OCI-attach reports from `clair-scan` 0.2 Task #1483

zregvart · 2024-09-30T14:23:59Z

This attaches the "clair"-formatted output of the clair-action command to the scanned image. Contrary to the sast-snyk-check Task only a single variant of attachment method is supported, based on the registry support. For quay.io OCI Distribution 1.1. Referrers API will be used.

The clair-action needs to be run twice as the Rego rules executed in the conftest-vulnerabilities require the "quay" format, which does not include any date information, whereas the (future) EC policy Rego rules require the "clair" format, which does.

Resolves: https://issues.redhat.com/browse/EC-837

Notes for reviewers:

should this be uploading both OCI 1.1 distribution referrers tag and API variants, analogous to the sast-snyk-check Task?
is there a better MIME type other than application/vnd.redhat.clair-report+json that could be used?
should the report be transformed into a in-toto enveloped vuln predicate attestation and attached as such?

lcarva · 2024-09-30T20:06:38Z

should the report be transformed into a in-toto enveloped vuln predicate attestation and attached as such?

Probably, but Konflux is not setup for this now.

task/clair-scan/0.2/clair-scan.yaml

lcarva · 2024-09-30T20:12:02Z

task/clair-scan/0.2/clair-scan.yaml

+        echo "Selecting auth"
+        select-oci-auth "$IMAGE_URL" > "$HOME/auth.json"
+
+        base_image="${IMAGE_URL/:*/}"


Maybe let's call this something like repository? "Base image" has a different meaning that may cause confusion.

lcarva · 2024-09-30T20:16:23Z

task/clair-scan/0.2/clair-scan.yaml

+        for f in clair-report-*.json; do
+          image_ref="${base_image}@$(cat "image-manifest-$(arch "$f").sha")"
+          echo "Attaching $f to ${image_ref}"
+          oras attach --no-tty --registry-config "$HOME/auth.json" --artifact-type "${MEDIA_TYPE}" "${image_ref}" "$f:${MEDIA_TYPE}"


On the EC side, we can't trust this information since there's no guarantee that the attached data was actually produced by this Task. Anyone with access to the registry can easily fake the report. This data is informative at best.

This Task needs to emit a digest of the expected data.

If we had identity-based signatures (keyless) enabled in Konflux, we would still need to do this since in that case users could still fake a report via some rogue Pipeline. Slightly harder, but not a risk we should take.

I did remember that after pushing, will run up against the result limit though...

Yeah, we may have to create a combined result of some sort. You could, for example, put them altogether in an Image Index.

zregvart · 2024-10-02T08:20:16Z

should the report be transformed into a in-toto enveloped vuln predicate attestation and attached as such?

Probably, but Konflux is not setup for this now.

We can choose to use the format, regardless of the attestation being signed or not

simonbaird · 2024-10-02T19:41:42Z

pipelines/docker-build-multi-platform-oci-ta/README.md

@@ -214,6 +214,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
 |name|description|used in params (taskname:taskrefversion:taskparam)
 |---|---|---|
 |IMAGES_PROCESSED| Images processed in the task.| |
+|REPORTS| Mapping of image digests to report digests| |


simonbaird · 2024-10-02T19:43:04Z

task/clair-scan/0.2/README.md

+|-------------------|------------------------------------------|
+| TEST_OUTPUT       | Tekton task test output.                 |
+| SCAN_OUTPUT       | Clair scan result.                       |
+| REPORTS           |Mapping of image digests to report digests|


task/clair-scan/0.2/clair-scan.yaml

This attaches the "clair"-formatted output of the `clair-action` command to the scanned image. Contrary to the `sast-snyk-check` Task only a single variant of attachment method is supported, based on the registry support. For quay.io OCI Distribution 1.1. Referrers API will be used. The `clair-action` needs to be run twice as the Rego rules executed in the `conftest-vulnerabilities` require the "quay" format, which does not include any date information, whereas the (future) EC policy Rego rules require the "clair" format, which does. Resolves: https://issues.redhat.com/browse/EC-837

lcarva · 2024-10-03T20:47:23Z

should the report be transformed into a in-toto enveloped vuln predicate attestation and attached as such?

Probably, but Konflux is not setup for this now.

We can choose to use the format, regardless of the attestation being signed or not

The benefit the format would bring is that it links the data to a predicate (image). You are doing that already in the REPORTS result. Using an in-toto envelope would standardize that. I don't think it covers any gaps though.

lcarva · 2024-10-03T20:52:02Z

should this be uploading both OCI 1.1 distribution referrers tag and API variants, analogous to the sast-snyk-check Task?

For posterity, in the arch meeting it was mentioned that double uploading may cause some issues. The Tasks that were doing it, no longer do it, see c746a25.

is there a better MIME type other than application/vnd.redhat.clair-report+json that could be used?

I think this one is reasonable since it is a completely custom format.

zregvart · 2024-10-04T09:04:42Z

Last call for discussions:

the result name (REPORTS vs REPORT_MAP vs REPORT_REFS), the REPORTS suits me fine because it is short and I don't need to change anything
using in-toto + vuln predicate, would be nice, though doesn't seem to address an issue we have
using image index for the reports, would be better to keep the result smaller, a new step would need to be added for this, probably utilizing quay.io/konflux-ci/buildah-task

I'm lazy to take on more work here and I'm hovering over the merge button. Let me know if you feel strongly about any of this.

jsztuka · 2024-10-04T12:02:58Z

Im team REPORTS only.
Bullet point 3 looks like candidate for follow up story. If it turns out we want it.

jsztuka

lgtm

jsztuka · 2024-10-04T12:03:30Z

Great work, thanks!

zregvart · 2024-10-04T12:37:19Z

Thanks for the reviews/feedback!

openshift-ci bot requested review from Josh-Everett and sonam1412 September 30, 2024 14:24

zregvart force-pushed the issue/EC-837 branch from 0ff6e35 to 2078931 Compare September 30, 2024 14:25

lcarva reviewed Sep 30, 2024

View reviewed changes

simonbaird approved these changes Sep 30, 2024

View reviewed changes

zregvart force-pushed the issue/EC-837 branch 6 times, most recently from d94e785 to c4749cf Compare October 2, 2024 12:55

simonbaird reviewed Oct 2, 2024

View reviewed changes

task/clair-scan/0.2/clair-scan.yaml Show resolved Hide resolved

simonbaird approved these changes Oct 2, 2024

View reviewed changes

zregvart force-pushed the issue/EC-837 branch from c4749cf to a87adda Compare October 3, 2024 09:43

zregvart force-pushed the issue/EC-837 branch from a87adda to cf02ca6 Compare October 3, 2024 12:36

lcarva approved these changes Oct 3, 2024

View reviewed changes

jsztuka approved these changes Oct 4, 2024

View reviewed changes

zregvart added this pull request to the merge queue Oct 4, 2024

github-merge-queue bot removed this pull request from the merge queue due to failed status checks Oct 4, 2024

zregvart added this pull request to the merge queue Oct 4, 2024

Merged via the queue into konflux-ci:main with commit d66d95d Oct 4, 2024
14 checks passed

rh-tap-build-team bot mentioned this pull request Oct 4, 2024

build-definitions update redhat-appstudio/infra-deployments#4605

Closed

zregvart deleted the issue/EC-837 branch October 4, 2024 15:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCI-attach reports from `clair-scan` 0.2 Task #1483

OCI-attach reports from `clair-scan` 0.2 Task #1483

zregvart commented Sep 30, 2024 •

edited

Loading

lcarva commented Sep 30, 2024

lcarva Sep 30, 2024 •

edited

Loading

lcarva Sep 30, 2024

zregvart Oct 2, 2024

lcarva Oct 2, 2024

zregvart commented Oct 2, 2024

simonbaird Oct 2, 2024

simonbaird Oct 2, 2024

lcarva commented Oct 3, 2024

lcarva commented Oct 3, 2024

zregvart commented Oct 4, 2024

jsztuka commented Oct 4, 2024

jsztuka left a comment

jsztuka commented Oct 4, 2024

zregvart commented Oct 4, 2024

	\|REPORTS\| Mapping of image digests to report digests\| \|
	\|REPORT_MAP\| Mapping of image digests to report digests\| \|

	\|REPORTS\| Mapping of image digests to report digests\| \|
	\|REPORT_REFS\| Mapping of image digests to report digests\| \|

	\| REPORTS \|Mapping of image digests to report digests\|
	\| REPORT_REFS \|Mapping of image digests to report digests in JSON format\|

OCI-attach reports from clair-scan 0.2 Task #1483

OCI-attach reports from clair-scan 0.2 Task #1483

Conversation

zregvart commented Sep 30, 2024 • edited Loading

lcarva commented Sep 30, 2024

lcarva Sep 30, 2024 • edited Loading

Choose a reason for hiding this comment

lcarva Sep 30, 2024

Choose a reason for hiding this comment

zregvart Oct 2, 2024

Choose a reason for hiding this comment

lcarva Oct 2, 2024

Choose a reason for hiding this comment

zregvart commented Oct 2, 2024

simonbaird Oct 2, 2024

Choose a reason for hiding this comment

simonbaird Oct 2, 2024

Choose a reason for hiding this comment

lcarva commented Oct 3, 2024

lcarva commented Oct 3, 2024

zregvart commented Oct 4, 2024

jsztuka commented Oct 4, 2024

jsztuka left a comment

Choose a reason for hiding this comment

jsztuka commented Oct 4, 2024

zregvart commented Oct 4, 2024

OCI-attach reports from `clair-scan` 0.2 Task #1483

OCI-attach reports from `clair-scan` 0.2 Task #1483

zregvart commented Sep 30, 2024 •

edited

Loading

lcarva Sep 30, 2024 •

edited

Loading