security: respond to weaknesses identified in the in-toto sec audit

[colek42]

1. Incorporate File Permissions into File Metadata Records

   • In response to the audit finding GHSA-wqrg-wjp9-wqfq, we need to include file permissions into file metadata records as part of the Omnitrail container development.

2. Remove Support for Configuration Files

   • As per the audit finding GHSA-wqrg-wjp9-wqfq, we need to remove support for configuration files in Witness. Guidance should be provided on setting configurations through API parameters or CLI arguments.

3. Add Feature to Attest Internal Configuration Parameters

   • In response to audit GHSA-wqrg-wjp9-wqfq, add a feature that attests to the Witness internal configuration parameters.

4. Strategies to Counter Layout Replay Attacks

   • According to the audit finding GHSA-73jv-h86v-c2vh, implement strategies set out in in-toto Enhancements ITE-2 and ITE-3 leveraging The Update Framework (TUF). This includes adding TUF support to Archivista to ensure freshness of Witness Policy and other data stored.

5. Implement Measures against Link File Reuse

   • As a response to the audit GHSA-6q78-j78h-pqm2, implement globally unique step names in a layout where reuse is not intended and reuse Witness policy across many pipelines as per recommendations from ITE-2 and ITE-3. Also, consider recording the hashes of the tool used in the step in the policy.

6. Improve Verification by Functionaries

   • To address audit finding GHSA-p86f-xmg6-9q4x, support checking of witness policies before creating attestations and use namespaces and security modules like Seccomp, AppArmor, and SELinux to isolate Witness from the build process. This should be implemented alongside the existing Sigstore and SPIRE key providers.

7. Clarify Position on PGP Support

   • As mentioned in response to audit GHSA-jjgp-whrp-gq8m, officially state and document that Witness neither supports nor plans to support PGP. This will ensure clarity for all users and contributors.

[linsun]

Hi! Is there any update to this? Are all the issues still around?

[JustinCappos]

Note, this tracking issue is specific to the Witness implementation and isn't reflective of issues in the in-toto specification.

[jkjell]

Hey @linsun 👋

Here are some updates and information with respect to the above:

1. Incorporate File Permissions into File Metadata Records
   • The omnitrail attestor has been implemented to capture file metadata: https://witness.dev/docs/docs/attestors/omnitrail
   • Documentation of this still needs to be improved: [chore]: add documentation for omnitrail attestor #465
2. Remove Support for Configuration Files
   • The use on configuration files is optional, allowing users to avoid this advisory.
   • However, we still plan to document and deprecate support for this: [Chore]: Warn against and deprecate using a witness configuration file. #542
3. Record hash of config
   • It looks like the above links to the wrong advisory. Here's the actual advisory: GHSA-wc64-c5rv-32pf
   • This layers on the above to provide further defense in depth. I created an issue 👇 to capture the intent.
   • Config attestor: [Feat]: Configuration Attestor go-witness#414
4. Strategies to Counter Layout Replay Attacks
   • As noted in the advisory, this is considered outside the scope of in-toto itself. The Witness maintainers agree with this.
   • This planned integration with Archivista will support addressing this: Feature|Experimental: Add support to add Policies to TUF archivista#159
5. Implement Measures against Link File Reuse
   • Witness leverages the attestation specification. This includes subjects in addition to step names. This ensures attestations apply appropriately to the policy being validated.
   • Witness attestations capture timestamps for all attestations created. Policies can include checks on timestamp for uniqueness.
   • When attestations are signed with a Fulcio certificate from Project Sigstore, the functionary can include checks on the x509 certificate extensions to validate fields like RunInvocationURI to differentiate links.
6. Improve Verification by Functionaries
   • Witness implements a pluggable model for create attestations. This captures information about the materials and products outside the scope of the observed process execution. Attestor lifecycle documentation: https://witness.dev/docs/docs/concepts/attestor#attestor-life-cycle
   • Properly implemented signing techniques from the Sigstore Project or SPIRE, adhering with SLSA level 3 isolation principals, capture materials and products in the control plane, separated from pipeline execution.
7. Clarify Position on PGP Support
   • We still need to add explicit documentation disclaiming support for this but, there is no claimed or documented support for PGP.
   • The current set of options for signing are documented here: https://witness.dev/docs/docs/commands#witness-sign

I'll update the above descriptions to better track this progress. Let us know if you have any further questions!