Add images signatures verification with containers/image

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

Author: runcom

Dockerfile

@@ -93,6 +93,8 @@ RUN apt-get update && apt-get install -y \
 	python-mock \
 	python-pip \
 	zip \
+	gpgme-devel \
+	libassuan-devel \
 	&& pip install awscli==1.10.15
 # Get lvm2 source for compiling statically
 ENV LVM2_VERSION 2.02.103
@@ -257,6 +259,20 @@ COPY hack/dockerfile/binaries-commits /tmp/binaries-commits
 COPY hack/dockerfile/install-binaries.sh /tmp/install-binaries.sh
 RUN /tmp/install-binaries.sh tomlv vndr runc containerd tini proxy bindata
 
+# Install skopeo
+ENV SKOPEO_COMMIT v0.1.16
+RUN set -x \
+	&& export GOPATH="$(mktemp -d)" \
+	&& git clone https://github.com/projectatomic/skopeo.git "$GOPATH/src/github.com/projectatomic/skopeo" \
+	&& cd "$GOPATH/src/github.com/projectatomic/skopeo" \
+	&& git checkout -q "$SKOPEO_COMMIT" \
+	&& make binary-local \
+	&& cp skopeo /usr/local/bin/skopeo \
+	&& mkdir -p /var/lib/atomic/sigstore \
+	&& mkdir -p /etc/containers/registries.d \
+	&& cp default-policy.json /etc/containers/policy.json \
+	&& rm -rf "$GOPATH"
+
 # Wrap all commands in the "docker-in-docker" script to allow nested containers
 ENTRYPOINT ["hack/dind"]
 

daemon/config_unix.go

@@ -36,6 +36,7 @@ type Config struct {
 	Init                 bool                     `json:"init,omitempty"`
 	InitPath             string                   `json:"init-path,omitempty"`
 	SeccompProfile       string                   `json:"seccomp-profile,omitempty"`
+	SigCheck             bool                     `json:"signature-verification"`
 }
 
 // bridgeConfig stores all the bridge driver specific
@@ -89,6 +90,7 @@ func (config *Config) InstallFlags(flags *pflag.FlagSet) {
 	flags.Int64Var(&config.CPURealtimePeriod, "cpu-rt-period", 0, "Limit the CPU real-time period in microseconds")
 	flags.Int64Var(&config.CPURealtimeRuntime, "cpu-rt-runtime", 0, "Limit the CPU real-time runtime in microseconds")
 	flags.StringVar(&config.SeccompProfile, "seccomp-profile", "", "Path to seccomp profile")
+	flags.BoolVar(&config.SigCheck, "signature-verification", true, "Check image's signatures on pull")
 
 	config.attachExperimentalFlags(flags)
 }

daemon/image_pull.go

@@ -92,6 +92,7 @@ func (daemon *Daemon) pullImageWithReference(ctx context.Context, ref reference.
 		},
 		DownloadManager: daemon.downloadManager,
 		Schema2Types:    distribution.ImageTypes,
+		SignatureCheck:  daemon.configStore.SigCheck,
 	}
 
 	err := distribution.Pull(ctx, ref, imagePullConfig)

distribution/config.go

@@ -58,6 +58,8 @@ type ImagePullConfig struct {
 	// Schema2Types is the valid schema2 configuration types allowed
 	// by the pull operation.
 	Schema2Types []string
+	// SignatureCheck controls whether to check image's signatures or not
+	SignatureCheck bool
 }
 
 // ImagePushConfig stores push configuration.

distribution/pull.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/containers/image/signature"
 	"github.com/docker/distribution/digest"
 	"github.com/docker/docker/api"
 	"github.com/docker/docker/distribution/metadata"
@@ -28,13 +29,22 @@ type Puller interface {
 // through to the underlying puller implementation for use during the actual
 // pull operation.
 func newPuller(endpoint registry.APIEndpoint, repoInfo *registry.RepositoryInfo, imagePullConfig *ImagePullConfig) (Puller, error) {
+	var pc *signature.PolicyContext
+	if imagePullConfig.SignatureCheck {
+		var err error
+		pc, err = configurePolicyContext()
+		if err != nil {
+			return nil, err
+		}
+	}
 	switch endpoint.Version {
 	case registry.APIVersion2:
 		return &v2Puller{
 			V2MetadataService: metadata.NewV2MetadataService(imagePullConfig.MetadataStore),
 			endpoint:          endpoint,
 			config:            imagePullConfig,
 			repoInfo:          repoInfo,
+			policyContext:     pc,
 		}, nil
 	case registry.APIVersion1:
 		return &v1Puller{
@@ -68,15 +78,13 @@ func Pull(ctx context.Context, ref reference.Named, imagePullConfig *ImagePullCo
 		fqr, err := reference.QualifyUnqualifiedReference(ref, r)
 		if err != nil {
 			errStr := fmt.Sprintf("Failed to fully qualify %q name with %q registry: %v", ref.Name(), r, err)
-			progress.Message(imagePullConfig.ProgressOutput, "", errStr)
 			if i == len(registry.DefaultRegistries)-1 {
 				return fmt.Errorf(errStr)
 			}
 			continue
 		}
 		if err := pullFromRegistry(ctx, fqr, imagePullConfig); err != nil {
 			// make sure we get a final "Error response from daemon: "
-			progress.Message(imagePullConfig.ProgressOutput, "", err.Error())
 			if i == len(registry.DefaultRegistries)-1 {
 				return err
 			}

distribution/pull_v2.go

@@ -11,6 +11,7 @@ import (
 	"runtime"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/containers/image/signature"
 	"github.com/docker/distribution"
 	"github.com/docker/distribution/digest"
 	"github.com/docker/distribution/manifest/manifestlist"
@@ -57,6 +58,9 @@ type v2Puller struct {
 	// confirmedV2 is set to true if we confirm we're talking to a v2
 	// registry. This is used to limit fallbacks to the v1 protocol.
 	confirmedV2 bool
+
+	policyContext *signature.PolicyContext
+	originalRef   reference.Named
 }
 
 func (p *v2Puller) Pull(ctx context.Context, ref reference.Named) (err error) {
@@ -91,16 +95,26 @@ func (p *v2Puller) Pull(ctx context.Context, ref reference.Named) (err error) {
 func (p *v2Puller) pullV2Repository(ctx context.Context, ref reference.Named) (err error) {
 	var layersDownloaded bool
 	if !reference.IsNameOnly(ref) {
+		var err error
+		if p.config.SignatureCheck {
+			ref, err = p.checkTrusted(ctx, ref)
+			if err != nil {
+				// do not fallback to v1 is there was any error checking image's signatures
+				return err
+			}
+		}
 		layersDownloaded, err = p.pullV2Tag(ctx, ref)
 		if err != nil {
 			return err
 		}
 	} else {
 		tags, err := p.repo.Tags(ctx).All(ctx)
 		if err != nil {
-			// If this repository doesn't exist on V2, we should
-			// permit a fallback to V1.
-			return allowV1Fallback(err)
+			if p.config.SignatureCheck {
+				return err
+			} else {
+				return allowV1Fallback(err)
+			}
 		}
 
 		// The v2 registry knows about this repository, so we will not
@@ -113,7 +127,17 @@ func (p *v2Puller) pullV2Repository(ctx context.Context, ref reference.Named) (e
 			if err != nil {
 				return err
 			}
-			pulledNew, err := p.pullV2Tag(ctx, tagRef)
+			var ref reference.Named
+			ref = tagRef
+			if p.config.SignatureCheck {
+				trustedRef, err := p.checkTrusted(ctx, tagRef)
+				if err != nil {
+					p.originalRef = nil
+					return err
+				}
+				ref = trustedRef
+			}
+			pulledNew, err := p.pullV2Tag(ctx, ref)
 			if err != nil {
 				// Since this is the pull-all-tags case, don't
 				// allow an error pulling a particular tag to
@@ -129,7 +153,11 @@ func (p *v2Puller) pullV2Repository(ctx context.Context, ref reference.Named) (e
 		}
 	}
 
-	writeStatus(ref.String(), p.config.ProgressOutput, layersDownloaded)
+	if p.originalRef != nil {
+		writeStatus(p.originalRef.String(), p.config.ProgressOutput, layersDownloaded)
+	} else {
+		writeStatus(ref.String(), p.config.ProgressOutput, layersDownloaded)
+	}
 
 	return nil
 }
@@ -341,7 +369,11 @@ func (p *v2Puller) pullV2Tag(ctx context.Context, ref reference.Named) (tagUpdat
 	if tagged, isTagged := ref.(reference.NamedTagged); isTagged {
 		manifest, err = manSvc.Get(ctx, "", distribution.WithTag(tagged.Tag()))
 		if err != nil {
-			return false, allowV1Fallback(err)
+			if p.config.SignatureCheck {
+				return false, err
+			} else {
+				return false, allowV1Fallback(err)
+			}
 		}
 		tagOrDigest = tagged.Tag()
 	} else if digested, isDigested := ref.(reference.Canonical); isDigested {
@@ -416,6 +448,11 @@ func (p *v2Puller) pullV2Tag(ctx context.Context, ref reference.Named) (tagUpdat
 		oldTagID, err := p.config.ReferenceStore.Get(ref)
 		if err == nil {
 			if oldTagID == id {
+				if p.config.SignatureCheck {
+					if err := p.addTrustedTag(id); err != nil {
+						return false, err
+					}
+				}
 				return false, addDigestReference(p.config.ReferenceStore, ref, manifestDigest, id)
 			}
 		} else if err != reference.ErrDoesNotExist {
@@ -426,6 +463,11 @@ func (p *v2Puller) pullV2Tag(ctx context.Context, ref reference.Named) (tagUpdat
 			if err = p.config.ReferenceStore.AddDigest(canonical, id, true); err != nil {
 				return false, err
 			}
+			if p.config.SignatureCheck {
+				if err := p.addTrustedTag(id); err != nil {
+					return false, err
+				}
+			}
 		} else {
 			if err = addDigestReference(p.config.ReferenceStore, ref, manifestDigest, id); err != nil {
 				return false, err
@@ -438,6 +480,17 @@ func (p *v2Puller) pullV2Tag(ctx context.Context, ref reference.Named) (tagUpdat
 	return true, nil
 }
 
+func (p *v2Puller) addTrustedTag(id digest.Digest) error {
+	if p.policyContext != nil {
+		if _, ok := p.originalRef.(reference.Canonical); !ok {
+			if err := p.config.ReferenceStore.AddTag(p.originalRef, id, true); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
 func (p *v2Puller) pullSchema1(ctx context.Context, ref reference.Named, unverifiedManifest *schema1.SignedManifest) (id digest.Digest, manifestDigest digest.Digest, err error) {
 	var verifiedManifest *schema1.Manifest
 	verifiedManifest, err = verifySchema1Manifest(unverifiedManifest, ref)

distribution/pull_v2_unix.go

@@ -3,11 +3,89 @@
 package distribution
 
 import (
+	"fmt"
+
+	"github.com/containers/image/docker"
+	containersImageRef "github.com/containers/image/docker/reference"
+	"github.com/containers/image/manifest"
+	"github.com/containers/image/signature"
+	"github.com/containers/image/types"
 	"github.com/docker/distribution"
 	"github.com/docker/distribution/context"
+	"github.com/docker/distribution/digest"
+	"github.com/docker/docker/dockerversion"
+	"github.com/docker/docker/reference"
+	"github.com/docker/docker/registry"
+	gctx "golang.org/x/net/context"
 )
 
 func (ld *v2LayerDescriptor) open(ctx context.Context) (distribution.ReadSeekCloser, error) {
 	blobs := ld.repo.Blobs(ctx)
 	return blobs.Open(ctx, ld.digest)
 }
+
+func configurePolicyContext() (*signature.PolicyContext, error) {
+	defaultPolicy, err := signature.DefaultPolicy(nil)
+	if err != nil {
+		return nil, err
+	}
+	pc, err := signature.NewPolicyContext(defaultPolicy)
+	if err != nil {
+		return nil, err
+	}
+	return pc, nil
+}
+
+func (p *v2Puller) checkTrusted(c gctx.Context, ref reference.Named) (reference.Named, error) {
+	p.originalRef = ref
+	// we can't use upstream docker/docker/reference since in projectatomic/docker
+	// we modified docker/docker/reference and it's not doing any normalization.
+	// we instead forked docker/docker/reference in containers/image and we need
+	// this parsing here to make sure signature naming checks are consistent.
+	dockerRef, err := containersImageRef.ParseNamed(ref.String())
+	if err != nil {
+		return nil, err
+	}
+	imgRef, err := docker.NewReference(dockerRef)
+	if err != nil {
+		return nil, err
+	}
+	isSecure := (p.endpoint.TLSConfig == nil || !p.endpoint.TLSConfig.InsecureSkipVerify)
+	authConfig := registry.ResolveAuthConfig(p.config.AuthConfigs, p.repoInfo.Index)
+	dockerAuthConfig := types.DockerAuthConfig{
+		Username: authConfig.Username,
+		Password: authConfig.Password,
+	}
+	ctx := &types.SystemContext{
+		DockerInsecureSkipTLSVerify: !isSecure,
+		DockerAuthConfig:            &dockerAuthConfig,
+		DockerRegistryUserAgent:     dockerversion.DockerUserAgent(c),
+	}
+	img, err := imgRef.NewImage(ctx)
+	if err != nil {
+		return nil, err
+	}
+	allowed, err := p.policyContext.IsRunningImageAllowed(img)
+	if !allowed {
+		if err != nil {
+			return nil, fmt.Errorf("%s isn't allowed: %v", ref.String(), err)
+		}
+		return nil, fmt.Errorf("%s isn't allowed", ref.String())
+	}
+	if err != nil {
+		return nil, err
+	}
+	mfst, _, err := img.Manifest()
+	if err != nil {
+		return nil, err
+	}
+	dgst, err := manifest.Digest(mfst)
+	if err != nil {
+		return nil, err
+	}
+	ref, err = reference.WithDigest(ref, digest.Digest(dgst))
+	if err != nil {
+		return nil, err
+	}
+	return ref, nil
+}

distribution/pull_v2_windows.go

@@ -7,10 +7,13 @@ import (
 	"os"
 
 	"github.com/Sirupsen/logrus"
+	"github.com/containers/image/signature"
 	"github.com/docker/distribution"
 	"github.com/docker/distribution/context"
 	"github.com/docker/distribution/manifest/schema2"
 	"github.com/docker/distribution/registry/client/transport"
+	"github.com/docker/docker/reference"
+	gctx "golang.org/x/net/context"
 )
 
 var _ distribution.Describable = &v2LayerDescriptor{}
@@ -47,3 +50,11 @@ func (ld *v2LayerDescriptor) open(ctx context.Context) (distribution.ReadSeekClo
 	}
 	return rsc, err
 }
+
+func configurePolicyContext() (*signature.PolicyContext, error) {
+	return nil, nil
+}
+
+func (p *v2Puller) checkTrusted(c gctx.Context, ref reference.Named) (reference.Named, error) {
+	return ref, nil
+}

hack/make.sh

@@ -266,6 +266,18 @@ install_binary() {
 	fi
 }
 
+install_policy() {
+	file="$1"
+	target="/etc/containers/policy.json"
+	if [ "$(go env GOOS)" == "linux"  ]; then
+		if [ ! -e "/etc/containers/policy.json" ]; then
+			echo "Installing $(basename $file) to ${target}"
+			mkdir -p /etc/containers
+			cp -L "$file" "$target"
+		fi
+	fi
+}
+
 main() {
 	# We want this to fail if the bundles already exist and cannot be removed.
 	# This is to avoid mixing bundles from different versions of the code.

hack/make/.integration-daemon-start

@@ -16,6 +16,8 @@ if [ "$(go env GOOS)" = 'windows' ]; then
        return
 fi
 
+install_policy "$base/../../policy.json"
+
 if [ -z "$DOCKER_TEST_HOST" ]; then
 	if docker version &> /dev/null; then
 		echo >&2 'skipping daemon start, since daemon appears to be already started'