_rootfs: Create a local rootfs
|
||||
- crictl_create_cc_container Use crictl to create a new busybox container in the kata cc pod
|
||||
- crictl_create_cc_pod Use crictl to create a new kata cc pod
|
||||
@ -532,6 +533,10 @@ shim_pull_image() {
|
||||
${ctr_shim_command}
|
||||
}
|
||||
|
||||
call_copy_files_to_guest() {
|
||||
copy_files_to_guest
|
||||
}
|
||||
|
||||
main() {
|
||||
while getopts "dh" opt; do
|
||||
case "$opt" in
|
||||
@ -641,6 +646,9 @@ main() {
|
||||
agent_create_container)
|
||||
agent_create_container
|
||||
;;
|
||||
copy_files_to_guest)
|
||||
call_copy_files_to_guest
|
||||
;;
|
||||
*)
|
||||
usage 1
|
||||
;;
|
||||
|
||||
@ -312,9 +312,9 @@ In our test repository there are three tagged images:
|
||||
|
||||
| Test Image | Base Image used | Signature status | GPG key status |
|
||||
| --- | --- | --- | --- |
|
||||
| `quay.io/kata-containers/confidential-containers:signed` | `busybox:1.33.1` | [signature](./../../tools/osbuilder/rootfs-builder/signed-container-artifacts/signatures.tar) embedded in kata rootfs | [public key](./../../tools/osbuilder/rootfs-builder/signed-container-artifacts/public.gpg) embedded in kata rootfs |
|
||||
| `quay.io/kata-containers/confidential-containers:signed` | `busybox:1.33.1` | [signature](https://github.com/kata-containers/tests/tree/CCv0/integration/confidential/fixtures/quay_verification/signatures.tar) embedded in kata rootfs | [public key](https://github.com/kata-containers/tests/tree/CCv0/integration/confidential/fixtures/quay_verification/public.gpg) embedded in kata rootfs |
|
||||
| `quay.io/kata-containers/confidential-containers:unsigned` | `busybox:1.33.1` | not signed | not signed |
|
||||
| `quay.io/kata-containers/confidential-containers:other_signed` | `nginx:1.21.3` | [signature](./../../tools/osbuilder/rootfs-builder/signed-container-artifacts/signatures.tar) embedded in kata rootfs | GPG key not kept |
|
||||
| `quay.io/kata-containers/confidential-containers:other_signed` | `nginx:1.21.3` | [signature](https://github.com/kata-containers/tests/tree/CCv0/integration/confidential/fixtures/quay_verification/signatures.tar) embedded in kata rootfs | GPG key not kept |
|
||||
|
||||
Using a standard unsigned `busybox` image that can be pulled from another, *unprotected*, `quay.io` repository we can
|
||||
test a few scenarios.
|
||||
@ -333,9 +333,14 @@ to create containers from these images using `crictl`:
|
||||
the guest agent code has been implemented, the Kata confidential-containers build needs to be run with
|
||||
`export SKOPEO=yes` as documented [above](#basic-script-set-up-and-optional-environment-variables) in order to use the
|
||||
image signature verification function.
|
||||
|
||||
- If you don't already have a Kata sandbox pod created with `crictl`, then follow the
|
||||
[instructions above](#using-crictl-for-end-to-end-provisioning-of-a-kata-confidential-containers-pod-with-an-unencrypted-image)
|
||||
up to, and including, the `~/ccv0.sh crictl_create_cc_pod` command.
|
||||
|
||||
- In order to enable the guest image, you will need to copy over the policy and signature files needed by running
|
||||
`~/ccv0.sh copy_files_to_guest`and then re-running `~/ccv0.sh crictl_create_cc_pod` which will delete and recreate
|
||||
your pod - adding in the new files.
|
||||
|
||||
- To test the fallback behaviour works using an unsigned image from an *unprotected* registry we can pull the `busybox`
|
||||
image by running:
|
||||
|
||||
@ -191,6 +191,5 @@ needed. Changes affect the files included in the final guest image.
|
||||
#### Confidential containers support
|
||||
|
||||
When building the rootfs for confidential containers if `SKOPEO=yes` is set then the `skopeo`
|
||||
package is built and added into the rootfs. It also adds the signature verification proof of concept files.
|
||||
If `UMOCI=yes` is set then the `umoci` package is built and added into the rootfs.
|
||||
For more info on these, see [the documentation](signed-container-artifacts/README.md).
|
||||
package is built and added into the rootfs.
|
||||
If `UMOCI=yes` is set then the `umoci` package is built and added into the rootfs.
|
||||
@ -639,23 +639,6 @@ EOF
|
||||
make bin/skopeo
|
||||
install -o root -g root -m 0755 bin/skopeo "${ROOTFS_DIR}/usr/bin/"
|
||||
popd
|
||||
|
||||
# Temp PoC code: Add image signature verification artifacts into rootfs
|
||||
rootfs_quay_verification_directory="/etc/containers/quay_verification"
|
||||
dev_verification_directory="${script_dir}/signed-container-artifacts"
|
||||
mkdir -p "${ROOTFS_DIR}${rootfs_quay_verification_directory}/signatures"
|
||||
install -o root -g root -m 0644 "${dev_verification_directory}/public.gpg" "${ROOTFS_DIR}${rootfs_quay_verification_directory}/public.gpg"
|
||||
install -o root -g root -m 0644 "${dev_verification_directory}/quay_policy.json" "${ROOTFS_DIR}${rootfs_quay_verification_directory}/quay_policy.json"
|
||||
tar -zvxf "${dev_verification_directory}/signatures.tar" -C "${ROOTFS_DIR}${rootfs_quay_verification_directory}/signatures"
|
||||
|
||||
container_registries_dir="${ROOTFS_DIR}/etc/containers/registries.d"
|
||||
mkdir -p ${container_registries_dir}
|
||||
cat << EOF | tee ${container_registries_dir}/quay.io.yaml
|
||||
docker:
|
||||
quay.io/kata-containers/confidential-containers:
|
||||
sigstore: file://${rootfs_quay_verification_directory}/signatures
|
||||
sigstore-staging: file://${rootfs_quay_verification_directory}/signatures
|
||||
EOF
|
||||
fi
|
||||
|
||||
if [ -n "${AA_KBC}" ]; then
|
||||
|
||||
@ -1,14 +0,0 @@
|
||||
### Description
|
||||
|
||||
This directory provides some artifacts required for implementing and testing the kata-agent's ability to verify the signatures of container images pulled from the test `quay.io/kata-containers/confidential-containers` repository.
|
||||
|
||||
### Contents
|
||||
|
||||
It consists of:
|
||||
- `signatures.tar` - a tar archive containing the signatures of `quay.io/kata-containers/confidential-containers:signed` and `quay.io/kata-containers/confidential-containers:other_signed`
|
||||
- `public.gpg` - the public GPG key, paired to the private key pair that was used to sign `quay.io/kata-containers/confidential-containers:signed`
|
||||
- `quay_policy.json` - a container policy file that allows insecure access to all repos except `quay.io/kata-containers`, in which it enforced signatures by the above key
|
||||
|
||||
### Usage
|
||||
|
||||
As part of the Confidential Containers v0 proof of concept these files will be built into the kata image and used for the purposes of testing verification of signed images see [Issue #2682](https://github.com/kata-containers/kata-containers/issues/2682). They are intended to be temporary whilst a better solution is found to pass them in, probably based on the attestation agent.
|
||||
@ -1,30 +0,0 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBGFMVEgBEACzd/HJz6nq8GAjFoWt20PhAy4Rp8q4qeFE3JJ+lwhPzkJdbL3Z
|
||||
QJ31TECrbKUyo3LIQ31B75AYw3vnEIUOcutSE1i8o557IoxxlG4SwtkRVdUPeE7e
|
||||
tIN2mZ+2GwngAmJEH15kMAFsUQa4n+XOVQOZI3QYelYjLwKamqAkwEv03JjGi2+m
|
||||
4kFHO0f3/esJfexUwxK0wPk2xziogaiO3z45bNJ106pH/y4hQ0pVmfIHzOV6pDsv
|
||||
UGq1qvve/gCEqYef/qH272hFGMLMjG/29+pVfulBvbzbQHMPyHi1Au5pzbVUHq9A
|
||||
9DhYxfZYi7c+yu9cXtrx3BiWHnv79AEKVd8BvEnpM6tcH9c/TRejGzV1tq8okNp3
|
||||
WizzOFsUpiiuXUZ9fUeCK9buDiwlt1vdd68nQgz6bGH8FjmWvQu8y3UdFQI50BCU
|
||||
eDxVDpr3Exc4Dz1lgSJMWL2kcIG/0VYFShdEu1/ig6gKRZFrmW7hgINuWVpYChdi
|
||||
+B7FH5P8FRPb7F+dWrcJ73p5YrK38GnzZu3mvfRRy9CAiSSE4ZDwBn233H+e0QsX
|
||||
mOiHqmKIVSnxUkXhNKWZoKP5PFPGXOXHAMidgX/0OE18G6ZdD0F/ESnaWT/ip73M
|
||||
MDaNmTCe/bYuoSg/hUGB0KD5LvhVZOMai8u2F0BrEagOFt7JFcmEpwjWZwARAQAB
|
||||
tElTdGV2ZW4gSG9yc21hbiAoR1BHIGtleSBmb3Igc2lnbmluZyBrYXRhIHRlc3Qg
|
||||
aW1hZ2VzKSA8c3RldmVuQHVrLmlibS5jb20+iQJYBBMBCABCFiEEZ7JKrMRZZ54C
|
||||
g9fuWPbtB+6mtCkFAmFMVEgCGwMFCQHhM4AFCwkIBwIDIgIBBhUKCQgLAgQWAgMB
|
||||
Ah4HAheAAAoJEFj27QfuprQpsvAP/3N+yDdeFDLiWRKmXlHsmdnOweaWqB7sQbtI
|
||||
ILXzEQBcZHZ1Q5LgkJ6o9GRRe+JOValAD9AwOB88gHMUZmGhfAM9vv7GtVXgiBCf
|
||||
/f414M1ny/q1H0dmpFqxoqZc9W6XZSZET/25QORS3bLH+GEvt8zvZRAKUOVEHOe4
|
||||
lthrcncmnhWxeg4dRFXFQs2YIn5W6b97xK3xzatl9rMX0wk8/lpx9GCKKjVw9ZPs
|
||||
TgndriLNu3hbNyaWhHeLqTOXD9E4YCc3qLsC/enGrXzJ/umgihu/G/b5alefzSOq
|
||||
xt0r6z7RnO99rUtKCam+5EDkKzUvhjgR3j2LkGZC1fqANt6LKO+C0Oqm0JT2mTda
|
||||
ta/x7Btj36KIb3uNSRt2bDrFYxOj6sFyPVTUlzNgitnK3TqIxnmyiGdhOUG2sZy8
|
||||
0I1Z4vZOBFw23XOjc4TTdVSoAmLRfHNyfmayGm/ckleN5vOlbW9O9tDkC4jZ6ZFM
|
||||
1qg12RLoKWqEthvis9XsWLbxAAhm1nFJWEiNXsumMP74SW0//jbdEOLNo0WDnSNb
|
||||
gu6khUarHGGiPBsxW8qDFusHXZe0JCIQQQ0CeXwOZ0iqH4/mCIJByHwgDtLgnsTM
|
||||
6khgSea1y5ktQBvRuMP889ebPHJ261jyIy9uy+nhiKypoO+yj1f/Rnj5kKKv72nK
|
||||
5uESpJBT
|
||||
=B7vQ
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
@ -1,18 +0,0 @@
|
||||
{
|
||||
"default": [
|
||||
{
|
||||
"type": "insecureAcceptAnything"
|
||||
}
|
||||
],
|
||||
"transports": {
|
||||
"docker": {
|
||||
"quay.io/kata-containers": [
|
||||
{
|
||||
"type": "signedBy",
|
||||
"keyType": "GPGKeys",
|
||||
"keyPath": "/etc/containers/quay_verification/public.gpg"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
Binary file not shown.
Loading…
Reference in New Issue
Block a user