kube-tarian / sigrun Goto Github PK

Sign your artifacts, source code or container images using Sigstore tools, Save the Signatures you want to use, and Validate & Control the deployments to allow only the known Sources based on Signatures, Maintainers & other payloads automatically.

Home Page: https://sigrun.dev

License: Apache License 2.0

Go 96.56% Dockerfile 1.07% Shell 2.20% Standard ML 0.17%

sigstore cosign rekor fulcio containers artifacts signature signature-verification kubernetes pods

sigrun's People

Contributors

Stargazers

Watchers

Forkers

syllogy srikrishnabh1 ducthinh993

sigrun's Issues

Resolve TODOs

SigRun whole Documentation

Manage CLI state

Investigate popular methods of managing cli state

Fix basic flow bugs

Change chain number to uuid

Implement configure command according to spec

Implement key less mode

Add tests

Implement sign command according to spec

Sigrun should not be a kubectl plugin

sigrun should be usable outside kubernetes

Add error handling and logging to webhook

Update should be resistant to attacks where chain is altered

genesis file can be altered by hacker making chain have different guid

sign sigrun ledger as well

sign the sigrun's ledger file as well. this will ensure ledger file is also protected. Signing ledger file should be the very last step to be executed. Only after signing ledger file the keys should be deleted.

Modify webhook to support any resource that creates a container

Currently validation controller only validates requests coming from pods for "Create" and "Update". However there can be other kubernetes objects which create container please review and update configuration accordingly.

Webhook should be created by controller

Currently secrets are in the install.yaml file for everyone to see. For security purposes sigrun controller should automatically create tls cert and register itself as a admission controller on deployment.

Controller should not have admin permissions

Currently controller has admin permissions, please change this.

Add metadata field to config file

use timestamping service for sigrun ledger similar to rekor

use RFC 3161 timestamping service to save the timestamp format of RFC3161 timestamp as well along with the existing timestamp you are saving in sigrun ledger.
We can use those timestamps as well on the validation side policies in kyverno & OPA.

https://blog.sigstore.dev/its-ten-o-clock-do-you-know-where-your-private-keys-are-5c869cf53234

Add support for annotations

Revise config file

{
	"Organization": "devopstoday211",
	"Maintainers": "something",
	"sigrun-sign-id": "sdafasdf1213sas",
	"PublicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0zl9+NowQv3ILEqzVdxsBapesA0G\nWcFWdFQsSU4648ZDo17kh8z7g59VbHg0ABNttsYKPQmd7JjYbUXfqp+SAA==\n-----END PUBLIC KEY-----\n",
	"Images": [
		"docker.io/shravanss/sigrun-example"
	],
	"Signatures": [
		{
			"timestamp": "",
			"signed-by": "",
			"sign-mode": "",
			"commit-id": "",
			"signature":"",
			"signer": "[email protected]",
			"cert": "",
			"checksum": "",
			"iam": "github.com/azure.com/gmail.com/linkedin.com/gitlab.com/bitbucket/atlassian"
		},
		{

		}
	]
}