CCv0: Refactor signature verification PoC changes

Removes signature verficiation files and related code

Fixes: #4111

Signed-off-by: Georgina Kinge <Georgina.Kinge@ibm.com>
Co-authored-by: Megan Wright <megan.wright@ibm.com>

docs/how-to/ccv0.sh

@@ -86,6 +86,7 @@ Commands:
 - build_qemu:                       Checkout, patch, build and install QEMU
 - configure:                        Configure Kata to use rootfs and enable debug
 - connect_to_ssh_demo_pod:          Ssh into the ssh demo pod, showing that the decryption succeeded
+- copy_files_to_guest               Copies signature verification files to guest
 - create_rootfs:                    Create a local rootfs
 - crictl_create_cc_container        Use crictl to create a new busybox container in the kata cc pod
 - crictl_create_cc_pod              Use crictl to create a new kata cc pod
@@ -532,6 +533,10 @@ shim_pull_image() {
     ${ctr_shim_command}
 }
 
+call_copy_files_to_guest() {
+    copy_files_to_guest
+}
+
 main() {
     while getopts "dh" opt; do
         case "$opt" in
@@ -641,6 +646,9 @@ main() {
         agent_create_container)
             agent_create_container
             ;;
+        copy_files_to_guest)
+            call_copy_files_to_guest
+            ;;
         *)
             usage 1
             ;;

docs/how-to/how-to-build-and-test-ccv0.md

@@ -312,9 +312,9 @@ In our test repository there are three tagged images:
 
 | Test Image | Base Image used | Signature status | GPG key status |
 | --- | --- | --- | --- |
-| `quay.io/kata-containers/confidential-containers:signed` | `busybox:1.33.1` | [signature](./../../tools/osbuilder/rootfs-builder/signed-container-artifacts/signatures.tar) embedded in kata rootfs |  [public key](./../../tools/osbuilder/rootfs-builder/signed-container-artifacts/public.gpg) embedded in kata rootfs |
+| `quay.io/kata-containers/confidential-containers:signed` | `busybox:1.33.1` | [signature](https://github.com/kata-containers/tests/tree/CCv0/integration/confidential/fixtures/quay_verification/signatures.tar) embedded in kata rootfs |  [public key](https://github.com/kata-containers/tests/tree/CCv0/integration/confidential/fixtures/quay_verification/public.gpg) embedded in kata rootfs |
 | `quay.io/kata-containers/confidential-containers:unsigned` | `busybox:1.33.1` | not signed | not signed |
-| `quay.io/kata-containers/confidential-containers:other_signed` | `nginx:1.21.3` | [signature](./../../tools/osbuilder/rootfs-builder/signed-container-artifacts/signatures.tar) embedded in kata rootfs | GPG key not kept |
+| `quay.io/kata-containers/confidential-containers:other_signed` | `nginx:1.21.3` | [signature](https://github.com/kata-containers/tests/tree/CCv0/integration/confidential/fixtures/quay_verification/signatures.tar) embedded in kata rootfs | GPG key not kept |
 
 Using a standard unsigned `busybox` image that can be pulled from another, *unprotected*, `quay.io` repository we can
 test a few scenarios.
@@ -333,9 +333,14 @@ to create containers from these images using `crictl`:
 the guest agent code has been implemented, the Kata confidential-containers build needs to be run with 
 `export SKOPEO=yes` as documented [above](#basic-script-set-up-and-optional-environment-variables) in order to use the
 image signature verification function.
+
 - If you don't already have a Kata sandbox pod created with `crictl`, then follow the 
 [instructions above](#using-crictl-for-end-to-end-provisioning-of-a-kata-confidential-containers-pod-with-an-unencrypted-image)
 up to, and including, the `~/ccv0.sh crictl_create_cc_pod` command.
+
+- In order to enable the guest image, you will need to copy over the policy and signature files needed by running 
+`~/ccv0.sh copy_files_to_guest`and then re-running `~/ccv0.sh crictl_create_cc_pod` which will delete and recreate 
+your pod - adding in the new files.
  
 - To test the fallback behaviour works using an unsigned image from an *unprotected* registry we can pull the `busybox`
 image by running:

tools/osbuilder/rootfs-builder/README.md

@@ -191,6 +191,5 @@ needed. Changes affect the files included in the final guest image.
 #### Confidential containers support
 
 When building the rootfs for confidential containers if `SKOPEO=yes` is set then the `skopeo`
-package is built and added into the rootfs. It also adds the signature verification proof of concept files.
+package is built and added into the rootfs.
-If `UMOCI=yes` is set then the `umoci` package is built and added into the rootfs.
+If `UMOCI=yes` is set then the `umoci` package is built and added into the rootfs.
-For more info on these, see [the documentation](signed-container-artifacts/README.md).

tools/osbuilder/rootfs-builder/rootfs.sh

@@ -639,23 +639,6 @@ EOF
 		make bin/skopeo
 		install -o root -g root -m 0755 bin/skopeo "${ROOTFS_DIR}/usr/bin/"
 		popd
-
-		# Temp PoC code: Add image signature verification artifacts into rootfs
-		rootfs_quay_verification_directory="/etc/containers/quay_verification"
-		dev_verification_directory="${script_dir}/signed-container-artifacts"
-		mkdir -p "${ROOTFS_DIR}${rootfs_quay_verification_directory}/signatures"
-		install -o root -g root -m 0644 "${dev_verification_directory}/public.gpg" "${ROOTFS_DIR}${rootfs_quay_verification_directory}/public.gpg"
-		install -o root -g root -m 0644 "${dev_verification_directory}/quay_policy.json" "${ROOTFS_DIR}${rootfs_quay_verification_directory}/quay_policy.json"
-		tar -zvxf "${dev_verification_directory}/signatures.tar" -C "${ROOTFS_DIR}${rootfs_quay_verification_directory}/signatures"
-
-		container_registries_dir="${ROOTFS_DIR}/etc/containers/registries.d"
-		mkdir -p ${container_registries_dir}
-	cat << EOF | tee ${container_registries_dir}/quay.io.yaml
-docker:
-    quay.io/kata-containers/confidential-containers:
-        sigstore: file://${rootfs_quay_verification_directory}/signatures
-        sigstore-staging: file://${rootfs_quay_verification_directory}/signatures
-EOF
 	fi
 
     if [ -n "${AA_KBC}" ]; then

tools/osbuilder/rootfs-builder/signed-container-artifacts/README.md

@@ -1,14 +0,0 @@
-### Description
-
-This directory provides some artifacts required for implementing and testing the kata-agent's ability to verify the signatures of container images pulled from the test `quay.io/kata-containers/confidential-containers` repository.
-
-### Contents
-
-It consists of:
-- `signatures.tar` - a tar archive containing the signatures of `quay.io/kata-containers/confidential-containers:signed` and `quay.io/kata-containers/confidential-containers:other_signed`
-- `public.gpg` - the public GPG key, paired to the private key pair that was used to sign `quay.io/kata-containers/confidential-containers:signed`
-- `quay_policy.json` - a container policy file that allows insecure access to all repos except `quay.io/kata-containers`, in which it enforced signatures by the above key
-
-### Usage
-
-As part of the Confidential Containers v0 proof of concept these files will be built into the kata image and used for the purposes of testing verification of signed images see [Issue #2682](https://github.com/kata-containers/kata-containers/issues/2682). They are intended to be temporary whilst a better solution is found to pass them in, probably based on the attestation agent.

tools/osbuilder/rootfs-builder/signed-container-artifacts/public.gpg

@@ -1,30 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGFMVEgBEACzd/HJz6nq8GAjFoWt20PhAy4Rp8q4qeFE3JJ+lwhPzkJdbL3Z
-QJ31TECrbKUyo3LIQ31B75AYw3vnEIUOcutSE1i8o557IoxxlG4SwtkRVdUPeE7e
-tIN2mZ+2GwngAmJEH15kMAFsUQa4n+XOVQOZI3QYelYjLwKamqAkwEv03JjGi2+m
-4kFHO0f3/esJfexUwxK0wPk2xziogaiO3z45bNJ106pH/y4hQ0pVmfIHzOV6pDsv
-UGq1qvve/gCEqYef/qH272hFGMLMjG/29+pVfulBvbzbQHMPyHi1Au5pzbVUHq9A
-9DhYxfZYi7c+yu9cXtrx3BiWHnv79AEKVd8BvEnpM6tcH9c/TRejGzV1tq8okNp3
-WizzOFsUpiiuXUZ9fUeCK9buDiwlt1vdd68nQgz6bGH8FjmWvQu8y3UdFQI50BCU
-eDxVDpr3Exc4Dz1lgSJMWL2kcIG/0VYFShdEu1/ig6gKRZFrmW7hgINuWVpYChdi
-+B7FH5P8FRPb7F+dWrcJ73p5YrK38GnzZu3mvfRRy9CAiSSE4ZDwBn233H+e0QsX
-mOiHqmKIVSnxUkXhNKWZoKP5PFPGXOXHAMidgX/0OE18G6ZdD0F/ESnaWT/ip73M
-MDaNmTCe/bYuoSg/hUGB0KD5LvhVZOMai8u2F0BrEagOFt7JFcmEpwjWZwARAQAB
-tElTdGV2ZW4gSG9yc21hbiAoR1BHIGtleSBmb3Igc2lnbmluZyBrYXRhIHRlc3Qg
-aW1hZ2VzKSA8c3RldmVuQHVrLmlibS5jb20+iQJYBBMBCABCFiEEZ7JKrMRZZ54C
-g9fuWPbtB+6mtCkFAmFMVEgCGwMFCQHhM4AFCwkIBwIDIgIBBhUKCQgLAgQWAgMB
-Ah4HAheAAAoJEFj27QfuprQpsvAP/3N+yDdeFDLiWRKmXlHsmdnOweaWqB7sQbtI
-ILXzEQBcZHZ1Q5LgkJ6o9GRRe+JOValAD9AwOB88gHMUZmGhfAM9vv7GtVXgiBCf
-/f414M1ny/q1H0dmpFqxoqZc9W6XZSZET/25QORS3bLH+GEvt8zvZRAKUOVEHOe4
-lthrcncmnhWxeg4dRFXFQs2YIn5W6b97xK3xzatl9rMX0wk8/lpx9GCKKjVw9ZPs
-TgndriLNu3hbNyaWhHeLqTOXD9E4YCc3qLsC/enGrXzJ/umgihu/G/b5alefzSOq
-xt0r6z7RnO99rUtKCam+5EDkKzUvhjgR3j2LkGZC1fqANt6LKO+C0Oqm0JT2mTda
-ta/x7Btj36KIb3uNSRt2bDrFYxOj6sFyPVTUlzNgitnK3TqIxnmyiGdhOUG2sZy8
-0I1Z4vZOBFw23XOjc4TTdVSoAmLRfHNyfmayGm/ckleN5vOlbW9O9tDkC4jZ6ZFM
-1qg12RLoKWqEthvis9XsWLbxAAhm1nFJWEiNXsumMP74SW0//jbdEOLNo0WDnSNb
-gu6khUarHGGiPBsxW8qDFusHXZe0JCIQQQ0CeXwOZ0iqH4/mCIJByHwgDtLgnsTM
-6khgSea1y5ktQBvRuMP889ebPHJ261jyIy9uy+nhiKypoO+yj1f/Rnj5kKKv72nK
-5uESpJBT
-=B7vQ
------END PGP PUBLIC KEY BLOCK-----

tools/osbuilder/rootfs-builder/signed-container-artifacts/quay_policy.json

@@ -1,18 +0,0 @@
-{
-    "default": [
-        {
-            "type": "insecureAcceptAnything"
-        }
-    ],
-    "transports": {
-        "docker": {
-            "quay.io/kata-containers": [
-                {
-                    "type": "signedBy",
-                    "keyType": "GPGKeys",
-                    "keyPath": "/etc/containers/quay_verification/public.gpg"
-                }
-            ]
-        }
-    }
-}