hackeramitkumar / cosign_2.0_signature_fetching_and_verification

Testing the cosign library

Requirements

• Docker
• Cosign CLI
• Go 1.20+
• Regctl

Note - Paste your cosign public key in cosign.pub file.

Setup for running the demo :

1. repo1="localhost:5001/demo-reffer"

We can use any registry which supports OCI 1.1

2. docker run -d --rm --label demo=referrers -e "REGISTRY_STORAGE_DELETE_ENABLED=true" -e "REGISTRY_VALIDATION_DISABLED=true" -p "127.0.0.1:5001:5000" registry:2

3. regctl registry set --tls=disabled localhost:5001

It will fetch the digest for linux/amd64 image from a multiplatform image

4. digest=$(regctl image digest --platform linux/amd64 regclient/regctl:edge)

5. regctl image copy regclient/regctl@${digest} ${repo1}:app

6. syft packages -q "${repo1}:app" -o cyclonedx-json | regctl artifact put --subject "${repo1}:app" --artifact-type application/vnd.cyclonedx+json -m application/vnd.cyclonedx+json --annotation "org.opencontainers.artifact.description=CycloneDX JSON SBOM"

7. syft packages -q "${repo1}:app" -o spdx-json | regctl artifact put --subject "${repo1}:app" --artifact-type application/spdx+json -m application/spdx+json --annotation "org.opencontainers.artifact.description=SPDX JSON SBOM"

Note -> Since cosign does not support these type of refferes so for performing artifact verification we have to add in toto attestation by using cosign CLI.

8. cosign attest --predicate <file> --key cosign.key <image>