diff --git a/modules/concepts/pages/artifact-registries/container-images.adoc b/modules/concepts/pages/artifact-registries/container-images.adoc index 29fe8b352..b8da20fb4 100644 --- a/modules/concepts/pages/artifact-registries/container-images.adoc +++ b/modules/concepts/pages/artifact-registries/container-images.adoc @@ -32,9 +32,6 @@ Since Stackable release 24.3, {stackable-sboms}[SBOMs{external-link-icon}^] for Since release 26.7, SBOMs are available in both the CycloneDX and SPDX formats. Have a look at the xref:guides:viewing-and-verifying-sboms.adoc[] guide to learn how to use SBOMs. -Additionally, since release 26.7, all images carry SLSA build provenance attestations at SLSA Level 3. -See the xref:guides:verifying-image-provenance.adoc[] guide for details. - [#multi-platform-support] == Multi-platform support diff --git a/modules/guides/nav.adoc b/modules/guides/nav.adoc index 8db4cf770..fe595dd2a 100644 --- a/modules/guides/nav.adoc +++ b/modules/guides/nav.adoc @@ -5,6 +5,5 @@ ** xref:running-stackable-in-an-airgapped-environment.adoc[] ** xref:viewing-and-verifying-sboms.adoc[] ** xref:enabling-verification-of-image-signatures.adoc[] -** xref:verifying-image-provenance.adoc[] ** xref:kubernetes-cluster-domain.adoc[] ** xref:deploy-operators-and-csi-drivers-separately.adoc[] diff --git a/modules/guides/pages/verifying-image-provenance.adoc b/modules/guides/pages/verifying-image-provenance.adoc deleted file mode 100644 index 5ec00f01a..000000000 --- a/modules/guides/pages/verifying-image-provenance.adoc +++ /dev/null @@ -1,59 +0,0 @@ -= Verifying SLSA provenance of Stackable images -:description: Learn how to verify the SLSA build provenance attestations of Stackable Data Platform container images using slsa-verifier. - -Starting with SDP 26.7, all Stackable container images, both product images and operator images, are published with https://slsa.dev/[SLSA{external-link-icon}^] build provenance attestations. - -Provenance is a signed statement describing how an artifact was built: which source repository and commit it was built from, which workflow built it, and on what infrastructure. With it, you can verify that an image you pulled from our registry was really built by Stackable's CI and it allows you to trace how it was built. - -The provenance is generated with the https://github.com/slsa-framework/slsa-github-generator[slsa-github-generator{external-link-icon}^] container workflow, which meets the requirements of *SLSA Level 3*: the provenance is created and signed by a trusted builder that is isolated from the project's own build workflow, so a compromised build job cannot forge it. Just like our xref:guides:viewing-and-verifying-sboms.adoc[SBOM attestations] and xref:guides:enabling-verification-of-image-signatures.adoc[images], the attestation is signed keylessly via https://www.sigstore.dev/[Sigstore{external-link-icon}^] (with GitHub Actions as the OIDC identity provider) and published in our OCI registry next to the image. - -== Verifying provenance with slsa-verifier - -The recommended tool for verification is https://github.com/slsa-framework/slsa-verifier[slsa-verifier{external-link-icon}^]. It verifies the signature on the provenance and checks that the image was built from the source repository you expect. - -`slsa-verifier` requires the image to be referenced by digest, not by tag. You can obtain the digest of an image with a tool like https://github.com/google/go-containerregistry/tree/main/cmd/crane[crane{external-link-icon}^]: - -[source,bash] ----- -crane digest oci.stackable.tech/sdp/kafka:3.9.1-stackable26.7.0 ----- - -Product images are built from the https://github.com/stackabletech/docker-images[docker-images{external-link-icon}^] repository: - -[source,bash] ----- -slsa-verifier verify-image \ - oci.stackable.tech/sdp/kafka@sha256:... \ - --source-uri github.com/stackabletech/docker-images ----- - -Operator images are built from their respective operator repository: - -[source,bash] ----- -slsa-verifier verify-image \ - oci.stackable.tech/sdp/kafka-operator@sha256:... \ - --source-uri github.com/stackabletech/kafka-operator ----- - -On success, `slsa-verifier` prints `PASSED: SLSA verification passed` and exits with code 0. It can also print the full verified provenance with `--print-provenance`, which is useful if you want to inspect the exact commit and workflow the image was built from. - -== Verifying provenance with cosign - -Alternatively, https://github.com/sigstore/cosign[cosign{external-link-icon}^] can verify and extract the provenance attestation. Two things to note: - -* The certificate identity is the trusted builder workflow of the slsa-github-generator project, not a Stackable workflow, because the provenance is deliberately signed by that isolated builder. -* The slsa-github-generator attaches the provenance in the legacy attestation format, so cosign 3 needs the `--new-bundle-format=false` flag to find it. - -[source,bash] ----- -cosign verify-attestation --type slsaprovenance \ ---new-bundle-format=false \ ---certificate-identity-regexp \ -'^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v.+' \ ---certificate-oidc-issuer https://token.actions.githubusercontent.com \ -oci.stackable.tech/sdp/kafka@sha256:... \ -| jq '.payload' -r | base64 -d | jq '.predicate' ----- - -The extracted predicate contains, among other things, the source repository and commit digest under `invocation.configSource` and the builder identity under `builder.id`. If you use cosign directly, make sure to check these fields yourself; `slsa-verifier` does this for you. diff --git a/modules/guides/pages/viewing-and-verifying-sboms.adoc b/modules/guides/pages/viewing-and-verifying-sboms.adoc index 758f1587e..7e59ad62f 100644 --- a/modules/guides/pages/viewing-and-verifying-sboms.adoc +++ b/modules/guides/pages/viewing-and-verifying-sboms.adoc @@ -6,7 +6,7 @@ With release 24.3 of SDP, we started providing SBOMs (Software Bill of Materials NOTE: Starting with SDP 25.7, we now embed the exact source code used to build each product directly into our images. You can find the source code in files ending with `-src.tar.gz` within the `/stackable` directory of each image. -Starting with SDP 26.7, every image additionally carries an SBOM in the https://spdx.dev/[SPDX{external-link-icon}^] format (SPDX JSON), attested alongside the CycloneDX SBOM. The SPDX SBOM is derived from the CycloneDX SBOM, so both formats describe the same component inventory. Container images also come with xref:guides:verifying-image-provenance.adoc[SLSA build provenance] since SDP 26.7. +Starting with SDP 26.7, every image additionally carries an SBOM in the https://spdx.dev/[SPDX{external-link-icon}^] format (SPDX JSON), attested alongside the CycloneDX SBOM. The SPDX SBOM is derived from the CycloneDX SBOM, so both formats describe the same component inventory. You can browse through our SBOMs at https://sboms.stackable.tech/[https://sboms.stackable.tech/{external-link-icon}^].