![16
{
"payloadType":"application/vnd.in-toto+json",
"payload": ´,
"signatures":[{"keyid":"OPK","sig": ´}]
}
{
"payload": ´,
"signatures": [
{"protected": ´, "header": {"sig_type":
"cic"}, "signature": ´},
{"protected": ´, "header": {"sig_type":
"oidc_gq"}, "signature": ´}
]
}
.signatures[0].sig
{
"jti": "66e345cc-0806-42a0-a346-7b98dc8ab2c0",
"sub": "repo:openpubkey/demo:ref:refs/heads/main",
"aud": "5km4t6i4IPk-tnv4qlmCcryfY0O-4PCNWOmFCJZJrzI",
"ref": "refs/heads/main",
"sha": "6b29027d7ddae1c2dcdcfb88ab402473af5d20c8",
"repository": "openpubkey/demo",
"repository_owner": "openpubkey",
"repository_owner_id": "145685596",
"run_id": "6628798402",
"repository_id": "698282570",
"iss": https://token.actions.githubusercontent.com
´,
}
.payload
{
"alg": "ES256",
"att": ´
"rz": ´,
"upk": {"alg": "ES256", "crv": "P-256",
"kty": "EC", "x": ´, "y": ´ }
}
{
"typ": "JWT",
"alg": "RS256",
"x5t": "AB3c0BSoSOiCRXez5POu2zvPX_0",
"kid": "001DDCD014A848E8824577B3E4F3AEDB3BCF5FFD"
}
.signatures[0].protected .signatures[1].protected
application/vnd.in-toto.provenance+dsse
(SLSA Provenance)
.payload](https://image.slidesharecdn.com/20231102dockerconhighlightjapaneseopenpubkey-231102173641-c7ae94d1/85/DockerCon-OpenPubKey-pdf-16-320.jpg)
![20241115 [KubeCon NA Pavilion] Lima.pdf_](https://cdn.slidesharecdn.com/ss_thumbnails/20241115kubeconnapavilionlima-241126155415-98be49e8-thumbnail.jpg?width=560&fit=bounds)
![20241113 [KubeCon NA Pavilion] containerd.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/20241113kubeconnapavilioncontainerd-241126154829-7a8fdf60-thumbnail.jpg?width=560&fit=bounds)
More Related Content
Similar to [DockerConハイライト] OpenPubKeyによるイメ`ジの俸兆と編^.pdf (20)
More from Akihiro Suda (20)
![20240415 [Container Plumbing Days] Usernetes Gen2 - Kubernetes in Rootless Do...](https://cdn.slidesharecdn.com/ss_thumbnails/20240415containerplumbingdaysusernetesgen2-kubernetesinrootlessdockerwithmultiplenodes-240415184952-ea0dfb7a-thumbnail.jpg?width=560&fit=bounds)
![20240321 [KubeCon EU Pavilion] Lima.pdf_](https://cdn.slidesharecdn.com/ss_thumbnails/20240321kubeconeupavilionlima-240408065915-d80bbad0-thumbnail.jpg?width=560&fit=bounds)
![20240320 [KubeCon EU Pavilion] containerd.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/20240320kubeconeupavilioncontainerd-240408065843-2d029142-thumbnail.jpg?width=560&fit=bounds)
![20240201 [HPC Containers] Rootless Containers.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/20240201hpccontainersrootlesscontainers-240408065736-d40a3c26-thumbnail.jpg?width=560&fit=bounds)
![[Podman Special Event] Kubernetes in Rootless Podman](https://cdn.slidesharecdn.com/ss_thumbnails/20231116podmanspecialeventkubernetesinrootlesspodman-231117201823-4feac1e3-thumbnail.jpg?width=560&fit=bounds)
![[KubeConNA2023] Lima pavilion](https://cdn.slidesharecdn.com/ss_thumbnails/20231107kubeconnapavilionlima-231117201753-89cc5ec6-thumbnail.jpg?width=560&fit=bounds)
![[KubeConNA2023] containerd pavilion](https://cdn.slidesharecdn.com/ss_thumbnails/20231107kubeconnapavilioncontainerd-231117201655-55ef4553-thumbnail.jpg?width=560&fit=bounds)
![[CNCF TAG-Runtime] Usernetes Gen2](https://cdn.slidesharecdn.com/ss_thumbnails/20231027cncftag-runtimeusernetesgen2-231102173536-1d53a112-thumbnail.jpg?width=560&fit=bounds)
![[DockerCon 2023] Reproducible builds with BuildKit for software supply chain ...](https://cdn.slidesharecdn.com/ss_thumbnails/20231005dockerconreproduciblebuildswithbuildkitforsoftwaresupplychainsecurity-231008180210-7ccc319e-thumbnail.jpg?width=560&fit=bounds)
![[KubeConEU2023] Lima pavilion](https://cdn.slidesharecdn.com/ss_thumbnails/kceu2023-pavilion-lima-230427150225-16054d2b-thumbnail.jpg?width=560&fit=bounds)
![[KubeConEU2023] containerd pavilion](https://cdn.slidesharecdn.com/ss_thumbnails/kceu2023-pavilion-containerd-230427150109-5e56d29a-thumbnail.jpg?width=560&fit=bounds)
![[Container Plumbing Days 2023] Why was nerdctl made?](https://cdn.slidesharecdn.com/ss_thumbnails/containerplumbing2023whywasnerdctlmade-230323115340-794fba85-thumbnail.jpg?width=560&fit=bounds)
![[FOSDEM2023] Bit-for-bit reproducible builds with Dockerfile](https://cdn.slidesharecdn.com/ss_thumbnails/fosdem2023bitforbitreproduciblebuildswithdockerfile-230210133322-31a74c01-thumbnail.jpg?width=560&fit=bounds)
![[CNCF TAG-Runtime 2022-10-06] Lima](https://cdn.slidesharecdn.com/ss_thumbnails/cncftag-runtime2022-10-06lima-221007111035-3bb96dd9-thumbnail.jpg?width=560&fit=bounds)
![[KubeCon EU 2022] Running containerd and k3s on macOS](https://cdn.slidesharecdn.com/ss_thumbnails/lima-220519142933-3d747f68-thumbnail.jpg?width=560&fit=bounds)
Recently uploaded (6)
[DockerConハイライト] OpenPubKeyによるイメ`ジの俸兆と編^.pdf
- 1. OpenPubKey によるイメ`ジの俸兆と編^ NTT ソフトウェアイノベ`ションセンタ ? 苻? DockerCon 2023 ハイライト (2023/11/2)
- 2. ? Moby (Docker Engineのupstream)、BuildKit、containerd、runc などの OSSのコミッタ ? 書定のDockerConでは ＾Reproducible builds with BuildKit for software supply chain security￣ にvして鞠 C https://medium.com/nttlabs/dockercon-2023-reproducible-builds-with-buildkit- for-software-supply-chain-security-0e5aedd1aaa7 ? 書?は??の函りMみについてではなく、 Docker芙?BastionZero 芙に よる OpenPubKey への函りMみについてB初 ? Reproducible builds にも OpenPubKey を?していきたいと房っている 2 ??B初
- 3. ? 2023/10/4: Demystify Secure Supply Chain Metadata C Christian Dupuis, Sr Principal Engineer, Docker ? 2023/10/5: Building the Software Supply Chain on Docker Official Images C Ethan Heilman, CTO & Co-Founder, BastionZero James Carnegie, Computer Programmer, Docker ? https://www.dockercon.com/ からまだ辛嬬 3 DockerCon での OpenPubKey vBセッション
- 4. 4 Linux Foundation プロジェクト晒のアナウンス https://www.linuxfoundation.org/press/announcing-openpubkey-project
- 5. ? OpenID Connect (OIDC) を?し、巷_I児Pとして聞えるようにしたもの ＾In essence, OpenPubkey is a protocol for getting OpenID Providers (OPs) to bind identities to public keys.￣ ( https://github.com/openpubkey/openpubkey ) ? 箭えば、GitHub Actions 貧でDockerイメ`ジをビルドするHに、GitHubリポジト リのorganization IDを根む俸兆を原紗できる ? GitHub Actions の Secrets に蜘畜Iをアップロ`ドしたりしなくてよい ? GitHub Actions 參翌の OpenID プロバイダ への鬉眸殯廖 プロバイダ箸任鮉Iは(圻t議に)音勣。 ? Sigstore の Cosign (keyless) に貌ているが、よりシンプルな撹 5 OpenPubKey
- 6. ? GitHub ActionsのYAML: https://github.com/openpubkey/demo ? BuildKit へのパッチ (隆マ`ジ): https://github.com/openpubkey/buildkit/tree/opk-signing ? docker verify コマンド: https://github.com/openpubkey/verify-docker-cli-plugin 6 DockerConでのOpenPubKeyのデモ
- 7. 7 GitHub Actions の YAML - name: Setup Docker buildx uses: docker/setup-buildx-action@v3.0.0 with: driver-opts: | image=openpubkey/buildkit:opk-signing env.ACTIONS_ID_TOKEN_REQUEST_URL=${{ env.ACTIONS_ID_TOKEN_REQUEST_URL }} env.ACTIONS_ID_TOKEN_REQUEST_TOKEN=${{ env.ACTIONS_ID_TOKEN_REQUEST_TOKEN }} - name: Build and push Docker image on push id: build-and-push uses: docker/build-push-action@v4.0.0 with: context: . push: true ´ sbom: true provenance: true ´ https://github.com/openpubkey/demo/blob/6b29027/.github/workflows/docker-build.yaml
- 8. 8 GitHub Actions の YAML - name: Setup Docker buildx uses: docker/setup-buildx-action@v3.0.0 with: driver-opts: | image=openpubkey/buildkit:opk-signing env.ACTIONS_ID_TOKEN_REQUEST_URL=${{ env.ACTIONS_ID_TOKEN_REQUEST_URL }} env.ACTIONS_ID_TOKEN_REQUEST_TOKEN=${{ env.ACTIONS_ID_TOKEN_REQUEST_TOKEN }} - name: Build and push Docker image on push id: build-and-push uses: docker/build-push-action@v4.0.0 with: context: . push: true ´ sbom: true provenance: true ´ https://github.com/openpubkey/demo/blob/6b29027/.github/workflows/docker-build.yaml GitHub により?啜弔穆O協される OIDCvBのh廠篳を BuildKit デ`モン に参イ気擦 OpenPubKeyに鬉靴 fork を峺協する https://github.com/openpubkey/buildkit SBOMおよびSLSA Provenance (ビルド秤) を イメ`ジに原紗する。 磴擦董SBOMやSLSA Provenance にする俸兆 (i.e., イメ`ジにする俸兆) も原紗する。
- 9. ? Docker CLI プラグインとして戻工 https://github.com/openpubkey/verify-docker-cli-plugin ? Docker Hub 貧のイメ`ジ ＾openpubkey/demo@sha256´￣ が、GitHub organization ＾openpubkey￣ の GitHub Actions でビルドされたことを_J できた ? ただし、GitHub Actions のキ`セット (https://token.actions.githubusercontent.com/.well-known/jwks) を佚mで きる念戻 9 docker verify コマンド $ gh api /orgs/openpubkey | jq .id 145685596 $ docker verify openpubkey/demo@sha256:6acf54fca0e7f9e9ef3d23c9b9ee306ce3c56b8315aa756643e4df25032bcdbe --repo-owner-id 145685596 ´ Verified all required attestations are present
- 10. 10 docker verify コマンド (竃?畠悶) $ docker verify openpubkey/demo@sha256:6acf54fca0e7f9e9ef3d23c9b9ee306ce3c56b8315aa756643e4df25032bcdbe --repo-owner-id 145685596 Verifying 2 attestations for pkg:docker/openpubkey/demo?digest=sha256:6acf54fca0e7f9e9ef3d23c9b9ee306ce3c56b8315aa756643e4df25032bcdbe&platform =linux/amd64 Verifying https://spdx.dev/Document attestation ? Verified attestation refers to digest sha256:6fbb78f2482a527575558d85147aee5f5f9f5288133bb0af316f91ed525a7246 ? Verified OIDC token was signed by https://token.actions.githubusercontent.com ? Verified attestation digest was signed on a Github Actions run: https://github.com/openpubkey/demo/actions/runs/6628798402 ? Verified repository owner 145685596 (openpubkey) Verifying https://slsa.dev/provenance/v0.2 attestation ? Verified attestation refers to digest sha256:6fbb78f2482a527575558d85147aee5f5f9f5288133bb0af316f91ed525a7246 ? Verified OIDC token was signed by https://token.actions.githubusercontent.com ? Verified attestation digest was signed on a Github Actions run: https://github.com/openpubkey/demo/actions/runs/6628798402 ? Verified repository owner 145685596 (openpubkey) ? Verified signed git sha provenance 6b29027d7ddae1c2dcdcfb88ab402473af5d20c8 ? Verified signed git repo provenance openpubkey/demo Verified all required attestations are present
- 11. 11 フロ` (1/2) BuildKit (OpenPubKey鬦) GitHub Actions $ACTIONS_ID_TOKEN_REQUEST_TOKEN $ACTIONS_ID_TOKEN_REQUEST_URL HTTP GET $ACTIONS_ID_TOKEN_REQUEST_URL &audience=$AUDIENCE ＾Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN￣ ? ID Token をk?するための Bearer Token をk? ? イメ`ジをビルドし、 provenanceを?撹 ? ?指泙蠅嶺Iペアを?撹 ? Client-Instance Claim (CIC) を ?撹 {｀rz¨: random(), ｀upk¨: publicKey, ｀alg¨: ｀EC256¨, ｀att¨: provenenceHash} ? CIC のハッシュを ＾audience￣ としてID Tokenのk?を勣箔 ☆CIC のハッシュは、GitHub Actions などの workload identity では audience に根めるが、user identity では nonce に根める。 audience (GHAのデフォルトでは リポジトリ のURL) には販吭の?忖双をいれてよいので OIDCのAPIを筝せずにCICのハッシュを僕る ことができる
- 12. 12 フロ` (2/2) BuildKit (OpenPubKey鬦) GitHub Actions ID Token: ＾SUBSTR0.SUBSTR1.SUBSTR2￣ ? SUBSTR0: ヘッダ の base64 ? SUBSTR1: ペイロ`ドの base64 (＾aud￣ などを根む) ? SUBSTR2: ￣SUBST0.SUBST1￣ にする 俸兆 ? 鞭け函った Bearer Token が 栽っていれば、ID Token をk ?する ? ID Tokenの麼なペイロ`ド: ? ＾aud￣ (audience) ? ＾repository_owner_id￣ (GitHubのorgのID) ? ＾run_id￣ (GHAのjobの g?ID) ? ID Tokenは、GHA??が隔っ ているIで俸兆される ? ?隔ちのCICと、GHAから鞭 け函ったID TokenとをMみ栽 わせ、俸兆し、 PK Token を 撹する。これをイメ`ジに 原紗する。 ? Guillou-Quisquater (GQ) 俸兆 により、圷のID Tokenの､ L盈される (ペイロ`ドの 何蛍は巷_される) (念) CIC: Client-Instance Claim: {｀rz¨: random(), ｀upk¨: publicKey, ｀alg¨: ｀EC256, ｀att¨: provenanceHash} audience: ここでは CICのハッシュ ID Token がIペアに~づく ☆GQ俸兆はworkload identityでは駅、user identity では販吭 GHAの栽はペイロ`ドが巷_されて}ないが、 麿のOpenIDプロバイダでは篇が駅勣そう
- 16. 16 { "payloadType":"application/vnd.in-toto+json", "payload": ´, "signatures":[{"keyid":"OPK","sig": ´}] } { "payload": ´, "signatures": [ {"protected": ´, "header": {"sig_type": "cic"}, "signature": ´}, {"protected": ´, "header": {"sig_type": "oidc_gq"}, "signature": ´} ] } .signatures[0].sig { "jti": "66e345cc-0806-42a0-a346-7b98dc8ab2c0", "sub": "repo:openpubkey/demo:ref:refs/heads/main", "aud": "5km4t6i4IPk-tnv4qlmCcryfY0O-4PCNWOmFCJZJrzI", "ref": "refs/heads/main", "sha": "6b29027d7ddae1c2dcdcfb88ab402473af5d20c8", "repository": "openpubkey/demo", "repository_owner": "openpubkey", "repository_owner_id": "145685596", "run_id": "6628798402", "repository_id": "698282570", "iss": https://token.actions.githubusercontent.com ´, } .payload { "alg": "ES256", "att": ´ "rz": ´, "upk": {"alg": "ES256", "crv": "P-256", "kty": "EC", "x": ´, "y": ´ } } { "typ": "JWT", "alg": "RS256", "x5t": "AB3c0BSoSOiCRXez5POu2zvPX_0", "kid": "001DDCD014A848E8824577B3E4F3AEDB3BCF5FFD" } .signatures[0].protected .signatures[1].protected application/vnd.in-toto.provenance+dsse (SLSA Provenance) .payload
- 17. ? OpenID Connect (OIDC) を?し、巷_I児Pとして聞えるようにしたもの ＾In essence, OpenPubkey is a protocol for getting OpenID Providers (OPs) to bind identities to public keys.￣ ( https://github.com/openpubkey/openpubkey ) ? 箭えば、GitHub Actions 貧でDockerイメ`ジをビルドするHに、GitHubリポジトリの organization IDを根む俸兆を原紗できる ? GitHub Actions の Secrets に蜘畜Iをアップロ`ドしたりしなくてよい ? GitHub Actions 參翌の OpenID プロバイダ への鬉眸殯廖 プロバイダ箸任鮉Iは(圻t議に)音勣。 ? Sigstore の Cosign (keyless) に貌ているが、よりシンプルな撹 17 まとめ (壅) スライド: https://github.com/AkihiroSuda (＾Presentation slides￣ ★ ＾2023￣ ★ ＾20231102 ´￣)