Digest or Named reference signature files from images with Connaisseur

[allanedwardslab651]

How does Connaisseur find the signature files that are related to our image artifacts? Also, is there any way to configure Connaisseur to look into another repo folder for a sig file from where the image is stored?

[Starkteetje]

Hi @allanedwardslab651
it would be helpful if you were a bit more specific. Different signature schemes work differently. However, from the other question you posed, I'd presume you're using Cosign. In that case, Cosign stores signature data alongside the image, c.f. their documentation.

In case you're using Notary, there's a dedicated Notary server needed. However, docker.io does have one by default, so if you're using images from its library, you can use them as Docker's public key and notary service is pre-configured in our default configuration here. See further documentation here.

[Starkteetje]

Actually, @xopham knows more about the Cosign ecosystem than I do and dug up https://docs.sigstore.dev/system_config/registry_support/#specifying-registry. Connaisseur has an extra env field in its config, so passing COSIGN_REPOSITORY should work and impact the execution of the binary, so if the repository you're hosting the signatures in has the correct structure, this could be a solution that works with both your approach and as-is-Connaisseur.

Could that approach work for you? I'd be interested to hear, whether it does or if not, what blocks it from working

[allanedwardslab651]

Yes, we were using COSIGN_REPOSITORY and specifying a different repository for our sig files. This was causing Connaisseur to not work properly. It expects the sig file in the same repo as the image we found out through testing.

[Starkteetje]

Hmm, that's weird. I just tried it and for me it did work to have an image at https://hub.docker.com/layers/teetje/cosigntest/1.2.3/images/sha256-90659bf80b44ce6be8234e6ff90a1ac34acbeb826903b02cfa0da11c82cbc042?context=repo validated by a signature in another repo, so in general this seems to work. Maybe something else is not working due to it being a totally different registry instead if just another repository in your setup.

We'll most likely release a new version of Connaisseur today, which will include debug logging for Cosign validators when Connaisseur is run with debug log level. Once that's released, it would be nice if you could test in debug mode and share (parts of) the log output and your values.yaml config, so that I can better understand what is going wrong in your instance

[xopham]

@allanedwardslab651 have you tested the solution to set the repository via connaisseurs environment variable field as proposed by @Starkteetje above?
@Starkteetje one limitation I see is the limitation to only one signature repo and all others will fail. Specifically, if you have multiple cosign validators for external and internal images. we might have to make the signature repository configurable nontheless

[Starkteetje]

A day later than we'd hoped, but we've just released v3.3.0, which does enabled verbose logging of Cosign, if Connaisseur's log level is set to debug. With that, we should get an answer as to why setting COSIGN_REPOSITORY worked for me, but not in your setup. It'd be nice if you could share these logs with us