Wednesday, October 5, 2022
HomeCyber SecurityDistroless Builds Are Now SLSA 2

Distroless Builds Are Now SLSA 2

[ad_1]

$ cosign verify-attestation -key cosign.pub gcr.io/distroless/base@sha256:4f8aa0aba190e375a5a53bb71a303c89d9734c817714aeaca9bb23b82135ed91Verification for gcr.io/distroless/base@sha256:4f8aa0aba190e375a5a53bb71a303c89d9734c817714aeaca9bb23b82135ed91 –The next checks have been carried out on every of those signatures:  – The cosign claims have been validated  – The signatures have been verified towards the required public key  – Any certificates have been verified towards the Fulcio roots….And you could find the provenance for the picture within the rekor transparency log with the rekor-cli software. For instance, you could possibly discover the provenance for the above picture by utilizing the picture’s digest and working:$ rekor-cli search –sha sha256:4f8aa0aba190e375a5a53bb71a303c89d9734c817714aeaca9bb23b82135ed91af7a9687d263504ccdb2759169c9903d8760775045c6e7554e365ec2bf29f6f8$ rekor-cli get –uuid af7a9687d263504ccdb2759169c9903d8760775045c6e7554e365ec2bf29f6f8 –format json | jq -r .Attestation | base64 –decode | jq{  “_type”: “distroless-provenance”,  “predicateType”: “https://tekton.dev/chains/provenance”,  “topic”: [    {      “name”: “gcr.io/distroless/base”,      “digest”: {        “sha256”: “703a4726aedc9ec7a7e32251087565246db117bb9a141a7993d1c4bb4036660d”      }    },    {      “name”: “gcr.io/distroless/base”,      “digest”: {        “sha256”: “d322ed16d530596c37eee3eb57a039677502aa71f0e4739b0272b1ebd8be9bce”      }    },    {      “name”: “gcr.io/distroless/base”,      “digest”: {        “sha256”: “2dfdd5bf591d0da3f67a25f3fc96d929b256d5be3e0af084db10952e5da2c661”      }    },    {      “name”: “gcr.io/distroless/base”,      “digest”: {        “sha256”: “4f8aa0aba190e375a5a53bb71a303c89d9734c817714aeaca9bb23b82135ed91”      }    },    {      “name”: “gcr.io/distroless/base”,      “digest”: {        “sha256”: “dc0a793d83196a239abf3ba035b3d1a0c7a24184856c2649666e84bc82fc5980”      }    },    {      “name”: “gcr.io/distroless/base-debian10”,      “digest”: {        “sha256”: “2dfdd5bf591d0da3f67a25f3fc96d929b256d5be3e0af084db10952e5da2c661”      }    },    {      “name”: “gcr.io/distroless/base-debian10”,      “digest”: {        “sha256”: “703a4726aedc9ec7a7e32251087565246db117bb9a141a7993d1c4bb4036660d”      }    },    {      “name”: “gcr.io/distroless/base-debian10”,      “digest”: {        “sha256”: “4f8aa0aba190e375a5a53bb71a303c89d9734c817714aeaca9bb23b82135ed91”      }    },    {      “name”: “gcr.io/distroless/base-debian10”,      “digest”: {        “sha256”: “d322ed16d530596c37eee3eb57a039677502aa71f0e4739b0272b1ebd8be9bce”      }    },    {      “name”: “gcr.io/distroless/base-debian10”,      “digest”: {        “sha256”: “dc0a793d83196a239abf3ba035b3d1a0c7a24184856c2649666e84bc82fc5980”      }    },    {      “name”: “gcr.io/distroless/base-debian11”,      “digest”: {        “sha256”: “c9507268813f235b11e63a7ae01526b180c94858bd718d6b4746c9c0e8425f7a”      }    },    {      “name”: “gcr.io/distroless/cc”,      “digest”: {        “sha256”: “4af613acf571a1b86b1d3c50682caada0b82024e566c1c4c2fe485a70f3af47d”      }    },    {      “name”: “gcr.io/distroless/cc”,      “digest”: {        “sha256”: “2c4bb6b7236db0a55ec54ba8845e4031f5db2be957ac61867872bf42e56c4deb”      }    },    {      “name”: “gcr.io/distroless/cc”,      “digest”: {        “sha256”: “2c4bb6b7236db0a55ec54ba8845e4031f5db2be957ac61867872bf42e56c4deb”      }    },    {      “name”: “gcr.io/distroless/cc-debian10”,      “digest”: {        “sha256”: “4af613acf571a1b86b1d3c50682caada0b82024e566c1c4c2fe485a70f3af47d”      }    },    {      “name”: “gcr.io/distroless/cc-debian10”,      “digest”: {        “sha256”: “2c4bb6b7236db0a55ec54ba8845e4031f5db2be957ac61867872bf42e56c4deb”      }    },    {      “name”: “gcr.io/distroless/cc-debian10”,      “digest”: {        “sha256”: “2c4bb6b7236db0a55ec54ba8845e4031f5db2be957ac61867872bf42e56c4deb”      }    },    {      “name”: “gcr.io/distroless/java”,      “digest”: {        “sha256”: “deb41661be772c6256194eb1df6b526cc95a6f60e5f5b740dda2769b20778c51”      }    },    {      “name”: “gcr.io/distroless/nodejs”,      “digest”: {        “sha256”: “927dd07e7373e1883469c95f4ecb31fe63c3acd104aac1655e15cfa9ae0899bf”      }    },    {      “name”: “gcr.io/distroless/nodejs”,      “digest”: {        “sha256”: “927dd07e7373e1883469c95f4ecb31fe63c3acd104aac1655e15cfa9ae0899bf”      }    },    {      “name”: “gcr.io/distroless/nodejs”,      “digest”: {        “sha256”: “f106757268ab4e650b032e78df0372a35914ed346c219359b58b3d863ad9fb58”      }    },    {      “name”: “gcr.io/distroless/nodejs-debian10”,      “digest”: {        “sha256”: “927dd07e7373e1883469c95f4ecb31fe63c3acd104aac1655e15cfa9ae0899bf”      }    },    {      “name”: “gcr.io/distroless/nodejs-debian10”,      “digest”: {        “sha256”: “f106757268ab4e650b032e78df0372a35914ed346c219359b58b3d863ad9fb58”      }    },    {      “name”: “gcr.io/distroless/nodejs-debian10”,      “digest”: {        “sha256”: “927dd07e7373e1883469c95f4ecb31fe63c3acd104aac1655e15cfa9ae0899bf”      }    },    {      “name”: “gcr.io/distroless/python3”,      “digest”: {        “sha256”: “aa8a0358b2813e8b48a54c7504316c7dcea59d6ae50daa0228847de852c83878”      }    },    {      “name”: “gcr.io/distroless/python3-debian10”,      “digest”: {        “sha256”: “aa8a0358b2813e8b48a54c7504316c7dcea59d6ae50daa0228847de852c83878”      }    },    {      “name”: “gcr.io/distroless/static”,      “digest”: {        “sha256”: “9acfd1fdf62b26cbd4f3c31422cf1edf3b7b01a9ecee00a499ef8b7e3536914d”      }    },    {      “name”: “gcr.io/distroless/static”,      “digest”: {        “sha256”: “e50641dbb871f78831f9aa7ffa59ec8f44d4cc33ae4ee992c9f4b046040e97f2”      }    },    {      “name”: “gcr.io/distroless/static-debian10”,      “digest”: {        “sha256”: “9acfd1fdf62b26cbd4f3c31422cf1edf3b7b01a9ecee00a499ef8b7e3536914d”      }    },    {      “name”: “gcr.io/distroless/static-debian10”,      “digest”: {        “sha256”: “e50641dbb871f78831f9aa7ffa59ec8f44d4cc33ae4ee992c9f4b046040e97f2”      }    }  ],  “predicate”: {    “invocation”: {      “parameters”: [        “MANIFEST_SUBSECTION={string 0 []}”,        “CHAINS-GIT_COMMIT={string 976c1c9bc178ac0371d8888d69893145c3df09f0 []}”,        “CHAINS-GIT_URL={string https://github.com/GoogleContainerTools/distroless []}”      ],      “recipe_uri”: “process://distroless-provenance”,      “event_id”: “531c282f-806e-41e4-b3ad-b596c4283381”,      “builder.id”: “tekton-chains”    },    “recipe”: {      “steps”: [        {          “entryPoint”: “#!/bin/shnset -exnn# get the digests for a subset of images built, and store in the IMAGES resultngo run provenance/provenance.go images $(params.MANIFEST_SUBSECTION) > $(results.IMAGES.path)n”,          “arguments”: null,          “environment”: {            “container”: “provenance”,            “image”: “docker.io/library/golang@sha256:cb1a7482cb5cfc52527c5cdea5159419292360087d5249e3fe5472f3477be642”          },          “annotations”: null        }      ]    },    “metadata”: {      “buildStartedOn”: “2021-09-16T00:03:04Z”,      “buildFinishedOn”: “2021-09-16T00:04:36Z”    },    “supplies”: [      {        “uri”: “https://github.com/GoogleContainerTools/distroless”,        “digest”: {          “revision”: “976c1c9bc178ac0371d8888d69893145c3df09f0”        }      }    ]  }}As you would possibly guess, our subsequent step is getting distroless to SLSA 3, which would require including non-falsifiable provenance and remoted builds to the distroless provide chain. Keep tuned for extra!

[ad_2]

RELATED ARTICLES

Most Popular

Recent Comments