2

I am trying to verify container images using Cosign.

Let's use the image csi-node-driver-registrar as an example. (the image doesn't matter as long as it is signed by the author)

I tried the following CLI command and it successfully verified the image:

cosign verify registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.3 --certificate-identity [email protected] --certificate-oidc-issuer https://accounts.google.com

However, I got the working values for "certificate-identity" and "certificate-oidc-issuer" by running the command with random wrong values. (so I saw the correct values in the error message) This is like a joke, isn't it?

So I really need some explanations about the following points:

  • How does Cosign sign and verify images in the "keyless" mode?

I read the official document but it completely lost me. I understand the basic concept about signature (the private key encrypted hash code of the original data) and the verification (decrypt by the public key and compare the 2 pieces of hash code).

  • How do I find the correct "certificate-identity" and "certificate-oidc-issuer" in case the image is not created/signed by me?

Many thanks!! I spent much time on Googling without any luck.

2 Answers 2

3

Thanks @Zhou ! Looks good. At the time of writing this response, Cosign version v2.4.0, I had to use :

cosign verify --certificate-identity-regexp '.*' --certificate-oidc-issuer-regexp '.*' $image

where $image is your image id like niceimagename@sh256:1234567. And if you want to target specifics values, you could use for example :

cosign verify --certificate-identity-regexp '.*' --certificate-oidc-issuer-regexp '.*' $image | jq -r '.[].optional| .Issuer, .Subject'
2
  • A few days after I posted the answer, I noticed that some images in some public registries have the "certificate-identity" and "certificate-oidc-issuer" on their description pages, but not all of them have it, so yeah, using the "-regexp .*" to walk around it is a quick&dirty solution.
    – Zhou
    Commented Sep 2, 2024 at 19:01
  • @Zhou could you post any examples where you saw those descriptions?
    – Mendhak
    Commented Nov 2, 2024 at 19:20
2

After a few hours searching, reading, and guessing, now I try to answer my own question.

When an image was signed by Cosign in the "keyless" mode, the private key in Fulcio's "root trust" bundle was used to create the signature, so the corresponding public key should also be used for the verification.

In other words, regarding signature creation, "keyless" doesn't mean no key is used. It just means users aren't required to provide a key --- an "official" private key will be used instead.

Based on the above, to verify such image signatures, Cosign will also request the private key from Fulcio. However, when creating the signature, some extra information is also added in as well as the hash code, so when verifying the signature, the extra information can also be verified as an additional layer of security.

The extra information is the so-called "certificate identity" and "certificate oidc issuer". When Cosign is signing an image that is stored in a container registry, it expects the container registry to be an "IDP", from which it retrieves an ID Token providing the user can successfully logon to the container registry (The "cosign sign" command will open a web browser window and take you to the logon page of the container registry).

After that, Cosign extracts the "id" claim from the ID Token, and save it along with the "IPD"'s URL into the signature.

The verification process will compare the saved "id" with the one you specified through the "certificate-identity" argument to make sure the image comes from the expected author. You can use "--certificate-identity-regexp '.*'" to walk around this check, but of course it's insecure to do so.

Anyone please correct me if I'm wrong. Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.