How to Implement Supply Chain Security with Sigstore 2 and Cosign 2 for Container Image Signing

package main

import (
    "fmt"
    "log"
    "os"
    "os/exec"
    "regexp"
    "strings"
)

// versionRegex extracts semantic version strings from command output
var versionRegex = regexp.MustCompile(`v?(\d+\.\d+\.\d+)`)

// requiredVersions maps tools to their minimum supported versions
var requiredVersions = map[string]string{
    "cosign":  "2.2.0",
    "sigstore": "2.0.0",
}

// compareVersions returns -1 if a < b, 0 if equal, 1 if a > b
func compareVersions(a, b string) int {
    aParts := strings.Split(a, ".")
    bParts := strings.Split(b, ".")
    for i := 0; i < len(aParts) && i < len(bParts); i++ {
        if aParts[i] < bParts[i] {
            return -1
        } else if aParts[i] > bParts[i] {
            return 1
        }
    }
    if len(aParts) < len(bParts) {
        return -1
    } else if len(aParts) > len(bParts) {
        return 1
    }
    return 0
}

// getToolVersion runs a tool's version command and extracts the version string
func getToolVersion(tool string, versionCmd []string) (string, error) {
    cmd := exec.Command(versionCmd[0], versionCmd[1:]...)
    output, err := cmd.Output()
    if err != nil {
        return "", fmt.Errorf("failed to run %s version command: %w", tool, err)
    }
    matches := versionRegex.FindStringSubmatch(string(output))
    if len(matches) < 2 {
        return "", fmt.Errorf("could not extract version from %s output: %s", tool, string(output))
    }
    return matches[1], nil
}

func main() {
    log.Println("Starting Sigstore/Cosign prerequisite check...")
    for tool, minVersion := range requiredVersions {
        var versionCmd []string
        switch tool {
        case "cosign":
            versionCmd = []string{"cosign", "version"}
        case "sigstore":
            // Sigstore CLI is part of cosign, but we check the sigstore-go library version via go list
            // For this example, we check cosign's bundled sigstore version
            versionCmd = []string{"cosign", "version"}
        default:
            log.Printf("Unknown tool: %s, skipping", tool)
            continue
        }

        version, err := getToolVersion(tool, versionCmd)
        if err != nil {
            log.Fatalf("Prerequisite check failed for %s: %v", tool, err)
        }

        // For sigstore, extract the bundled version from cosign output
        var actualVersion string
        if tool == "sigstore" {
            // Cosign version output includes sigstore-go version
            cmd := exec.Command("cosign", "version")
            output, _ := cmd.Output()
            re := regexp.MustCompile(`sigstore-go:\s+v?(\d+\.\d+\.\d+)`)
            matches := re.FindStringSubmatch(string(output))
            if len(matches) < 2 {
                log.Fatalf("Could not extract sigstore-go version from cosign output")
            }
            actualVersion = matches[1]
        } else {
            actualVersion = version
        }

        if compareVersions(actualVersion, minVersion) < 0 {
            log.Fatalf("%s version %s is below minimum required %s", tool, actualVersion, minVersion)
        }
        log.Printf("%s version %s meets requirements (min: %s)", tool, actualVersion, minVersion)
    }

    // Check OCI registry access
    registry := os.Getenv("REGISTRY")
    if registry == "" {
        registry = "ghcr.io"
    }
    cmd := exec.Command("skopeo", "inspect", fmt.Sprintf("docker://%s/hello-world:latest", registry))
    if err := cmd.Run(); err != nil {
        log.Fatalf("Failed to access registry %s: %v. Set REGISTRY env var to your registry", registry, err)
    }
    log.Printf("Successfully accessed registry %s", registry)

    log.Println("All prerequisites met. Proceeding with tutorial...")
}

package main

import (
    "context"
    "fmt"
    "log"
    "os"
    "os/exec"
    "strings"

    "github.com/sigstore/cosign/v2/pkg/cosign"
    "github.com/sigstore/cosign/v2/pkg/oci"
    "github.com/sigstore/cosign/v2/pkg/oci/remote"
    "github.com/sigstore/sigstore-go/pkg/sign"
    "github.com/sigstore/sigstore-go/pkg/sign/fulcio"
    "github.com/sigstore/sigstore-go/pkg/sign/rekor"
    "github.com/sigstore/sigstore-go/pkg/types"
)

// defaultImage is the test image used for signing examples
const defaultImage = "ghcr.io/your-org/tutorial-image:latest"

// getSigner initializes a keyless Sigstore signer using Fulcio for certificates and Rekor for transparency
func getSigner(ctx context.Context) (types.Signer, error) {
    // Initialize Fulcio signer for keyless signing (uses OIDC email for identity)
    fulcioSigner, err := fulcio.NewSigner(fulcio.SignerOptions{})
    if err != nil {
        return nil, fmt.Errorf("failed to initialize Fulcio signer: %w", err)
    }

    // Initialize Rekor client for transparency log entries
    rekorClient, err := rekor.NewClient(rekor.DefaultRekorURL)
    if err != nil {
        return nil, fmt.Errorf("failed to initialize Rekor client: %w", err)
    }

    // Combine signers: Fulcio for certificate, Rekor for transparency
    signer := sign.NewCombinedSigner(fulcioSigner, rekorClient)
    return signer, nil
}

// signImage signs the target OCI image using the provided signer and pushes the signature to the registry
func signImage(ctx context.Context, signer types.Signer, imageRef string) error {
    // Parse the image reference
    ref, err := remote.ParseReference(imageRef)
    if err != nil {
        return fmt.Errorf("failed to parse image reference %s: %w", imageRef, err)
    }

    // Get the image descriptor from the registry
    img, err := remote.Image(ref, remote.WithContext(ctx))
    if err != nil {
        return fmt.Errorf("failed to fetch image %s: %w", imageRef, err)
    }

    // Sign the image digest
    sig, err := signer.Sign(ctx, img)
    if err != nil {
        return fmt.Errorf("failed to sign image %s: %w", imageRef, err)
    }

    // Attach the signature to the image in the registry
    if err := remote.AttachSignature(ref, sig, remote.WithContext(ctx)); err != nil {
        return fmt.Errorf("failed to attach signature to %s: %w", imageRef, err)
    }

    log.Printf("Successfully signed image %s with digest %s", imageRef, img.Digest().String())
    return nil
}

func main() {
    ctx := context.Background()

    // Get image reference from env var, fall back to default
    imageRef := os.Getenv("TARGET_IMAGE")
    if imageRef == "" {
        imageRef = defaultImage
        os.Setenv("TARGET_IMAGE", imageRef)
    }

    // Validate image reference format
    if !strings.Contains(imageRef, ":") {
        log.Fatalf("Invalid image reference %s: must include tag or digest", imageRef)
    }

    // Initialize Sigstore signer
    signer, err := getSigner(ctx)
    if err != nil {
        log.Fatalf("Failed to initialize signer: %v", err)
    }

    // Sign the image
    if err := signImage(ctx, signer, imageRef); err != nil {
        log.Fatalf("Image signing failed: %v", err)
    }

    // Verify the signature immediately to catch errors early
    verifyCmd := exec.Command("cosign", "verify", "--certificate-identity-regexp", ".*", "--certificate-oidc-issuer-regexp", ".*", imageRef)
    verifyCmd.Stdout = os.Stdout
    verifyCmd.Stderr = os.Stderr
    if err := verifyCmd.Run(); err != nil {
        log.Fatalf("Post-signing verification failed: %v", err)
    }

    log.Println("Image signing and verification completed successfully")
}

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "os"
    "strings"
    "time"

    "github.com/sigstore/cosign/v2/pkg/cosign"
    "github.com/sigstore/cosign/v2/pkg/cosign/verify"
    "github.com/sigstore/cosign/v2/pkg/oci/remote"
    "github.com/sigstore/sigstore-go/pkg/verify/registry"
    "github.com/go-redis/redis/v9"
)

// Policy defines verification requirements for container images
type Policy struct {
    AllowedIssuers     []string `json:"allowed_issuers"`
    AllowedIdentities []string `json:"allowed_identities"`
    RequireRekor      bool     `json:"require_rekor"`
}

// loadPolicy reads verification policy from a JSON file
func loadPolicy(policyPath string) (*Policy, error) {
    data, err := os.ReadFile(policyPath)
    if err != nil {
        return nil, fmt.Errorf("failed to read policy file %s: %w", policyPath, err)
    }

    var policy Policy
    if err := json.Unmarshal(data, &policy); err != nil {
        return nil, fmt.Errorf("failed to parse policy file %s: %w", policyPath, err)
    }

    // Set defaults if not specified
    if len(policy.AllowedIssuers) == 0 {
        policy.AllowedIssuers = []string{"https://accounts.google.com", "https://github.com/login/oauth"}
    }
    if len(policy.AllowedIdentities) == 0 {
        policy.AllowedIdentities = []string{".*@your-org.com"}
    }
    return &policy, nil
}

// verifyImage checks a single image against the provided policy
func verifyImage(ctx context.Context, imageRef string, policy *Policy) error {
    // Parse image reference
    ref, err := remote.ParseReference(imageRef)
    if err != nil {
        return fmt.Errorf("invalid image reference %s: %w", imageRef, err)
    }

    // Configure verification options
    opts := []verify.VerifyOption{
        verify.WithIssuers(policy.AllowedIssuers),
        verify.WithIdentities(policy.AllowedIdentities),
    }

    if policy.RequireRekor {
        opts = append(opts, verify.WithRekor())
    }

    // Check Redis cache first (from Tip 2)
    rdb := redis.NewClient(&redis.Options{Addr: "localhost:6379"})
    cacheKey := fmt.Sprintf("rekor:%s", ref.Digest().String())
    cached, err := rdb.Get(ctx, cacheKey).Result()
    if err == nil {
        if cached == "valid" {
            log.Printf("Image %s passed verification (cached)", imageRef)
            return nil
        }
        return fmt.Errorf("cached invalid signature for %s", imageRef)
    }

    // Run verification if not cached
    _, err = verify.VerifyImage(ctx, ref, opts...)
    if err != nil {
        rdb.Set(ctx, cacheKey, "invalid", 1*time.Hour)
        return fmt.Errorf("verification failed for %s: %w", imageRef, err)
    }

    // Cache valid result
    rdb.Set(ctx, cacheKey, "valid", 24*time.Hour)
    log.Printf("Image %s passed verification", imageRef)
    return nil
}

func main() {
    ctx := context.Background()

    // Load policy from file
    policyPath := os.Getenv("VERIFY_POLICY_PATH")
    if policyPath == "" {
        policyPath = "verify-policy.json"
    }
    policy, err := loadPolicy(policyPath)
    if err != nil {
        log.Fatalf("Failed to load policy: %v", err)
    }

    // Get list of images to verify from env var (comma-separated)
    imagesEnv := os.Getenv("IMAGES_TO_VERIFY")
    if imagesEnv == "" {
        log.Fatal("IMAGES_TO_VERIFY env var must be set to comma-separated list of image references")
    }
    images := strings.Split(imagesEnv, ",")

    // Verify each image
    var failedImages []string
    for _, img := range images {
        img = strings.TrimSpace(img)
        if img == "" {
            continue
        }
        if err := verifyImage(ctx, img, policy); err != nil {
            log.Printf("ERROR: %v", err)
            failedImages = append(failedImages, img)
        }
    }

    // Report results
    if len(failedImages) > 0 {
        log.Fatalf("Verification failed for %d images: %v", len(failedImages), failedImages)
    }

    log.Println("All images passed verification policy")
}

jobs:
  sign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # Required for OIDC token access
    steps:
      - uses: actions/checkout@v4
      - uses: sigstore/cosign-installer@v3.4.0
      - run: cosign sign --oidc-issuer https://token.actions.githubusercontent.com ghcr.io/${{ github.repository }}/app:${{ github.sha }}

import "github.com/go-redis/redis/v9"

// Add to verifyImage function
rdb := redis.NewClient(&redis.Options{Addr: "localhost:6379"})
cacheKey := fmt.Sprintf("rekor:%s", img.Digest().String())
cached, err := rdb.Get(ctx, cacheKey).Result()
if err == nil {
  // Use cached verification result
  if cached == "valid" {
    return nil
  }
  return fmt.Errorf("cached invalid signature")
}
// Run verification if not cached
err = verify.VerifyImage(...)
if err == nil {
  rdb.Set(ctx, cacheKey, "valid", 24*time.Hour)
} else {
  rdb.Set(ctx, cacheKey, "invalid", 1*time.Hour)
}

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-signed-images
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-image-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/your-org/*"
          attestors:
            - count: 1
              entries:
                - keyless:
                    issuers:
                      - "https://token.actions.githubusercontent.com"
                    subjects:
                      - "https://github.com/your-org/*"

sigstore-cosign-tutorial/
├── step1-prereq-check/
│   └── main.go
├── step2-sign-image/
│   └── main.go
├── step3-verify-image/
│   └── main.go
├── policies/
│   └── verify-policy.json
├── .github/
│   └── workflows/
│       └── sign-verify.yml
└── README.md