容器镜像签名与验证：用 cosign 守住供应链安全的最后一道门

攻击者
  │
  ├─ 路径1：上传恶意基础镜像到 Docker Hub
  │         → 开发者基于该镜像构建应用
  │         → 恶意代码进入 CI/CD 流水线
  │         → 部署到生产环境
  │
  ├─ 路径2：入侵 CI 系统，篡改构建产物
  │         → 推送同名 tag 的篡改镜像
  │         → 部署系统拉取"最新"镜像
  │         → 后门进入生产
  │
  ├─ 路径3：中间人攻击，篡改镜像传输
  │         → 拦截 docker pull 请求
  │         → 返回篡改后的镜像层
  │
  └─ 路径4：内部人员误操作或恶意操作
            → 直接推送未经验证的镜像到生产仓库

签名时：
  1. cosign 通过 OIDC 让你的 CI 证明身份
     → "我是 GitHub Actions 里 xxx 仓库的工作流"
  2. Fulcio（证书颁发机构）签发一张短期证书
     → 有效期就几分钟，过了就作废
  3. 用这张证书对应的临时私钥完成签名
  4. 私钥扔掉——不需要保管
  5. 签名记录 + 证书写入 Rekor（透明日志）
     → 不可篡改、可公开查询

验证时：
  1. 从 Rekor 查签名记录和证书
  2. 验证证书确实由 Fulcio 签发
  3. 验证证书里的身份信息（OIDC issuer + identity）
  4. 验证签名与镜像 digest 匹配
  5. 全部通过 → 信任这个镜像

# Linux
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
mv cosign-linux-amd64 /usr/local/bin/cosign
chmod +x /usr/local/bin/cosign

# macOS
brew install cosign

# 验证安装
cosign version

# 签名：签的是 digest 不是 tag
# tag 是可变指针，今天指这个明天能被重新指向另一个
# digest 是内容哈希，内容变一个字节它就变，签它才有意义
cosign sign registry.example.com/app@sha256:abc123def456...

# 本地执行时会弹浏览器让你通过 OIDC 登录
# CI 里通常配置 OIDC token，自动完成身份验证

# 生成密钥对
# 会提示设置密码，私钥用这个密码加密
cosign generate-key-pair
# 生成两个文件：
#   cosign.key - 私钥（必须保密保管）
#   cosign.pub - 公钥（分发给验证方）

# 用私钥签名
cosign sign --key cosign.key \
  registry.example.com/app@sha256:abc123def456...

# 用公钥验证
cosign verify --key cosign.pub \
  registry.example.com/app@sha256:abc123def456...

# keyless 验证 - 必须指定身份和 issuer
# 这两个参数是关键，新手最容易漏
cosign verify \
  --certificate-identity "https://github.com/myorg/myapp/.github/workflows/release.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  registry.example.com/app@sha256:abc123def456...

# .github/workflows/build-and-sign.yml
name: Build and Sign

on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write   # 关键：开启 OIDC token 写权限
  packages: write

jobs:
  build-sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ghcr.io/${{ github.repository }}:latest
          # 关键：同时输出 digest，签名要用
          outputs: type=oci,dest=/tmp/image.tar

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Get image digest
        id: digest
        run: |
          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/${{ github.repository }}:latest | cut -d'@' -f2)
          echo "digest=$DIGEST" >> $GITHUB_OUTPUT
          echo "ref=ghcr.io/${{ github.repository }}@${DIGEST}" >> $GITHUB_OUTPUT          

      - name: Sign image (keyless)
        run: |
          cosign sign --yes \
            ghcr.io/${{ github.repository }}@${{ steps.digest.outputs.digest }}          
        # --yes 跳过交互确认，CI 环境必须加

      - name: Verify signature
        run: |
          cosign verify \
            --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/build-and-sign.yml@refs/heads/main" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            ghcr.io/${{ github.repository }}@${{ steps.digest.outputs.digest }}          
        # 签完立即验一遍，确认签名有效

      - name: Attach SBOM (可选但推荐)
        run: |
          # 生成 SBOM 并附加到镜像
          # SBOM = Software Bill of Materials，软件物料清单
          syft ghcr.io/${{ github.repository }}@${{ steps.digest.outputs.digest }} -o spdx-json > /tmp/sbom.spdx.json
          cosign attach sbom --sbom /tmp/sbom.spdx.json \
            ghcr.io/${{ github.repository }}@${{ steps.digest.outputs.digest }}

          # 签名 SBOM，防止 SBOM 被篡改
          cosign sign --yes \
            --attachment sbom \
            ghcr.io/${{ github.repository }}@${{ steps.digest.outputs.digest }}          

# kyverno-verify-images.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: Enforce  # Enforce=拒绝，Audit=只记录
  background: false
  webhookTimeoutSeconds: 30
  rules:
    - name: verify-ghcr-images
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/myorg/*"  # 只验证自己仓库的镜像
          mutateDigest: true      # 自动把 tag 替换成 digest
          attestors:
            - count: 1
              entries:
                - keyless:
                    subject: "https://github.com/myorg/*/.github/workflows/*.yml@refs/heads/main"
                    issuer: "https://token.actions.githubusercontent.com"
                    rekor:
                      url: https://rekor.sigstore.dev

# cosign 的 admission controller 配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: cosign-webhook-config
  namespace: cosign-system
data:
  config.yaml: |
    # 指定允许的镜像和对应的验证方式
    allow:
      - pattern: "ghcr.io/myorg/*"
        verify_config:
          keyless:
            subject: "https://github.com/myorg/*/.github/workflows/*.yml@refs/heads/main"
            issuer: "https://token.actions.githubusercontent.com"
      - pattern: "docker.io/library/*"
        # 官方镜像不需要验证签名
        skip_verify: true    

# Kyverno 策略加白名单
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: Enforce
  background: false
  webhookTimeoutSeconds: 30
  rules:
    - name: exclude-system-namespaces
      match:
        any:
          - resources:
              kinds:
                - Pod
      exclude:
        any:
          - resources:
              namespaces:
                - kube-system
                - kube-public
                - kube-node-lease
                - cosign-system
                - kyverno
      verifyImages:
        - imageReferences:
            - "ghcr.io/myorg/*"
          # ... 验证配置

# 用 syft 生成 SBOM
syft ghcr.io/myorg/app@sha256:abc123... -o spdx-json > sbom.spdx.json

# 用 cosign 附加 SBOM 证明（会自动签名）
cosign attest --yes \
  --predicate sbom.spdx.json \
  --type spdxjson \
  ghcr.io/myorg/app@sha256:abc123...

# 验证 SBOM 证明
cosign verify-attestation \
  --certificate-identity "https://github.com/myorg/app/.github/workflows/build.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --type spdxjson \
  ghcr.io/myorg/app@sha256:abc123...

# 用 grype 扫描漏洞
grype ghcr.io/myorg/app@sha256:abc123... -o json > vuln-scan.json

# 附加扫描结果作为证明
cosign attest --yes \
  --predicate vuln-scan.json \
  --type vuln \
  ghcr.io/myorg/app@sha256:abc123...

# Kyverno 多层验证策略
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-sbom-and-scan
spec:
  validationFailureAction: Enforce
  background: false
  webhookTimeoutSeconds: 30
  rules:
    - name: check-signature-and-sbom
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/myorg/*"
          attestors:
            - count: 1
              entries:
                - keyless:
                    subject: "https://github.com/myorg/*/.github/workflows/*.yml@refs/heads/main"
                    issuer: "https://token.actions.githubusercontent.com"
          attestations:
            - type: spdxjson
              attestors:
                - count: 1
                  entries:
                    - keyless:
                        subject: "https://github.com/myorg/*/.github/workflows/*.yml@refs/heads/main"
                        issuer: "https://token.actions.githubusercontent.com"
            # 还可以加漏洞扫描证明的验证
            - type: vuln
              attestors:
                - count: 1
                  entries:
                    - keyless:
                        subject: "https://github.com/myorg/*/.github/workflows/*.yml@refs/heads/main"
                        issuer: "https://token.actions.githubusercontent.com"