Sigstore and OWASP: The Definitive Guide to automation for Security

import os
import sys
import json
import subprocess
import logging
from pathlib import Path
from typing import List, Dict, Optional

# Configure logging for audit trails
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[logging.StreamHandler(sys.stdout)]
)
logger = logging.getLogger(__name__)

class OWASPDependencyScanner:
    """Automates OWASP Dependency-Check scans and validates Sigstore signatures for dependencies."""

    def __init__(self, project_root: Path, cosign_path: str = "cosign", dependency_check_path: str = "dependency-check"):
        self.project_root = project_root.resolve()
        self.cosign_path = cosign_path
        self.dependency_check_path = dependency_check_path
        self.scan_report_path = self.project_root / "dependency-check-report.json"

        # Validate tool availability
        self._validate_tools()

    def _validate_tools(self) -> None:
        """Check if required tools are installed and accessible."""
        tools = [self.cosign_path, self.dependency_check_path]
        for tool in tools:
            try:
                subprocess.run([tool, "--version"], capture_output=True, check=True)
                logger.info(f"Validated tool: {tool}")
            except FileNotFoundError:
                logger.error(f"Tool not found: {tool}. Install via 'brew install cosign' or OWASP docs.")
                sys.exit(1)
            except subprocess.CalledProcessError as e:
                logger.error(f"Tool validation failed for {tool}: {e.stderr.decode()}")
                sys.exit(1)

    def scan_dependencies(self) -> Dict:
        """Run OWASP Dependency-Check scan on project dependencies."""
        try:
            logger.info(f"Starting OWASP Dependency-Check scan for {self.project_root}")
            scan_cmd = [
                self.dependency_check_path,
                "--project", self.project_root.name,
                "--scan", str(self.project_root / "vendor"),  # Adjust for your package manager
                "--format", "JSON",
                "--out", str(self.scan_report_path),
                "--failOnCVSS", "7"  # Fail pipeline on high-severity CVEs
            ]
            result = subprocess.run(scan_cmd, capture_output=True, text=True)
            if result.returncode != 0:
                logger.error(f"Dependency-Check scan failed: {result.stderr}")
                raise RuntimeError(f"Scan failed with exit code {result.returncode}")

            with open(self.scan_report_path, "r") as f:
                scan_data = json.load(f)
            logger.info(f"Scan complete. Found {len(scan_data.get('dependencies', []))} dependencies.")
            return scan_data
        except Exception as e:
            logger.error(f"Dependency scan failed: {str(e)}")
            raise

    def verify_dependency_signatures(self, dependencies: List[Dict]) -> bool:
        """Verify Sigstore signatures for all scanned dependencies."""
        logger.info("Verifying Sigstore signatures for dependencies...")
        for dep in dependencies:
            dep_path = Path(dep.get("filePath", ""))
            if not dep_path.exists():
                logger.warning(f"Dependency file not found: {dep_path}")
                continue
            try:
                verify_cmd = [self.cosign_path, "verify", "--keyless", str(dep_path)]
                result = subprocess.run(verify_cmd, capture_output=True, text=True)
                if result.returncode != 0:
                    logger.error(f"Unsigned dependency detected: {dep_path}. Error: {result.stderr}")
                    return False
                logger.info(f"Verified signature for {dep_path}")
            except Exception as e:
                logger.error(f"Signature verification failed for {dep_path}: {str(e)}")
                return False
        logger.info("All dependency signatures verified successfully.")
        return True

if __name__ == "__main__":
    # Example usage: Scan a Python project's vendor directory
    project_root = Path("./my-python-project")
    if not project_root.exists():
        logger.error(f"Project root not found: {project_root}")
        sys.exit(1)

    scanner = OWASPDependencyScanner(project_root)
    try:
        scan_results = scanner.scan_dependencies()
        dependencies = scan_results.get("dependencies", [])
        if not scanner.verify_dependency_signatures(dependencies):
            logger.error("Pipeline failed: Unsigned or vulnerable dependencies detected.")
            sys.exit(1)
        logger.info("All checks passed. Proceeding to build.")
    except Exception as e:
        logger.error(f"Pipeline failed: {str(e)}")
        sys.exit(1)

# .github/workflows/security-automation.yml
name: Sigstore + OWASP Security Pipeline

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  COSIGN_VERSION: v2.2.1
  OWASP_DC_VERSION: 8.4.3

jobs:
  security-scan-and-sign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write  # Required for OIDC Sigstore authentication

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Fetch all history for OWASP version detection

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build container image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

      - name: Install Sigstore Cosign
        run: |
          curl -sSfL https://cosign.engineering/install.sh | sh -s -- -b /usr/local/bin ${COSIGN_VERSION}
          cosign version

      - name: Install OWASP Dependency-Check
        run: |
          curl -sSfL https://github.com/OWASP/dependency-check/releases/download/v${OWASP_DC_VERSION}/dependency-check-${OWASP_DC_VERSION}-release.zip -o dependency-check.zip
          unzip -q dependency-check.zip
          sudo mv dependency-check/bin/dependency-check.sh /usr/local/bin/dependency-check
          dependency-check --version

      - name: Run OWASP Dependency-Check scan
        run: |
          dependency-check \
            --project "${{ github.repository }}" \
            --scan . \
            --format JSON \
            --out dependency-check-report.json \
            --failOnCVSS 7
        continue-on-error: false  # Fail pipeline on high-severity CVEs

      - name: Upload scan report
        uses: actions/upload-artifact@v3
        with:
          name: dependency-check-report
          path: dependency-check-report.json

      - name: Sign container image with Sigstore (keyless)
        run: |
          cosign sign \
            --yes \
            --keyless \
            --oidc-issuer https://token.actions.githubusercontent.com \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
        env:
          COSIGN_EXPERIMENTAL: 1  # Enable keyless signing

      - name: Verify image signature
        run: |
          cosign verify \
            --keyless \
            --oidc-issuer https://token.actions.githubusercontent.com \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

      - name: Push signed image to registry
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

      - name: Generate compliance report
        run: |
          echo "Security Compliance Report" > compliance-report.txt
          echo "Generated: $(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> compliance-report.txt
          echo "Image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}" >> compliance-report.txt
          echo "OWASP Scan: Passed (CVSS <7)" >> compliance-report.txt
          echo "Sigstore Signature: Verified (Keyless OIDC)" >> compliance-report.txt
          cat compliance-report.txt

      - name: Upload compliance report
        uses: actions/upload-artifact@v3
        with:
          name: compliance-report
          path: compliance-report.txt

package main

import (
    "context"
    "crypto/x509"
    "encoding/json"
    "fmt"
    "log"
    "os"
    "strings"

    "github.com/sigstore/cosign/v2/pkg/cosign"
    "github.com/sigstore/cosign/v2/pkg/oci/remote"
)

// Config holds pre-commit hook configuration
type Config struct {
    AllowedIssuers []string `json:"allowed_issuers"`
    MaxCVSS        float64  `json:"max_cvss"`
    Registry       string   `json:"registry"`
}

func loadConfig(configPath string) (*Config, error) {
    data, err := os.ReadFile(configPath)
    if err != nil {
        return nil, fmt.Errorf("failed to read config: %w", err)
    }
    var cfg Config
    if err := json.Unmarshal(data, &cfg); err != nil {
        return nil, fmt.Errorf("failed to unmarshal config: %w", err)
    }
    if len(cfg.AllowedIssuers) == 0 {
        cfg.AllowedIssuers = []string{"https://token.actions.githubusercontent.com"}
    }
    return &cfg, nil
}

// verifyImageSignature checks if an image is signed with Sigstore keyless
func verifyImageSignature(ctx context.Context, imageRef string, cfg *Config) error {
    // Parse the image reference
    ref, err := remote.ParseImageRef(imageRef)
    if err != nil {
        return fmt.Errorf("invalid image reference: %w", err)
    }

    // Verify keyless signature
    verified, err := cosign.VerifyImageSignatures(ctx, ref, &cosign.VerifyImageOptions{
        KeyRef:      "", // Keyless mode
        OIDCIssuers: cfg.AllowedIssuers,
    })
    if err != nil {
        return fmt.Errorf("signature verification failed: %w", err)
    }

    if len(verified) == 0 {
        return fmt.Errorf("no valid signatures found for image %s", imageRef)
    }

    // Validate certificate issuer
    for _, sig := range verified {
        cert, err := sig.Cert()
        if err != nil {
            return fmt.Errorf("failed to get certificate: %w", err)
        }
        if cert == nil {
            return fmt.Errorf("no certificate attached to signature for %s", imageRef)
        }
        issuer := getCertificateIssuer(cert)
        if !contains(cfg.AllowedIssuers, issuer) {
            return fmt.Errorf("untrusted issuer %s for image %s", issuer, imageRef)
        }
    }

    log.Printf("Verified %d signatures for image %s", len(verified), imageRef)
    return nil
}

func getCertificateIssuer(cert *x509.Certificate) string {
    // Extract OIDC issuer from certificate extensions
    for _, ext := range cert.Extensions {
        if ext.Id.String() == "1.3.6.1.4.1.57264.1.1" { // Sigstore OIDC issuer extension
            return string(ext.Value)
        }
    }
    return ""
}

func contains(arr []string, str string) bool {
    for _, a := range arr {
        if a == str {
            return true
        }
    }
    return false
}

func main() {
    // Load configuration
    cfg, err := loadConfig(".sigstore-precommit.json")
    if err != nil {
        log.Fatalf("Failed to load config: %v", err)
    }

    // Get staged images from git (simplified for example)
    images := []string{
        "ghcr.io/my-org/my-app:latest",
        "ghcr.io/my-org/my-worker:latest",
    }

    ctx := context.Background()
    for _, img := range images {
        log.Printf("Verifying image: %s", img)
        if err := verifyImageSignature(ctx, img, cfg); err != nil {
            log.Fatalf("Verification failed for %s: %v", img, err)
        }
    }

    log.Println("All images verified successfully. Proceeding with commit.")
}

  - name: Cache OWASP Dependency-Check NVD data
    uses: actions/cache@v3
    with:
      path: ~/.dependency-check/data
      key: ${{ runner.os }}-dependency-check-nvd-${{ hashFiles('**/pom.xml', '**/package-lock.json') }}
      restore-keys: |
        ${{ runner.os }}-dependency-check-nvd-

  cosign sign --yes --keyless --oidc-issuer https://token.actions.githubusercontent.com ghcr.io/my-org/my-app:latest

  docker run -t owasp/zap2docker-stable zap-baseline.py -t http://localhost:3000 -x zap-report.xml

sigstore-owasp-definitive-guide/
├── .github/
│   └── workflows/
│       └── security-automation.yml  # GitHub Actions pipeline
├── cmd/
│   └── precommit/
│       └── main.go  # Go pre-commit verification script
├── python/
│   └── scanner.py  # OWASP Dependency-Check scanner
├── k8s/
│   └── clusterimagepolicy.yaml  # Sigstore admission policy
├── .sigstore-precommit.json  # Pre-commit hook configuration
├── Dockerfile  # Example container image
└── README.md  # Setup instructions