implementing-image-provenance-verification-with-cosign

Name: implementing-image-provenance-verification-with-cosign
Author: mukul975

github.com/mukul975安全35.2k54 次安装8 周前更新

代码仓库

关于 implementing-image-provenance-verification-with-cosign

面向容器镜像维护者和安全团队的 Cosign 实施指南，用于签名、验证并附加 OCI 制品元数据。内容涵盖密钥与 OIDC 无密钥签名、证明信息以及部署策略。

主要功能

01使用密钥或 OIDC 签名
02验证镜像签名与身份
03附加 SBOM 和漏洞扫描证明
04集成 CI/CD 签名流程
05通过 Kubernetes 策略强制验证

适用场景

01为发布的容器镜像签名
02在流水线中验证构建身份
03随镜像发布 SBOM 或来源证明
04阻止集群部署未签名镜像

安装

复制下面的命令，在终端中运行。

npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill implementing-image-provenance-verification-with-cosign

安装后在 Claude Code 中输入/implementing-image-provenance-verification-with-cosign确认已加载。

包含的文件

除 SKILL.md 外，安装时一起下载的参考资料和脚本。

LICENSE

assets/

template.md

references/

api-reference.md

standards.md

workflows.md

scripts/

agent.py

process.py

详细介绍

使用 Cosign 实现镜像来源验证

概述

Cosign 是 Sigstore 的一款工具，用于对容器镜像和 OCI 制品进行签名、验证以及附加元数据。它同时支持基于密钥和免密钥（OIDC）的签名方式，可与 Fulcio（证书颁发机构）和 Rekor（透明度日志）集成，并为容器镜像提供供应链安全保障。

何时使用

在环境中部署或配置使用 Cosign 实现镜像来源验证能力时
在建立符合合规要求的安全控制措施时
在为此领域构建或改进安全架构时
在执行需要此实现的安全评估时

前提条件

已安装 Cosign CLI
用于构建镜像的 Docker 或 Podman
符合 OCI 规范的容器镜像仓库（Docker Hub、GHCR、GCR、ECR）
用于免密钥签名的 OIDC 提供方账户（GitHub、Google、Microsoft）

安装 Cosign

# Install via Go
go install github.com/sigstore/cosign/v2/cmd/cosign@latest

# Install via Homebrew
brew install cosign

# Install via script
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
sudo mv cosign-linux-amd64 /usr/local/bin/cosign
sudo chmod +x /usr/local/bin/cosign

# Verify installation
cosign version

基于密钥的签名

生成密钥对

# Generate cosign key pair (creates cosign.key and cosign.pub)
cosign generate-key-pair

# Generate key pair stored in KMS
cosign generate-key-pair --kms awskms:///alias/cosign-key
cosign generate-key-pair --kms gcpkms://projects/PROJECT/locations/LOCATION/keyRings/KEYRING/cryptoKeys/KEY
cosign generate-key-pair --kms hashivault://transit/keys/cosign

使用密钥对镜像签名

# Sign an image
cosign sign --key cosign.key ghcr.io/myorg/myapp:v1.0.0

# Sign with annotations
cosign sign --key cosign.key \
  -a "build-id=12345" \
  -a "git-sha=$(git rev-parse HEAD)" \
  ghcr.io/myorg/myapp:v1.0.0

使用密钥验证镜像

# Verify signature
cosign verify --key cosign.pub ghcr.io/myorg/myapp:v1.0.0

# Verify with annotation check
cosign verify --key cosign.pub \
  -a "build-id=12345" \
  ghcr.io/myorg/myapp:v1.0.0

免密钥签名（OIDC）

使用免密钥方式签名（交互式）

# Keyless sign - opens browser for OIDC auth
cosign sign ghcr.io/myorg/myapp:v1.0.0

# The signature, certificate, and Rekor entry are created automatically

使用免密钥方式签名（CI/CD - 非交互式）

# GitHub Actions (uses OIDC token automatically)
cosign sign ghcr.io/myorg/myapp:v1.0.0 \
  --yes

# With explicit identity token
cosign sign ghcr.io/myorg/myapp:v1.0.0 \
  --identity-token=$(cat /var/run/sigstore/cosign/oidc-token) \
  --yes

验证免密钥签名

# Verify by email identity
cosign verify ghcr.io/myorg/myapp:v1.0.0 \
  [email protected] \
  --certificate-oidc-issuer=https://accounts.google.com

# Verify by GitHub Actions workflow
cosign verify ghcr.io/myorg/myapp:v1.0.0 \
  --certificate-identity=https://github.com/myorg/myrepo/.github/workflows/build.yml@refs/heads/main \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

# Verify with regex matching
cosign verify ghcr.io/myorg/myapp:v1.0.0 \
  --certificate-identity-regexp=".*@example.com" \
  --certificate-oidc-issuer=https://accounts.google.com

证明（SLSA 来源）

附加 SBOM 证明

# Generate SBOM
syft ghcr.io/myorg/myapp:v1.0.0 -o cyclonedx-json > sbom.cdx.json

# Attach SBOM as attestation
cosign attest --key cosign.key \
  --type cyclonedx \
  --predicate sbom.cdx.json \
  ghcr.io/myorg/myapp:v1.0.0

# Verify attestation
cosign verify-attestation --key cosign.pub \
  --type cyclonedx \
  ghcr.io/myorg/myapp:v1.0.0

附加漏洞扫描证明

# Run scan and save results
grype ghcr.io/myorg/myapp:v1.0.0 -o json > vuln-scan.json

# Attach scan results as attestation
cosign attest --key cosign.key \
  --type vuln \
  --predicate vuln-scan.json \
  ghcr.io/myorg/myapp:v1.0.0

SLSA 来源证明

# Attach SLSA provenance
cosign attest --key cosign.key \
  --type slsaprovenance \
  --predicate provenance.json \
  ghcr.io/myorg/myapp:v1.0.0

# Verify SLSA provenance
cosign verify-attestation --key cosign.pub \
  --type slsaprovenance \
  ghcr.io/myorg/myapp:v1.0.0

CI/CD 集成

GitHub Actions

name: Sign and Publish
on:
  push:
    tags: ['v*']

permissions:
  contents: read
  packages: write
  id-token: write  # Required for keyless signing

jobs:
  build-sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: sigstore/cosign-installer@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        id: build
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.ref_name }}

      - name: Sign image (keyless)
        run: |
          cosign sign --yes \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}

      - name: Generate and attach SBOM
        run: |
          syft ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }} -o cyclonedx-json > sbom.json
          cosign attest --yes \
            --type cyclonedx \
            --predicate sbom.json \
            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}

Kubernetes 准入强制

策略控制器（Sigstore）

# Install policy-controller
helm repo add sigstore https://sigstore.github.io/helm-charts
helm install policy-controller sigstore/policy-controller \
  --namespace cosign-system --create-namespace

# Enforce signed images in namespace
apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: require-signed-images
spec:
  images:
    - glob: "ghcr.io/myorg/**"
  authorities:
    - keyless:
        url: https://fulcio.sigstore.dev
        identities:
          - issuer: https://token.actions.githubusercontent.com
            subjectRegExp: "https://github.com/myorg/.*"
      ctlog:
        url: https://rekor.sigstore.dev

Kyverno 集成

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  rules:
    - name: verify-cosign-signature
      match:
        any:
          - resources:
              kinds: ["Pod"]
      verifyImages:
        - imageReferences:
            - "ghcr.io/myorg/*"
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/myorg/*"
                    issuer: "https://token.actions.githubusercontent.com"
                    rekor:
                      url: https://rekor.sigstore.dev

透明度日志（Rekor）

# Search Rekor for image signatures
rekor-cli search --email [email protected]

# Get specific entry
rekor-cli get --uuid <entry-uuid>

# Verify entry inclusion
cosign verify ghcr.io/myorg/myapp:v1.0.0 \
  [email protected] \
  --certificate-oidc-issuer=https://accounts.google.com

最佳实践

在 CI/CD 自动化流水线中使用免密钥签名
按摘要签名而非按标签签名，以获得不可变引用
在签名之外附加 SBOM 证明
在准入环节使用 policy-controller 或 Kyverno 强制校验签名
使用 OIDC 身份验证而不仅仅是密钥验证
对于基于密钥的签名，将密钥存储在 KMS 中（AWS KMS、GCP KMS、HashiCorp Vault）
验证完整链条：签名 + 证书 + Rekor 收录
包含构建元数据作为签名上的注解

支持 Markdown

登录后评论

基本信息

作者: mukul975
仓库: mukul975/anthropic-cybersecurity-skills
分类: 安全
安装次数: 54
GitHub Stars: 35,191

报告问题