Introduction to Software Supply Chain Security & Tooling

Slide 1

Slide 1 text

Supply Chain Security Tooling

Slide 2

Slide 2 text

Welcome! Dependencies, Tutorials, Links to Slides: https://github.com/jeefy/sigstore-intro-tutorial

Slide 3

Slide 3 text

$ whoami - Bob Bob Killen bobkillen@linux.com OSS Program Manager @ Google Github: @mrbobbytables Twitter: @mrbobbytables Site: mrbobbytabl.es

Slide 4

Slide 4 text

$ whoami - Jeff Jeffrey Sica jeefy@linuxfoundation.org DevEx @ CNCF Github: @jeefy Twitter: @jeefy Site: jeefy.dev

Slide 5

Slide 5 text

Before We Begin https://docs.sigstore.dev/cosign/installation/

Slide 6

Slide 6 text

Before We Begin Pt. 2 Docker will be required to follow along with the demos. Docker is not required to use the tooling shown. https://docs.docker.com/engine/install/#desktop

Slide 7

Slide 7 text

Before We Begin Pt. 3 KinD (Kubernetes in Docker) and Helm will be used for later demos. https://kind.sigs.k8s.io/docs/user/quick-start/#installation https://helm.sh/docs/intro/install/

Slide 8

Slide 8 text

Disclaimer You should have some knowledge of containers and Kubernetes

Slide 9

Slide 9 text

Containers: Galaxy-scale overview ● Package an application with all of its dependencies (container image) ● Run instances of the packaged application (container) ● Think “Virtual Machine” but sharing kernel space and OS libraries (cgroups)

Slide 10

Slide 10 text

Kubernetes: Galaxy-scale overview ● “Container Orchestration” – It takes an entire orchestra to play a symphony ● Manages containers and their dependencies (Storage, Networking, third-party resources) in a declarative way ● 100% API Driven

Slide 11

Slide 11 text

So… What Is Supply Chain Security? Sourcing Inventory Production Planning Transportation

Slide 12

Slide 12 text

The “Software Supply Chain” Code Artifacts Distribution Dependencies Execution

Slide 13

Slide 13 text

Current State?

Slide 14

Slide 14 text

Current State https://www.bike-eu.com/market/nieuws/2022/01/imbalance-in-shipping-container-supply-chain-is-far-from-over-10142078

Slide 15

Slide 15 text

Current State https://www.bike-eu.com/market/nieuws/2022/01/imbalance-in-shipping-container-supply-chain-is-far-from-over-10142078

Slide 16

Slide 16 text

Current State https://www.cnbc.com/2021/03/26/satellite-images-of-ship-ever-given-in-suez-canal-shows-work-underway.html

Slide 17

Slide 17 text

Current State https://www.freightwaves.com/news/insurers-call-for-action-to-prevent-containership-fires

Slide 18

Slide 18 text

https://sonatype.com/resources/white-paper-2021-state-of-the-software-supply-chain-report-2021

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

Solarwinds Attack ● SolarWinds Orion network management tool’s build servers compromised ● Hack injected a malicious DLL at build time that was signed and distributed to clients automatically when they updated ● 18,000 SolarWinds customers including many Fortune 500 Companies, Government Agencies and Tier 1 Network Providers were impacted Project Trebuchet: How SolarWinds is Using Open Source to Secure Their Supply Chain in the Wake of the Sunburst Hack

Slide 21

Slide 21 text

Slide 22

Slide 22 text

https://sonatype.com/resources/white-paper-2021-state-of-the-software-supply-chain-report-2021

Slide 23

Slide 23 text

US Gov Policy Changes Executive Order 14028 - (Sec. 2) Remove barriers to threat information sharing between Government and the Private Sector - (Sec. 3) Modernize and implement stronger cybersecurity standards in the Federal Government - (Sec. 4) Improve Software Supply Chain Security - (Sec. 5) Establish a Cybersecurity Safety Review Board - (Sec. 6) Create a standard playbook for responding to cyber incidents - (Sec. 7) Improve Detection of Cybersecurity Incidents on Federal Government Networks - (Sec. 8) Improve Investigative and Remediation Capabilities

Slide 24

Slide 24 text

US Gov Policy Changes Executive Order 14028 - (Sec. 2) Remove barriers to threat information sharing between the Government and the Private Sector - (Sec. 3) Modernize and implement stronger cybersecurity standards in the Federal Government - (Sec. 4) Improve Software Supply Chain Security - (Sec. 5) Establish a Cybersecurity Safety Review Board - (Sec. 6) Create a standard playbook for responding to cyber incidents - (Sec. 7) Improve Detection of Cybersecurity Incidents on Federal Government Networks - (Sec. 8) Improve Investigative and Remediation Capabilities

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Slide 28

Slide 28 text

Slide 29

Slide 29 text

Slide 30

Slide 30 text

Slide 31

Slide 31 text

Slide 32

Slide 32 text

The Problem In A Nutshell

Slide 33

Slide 33 text

Supply Chain Attacks are on the rise and the Software Development Lifecycle has become a popular vector for attacks.

Slide 34

Slide 34 text

How can we trust the software we choose to run?

Slide 35

Slide 35 text

No content

Slide 36

Slide 36 text

A Reasonable Solution

Slide 37

Slide 37 text

SLSA

Slide 38

Slide 38 text

Supply chain Levels for Software Artifacts 💃 slsa.dev

Slide 39

Slide 39 text

Source Integrity Build Integrity Source Build Package Dev Dependencies Users Software Supply Chain Artifact Process

Slide 40

Slide 40 text

Source Integrity Build Integrity Source Build Package Dev Inject bad code (A) Compromise source control (B) Build from modiﬁed sources (C) Dependencies Compromise build system (D) Bypass CI/CD, inject bad artifact (F) Compromise package repository (G) Use bad package (H) Users Software Supply Chain: Vulnerability Points Artifact Process Inject bad or vulnerable dependency (E)

Slide 41

Slide 41 text

Source Integrity Build Integrity Source Build Package Dev Inject bad code (A) Compromise source control (B) Build from modiﬁed sources (C) Dependencies Compromise build system (D) Bypass CI/CD, inject bad artifact (F) Compromise package repository (G) Use bad package (H) Users Software Supply Chain: Trust Boundaries Artifact Process Inject bad or vulnerable dependency (E)

Slide 42

Slide 42 text

SLSA Levels Automation & Provenance Build must be fully scripted/automated and generate provenance Version Control & Signed Provenance Requires using version control and hosted build service that generates authenticated provenance Non-falsiﬁable, Ephemeral Builds are fully trustworthy, with identity attestations of underlying build infrastructure/hardware. Ephemeral builds leave nothing behind. Hermetic Builds, Review All build inputs/dependencies are speciﬁed upfront with no internet egress during the build. Two-party reviews. https://slsa.dev/spec/v0.1/requirements

Slide 43

Slide 43 text

Build Provenance Set of metadata that describes a software artifact and how it was built. SLSA spec ﬁelds* - subject - artifact(s) information (name+digest) - builder - the entity that produced the artifact(s) - invocation - execution command / information - buildConﬁg - record of steps executed during build - materials - other artifacts/dependencies used during build

Slide 44

Slide 44 text

Slide 45

Slide 45 text

Slide 46

Slide 46 text

{ "_type": "https://in-toto.io/Statement/v0.1", "subject": [{ ... }], "predicateType": "https://slsa.dev/provenance/v0.2", "predicate": { "builder": { "id": "" }, "buildType": "", "invocation": { "configSource": { "uri": "", "digest": { /* DigestSet */ }, "entryPoint": "" }, "parameters": { /* object */ }, "environment": { /* object */ } }, … … "buildConfig": { /* object */ }, "metadata": { "buildInvocationId": "", "buildStartedOn": "", "buildFinishedOn": "", "completeness": { "parameters": true/false, "environment": true/false, "materials": true/false }, "reproducible": true/false }, "materials": [ { "uri": "", "digest": { /* DigestSet */ } } ] }} builder - Entity that produced the artifact Examples: "builder": { "id": "mailto:person@example.com" } "builder": { "id": "https://github.com/Attestations/GitHubHostedActions@v1" } "builder": { "id": "https://gitlab.com/foo/bar/-/runners/12345678" }

Slide 47

Slide 47 text

{ "_type": "https://in-toto.io/Statement/v0.1", "subject": [{ ... }], "predicateType": "https://slsa.dev/provenance/v0.2", "predicate": { "builder": { "id": "" }, "buildType": "", "invocation": { "configSource": { "uri": "", "digest": { /* DigestSet */ }, "entryPoint": "" }, "parameters": { /* object */ }, "environment": { /* object */ } }, … … "buildConfig": { /* object */ }, "metadata": { "buildInvocationId": "", "buildStartedOn": "", "buildFinishedOn": "", "completeness": { "parameters": true/false, "environment": true/false, "materials": true/false }, "reproducible": true/false }, "materials": [ { "uri": "", "digest": { /* DigestSet */ } } ] }} invocation - Execution command / information Example: "invocation": { "configSource": { "uri": "git+https://github.com/foo/bar.git, "digest": { "sha1": "1234..."}, //git commit hash "entryPoint": "build.yaml:build" }, "parameters": {"inputs": {}}, "environment": { “arch”: “amd64”, "env": { "GITHUB_RUN_ID": "1234", "GITHUB_RUN_NUMBER": "5678", "GITHUB_EVENT_NAME": "push" } } }

Slide 48

Slide 48 text

{ "_type": "https://in-toto.io/Statement/v0.1", "subject": [{ ... }], "predicateType": "https://slsa.dev/provenance/v0.2", "predicate": { "builder": { "id": "" }, "buildType": "", "invocation": { "configSource": { "uri": "", "digest": { /* DigestSet */ }, "entryPoint": "" }, "parameters": { /* object */ }, "environment": { /* object */ } }, … … "buildConfig": { /* object */ }, "metadata": { "buildInvocationId": "", "buildStartedOn": "", "buildFinishedOn": "", "completeness": { "parameters": true/false, "environment": true/false, "materials": true/false }, "reproducible": true/false }, "materials": [ { "uri": "", "digest": { /* DigestSet */ } } ] }} materials - other artifacts/dependencies used during build Example: "materials": [{ "uri": "https://example.com/example-1.2.3.tar.gz", "digest": {"sha256": "1234..."} }] "materials": [{ "uri": "git+https://github.com/foo/bar.git", "digest": {"sha1": "abc..."} }]

Slide 49

Slide 49 text

{ "_type": "https://in-toto.io/Statement/v0.1", "subject": [{ ... }], "predicateType": "https://slsa.dev/provenance/v0.2", "predicate": { "builder": { "id": "" }, "buildType": "", "invocation": { "configSource": { "uri": "", "digest": { /* DigestSet */ }, "entryPoint": "" }, "parameters": { /* object */ }, "environment": { /* object */ } }, … … "buildConfig": { /* object */ }, "metadata": { "buildInvocationId": "", "buildStartedOn": "", "buildFinishedOn": "", "completeness": { "parameters": true/false, "environment": true/false, "materials": true/false }, "reproducible": true/false }, "materials": [ { "uri": "", "digest": { /* DigestSet */ } } ] }} buildConfig - record of steps executed during build Example: "buildConfig": { "steps": [ { "image": "pkg:docker/make@sha256:244fd47e07d1004f0aed9c", "arguments": ["build"] } ] } "buildConfig": { "commands": [ "./configure --enable-some-feature", "make foo.zip" ], "shell": "bash" }

Slide 50

Slide 50 text

{ "_type": "https://in-toto.io/Statement/v0.1", "subject": [{ ... }], "predicateType": "https://slsa.dev/provenance/v0.2", "predicate": { "builder": { "id": "" }, "buildType": "", "invocation": { "configSource": { "uri": "", "digest": { /* DigestSet */ }, "entryPoint": "" }, "parameters": { /* object */ }, "environment": { /* object */ } }, … … "buildConfig": { /* object */ }, "metadata": { "buildInvocationId": "", "buildStartedOn": "", "buildFinishedOn": "", "completeness": { "parameters": true/false, "environment": true/false, "materials": true/false }, "reproducible": true/false }, "materials": [ { "uri": "", "digest": { /* DigestSet */ } } ] }} subject - Artifact(s) information (name+digest) Examples: "subject": [{"name": "_", "digest": {"sha256": "5678..."}}] "subject": [ { "name": "herpderp.exe", "digest": {"sha256": "1234..."} }]

Slide 51

Slide 51 text

Software Attestation A software attestation is a signed set metadata (provenance) about one or more software artifacts. { "payload": "Gew9gICJzdWJqZWN0IjogWwogICAg...", "payloadType": "application/vnd.in-toto+json", "signatures": [{ "keyid": "my-awesome-builder-key", //optional "sig": "Re4ya66MyFyc9Y..." }] }

Slide 52

Slide 52 text

{ "payload": "Gew9gICJzdWJqZWN0IjogWwogICAg...", "payloadType": "application/vnd.in-toto+json", "signatures": [{ "keyid": "my-awesome-builder", "sig": "Re4ya66MyFyc9Y..." }] } { "_type": "https://in-toto.io/Statement/v0.1", "subject": [{ "name": "_", "digest": {"sha256": "5678..."} }], "predicateType": "https://slsa.dev/provenance/v0.2", "predicate": { "builder": { "id": "https://github.com/Attestations/GitHubHostedActions@v1" }, "buildType": "", "invocation": { "configSource": { "uri": "", "digest": { /* DigestSet */ }, "entryPoint": "" } …

Slide 53

Slide 53 text

Slide 54

Slide 54 text

Is There A Reasonable Technical Solution?

Slide 55

Slide 55 text

sigstore https://sigstore.dev

Slide 56

Slide 56 text

Community Driven

Slide 57

Slide 57 text

Community Driven

Slide 58

Slide 58 text

Let’s Encrypt? Let’s Sign.

Slide 59

Slide 59 text

No content

Slide 60

Slide 60 text

An Overview Of sigstore ● fulcio ● rekor ● cosign

Slide 61

Slide 61 text

An Overview Of sigstore ● fulcio ○ Identity ● rekor ○ Immutable log with artifact metadata ● cosign ○ Utility to automate combining fulcio, rekor, and OCI-compliant artifacts ○ Utilizes underlying sigstore libraries

Slide 62

Slide 62 text

fulcio Free Root-CA for code signing certs - issuing certiﬁcates based on an OIDC email address fulcio only signs short-lived certiﬁcates that are valid for under 20 minutes https://docs.sigstore.dev/fulcio/overview https://github.com/sigstore/fulcio

Slide 63

Slide 63 text

fulcio Free Root-CA for code signing certs - issuing certiﬁcates based on an OIDC email address. fulcio only signs short-lived certiﬁcates that are valid for under 20 minutes. https://twitter.com/jacques_chester/status/1506332697387491335

Slide 64

Slide 64 text

rekor Greek for “Record” rekor is a transparency log where anyone can ﬁnd and verify signatures, and check whether someone’s changed the source code, the build platform or the artifact repository. https://docs.sigstore.dev/rekor/overview https://github.com/sigstore/rekor

Slide 65

Slide 65 text

cosign cosign: Container Signing, veriﬁcation and storage in an OCI registry “Make signatures invisible infrastructure” Pluggable components https://docs.sigstore.dev/cosign/overview https://github.com/sigstore/cosign

Slide 66

Slide 66 text

How it works! https://www.sigstore.dev/how-it-works

Slide 67

Slide 67 text

The. Demo.

Slide 68

Slide 68 text

Demo Recap ● Built a container ● Auth’d using cosign ● Signed a container using cosign ● Inspected the container’s signature using cosign

Slide 69

Slide 69 text

Cool I have a signed container. Now what?

Slide 70

Slide 70 text

Kubernetes Admission Webhooks Lightweight extensible way to “do something” with API Server requests Two kinds: - Validating Admission Webhook - Mutating Admission Webhook

Slide 71

Slide 71 text

Kubernetes Admission Webhooks Lightweight extensible way to “do something” with API Server requests Two kinds: - Validating Admission Webhook - Mutating Admission Webhook

Slide 72

Slide 72 text

Kubernetes Admission Webhooks … webhooks: - name: "pod-policy.example.com" rules: - apiGroups: [""] apiVersions: ["v1"] operations: ["CREATE"] resources: ["pods"] scope: "Namespaced"

Slide 73

Slide 73 text

Kubernetes Admission Webhooks Lightweight extensible way to “do something” with API Server requests Two kinds: - Validating Admission Webhook - Mutating Admission Webhook

Slide 74

Slide 74 text

sigstore Policy Controller … apiVersion: policy.sigstore.dev/v1beta1 kind: ClusterImagePolicy metadata: name: image-policy spec: images: - glob: "**"

Slide 75

Slide 75 text

sigstore Policy Controller … apiVersion: policy.sigstore.dev/v1beta1 kind: ClusterImagePolicy metadata: name: image-policy spec: images: - glob: "**" Beta

Slide 76

Slide 76 text

Kubernetes native policy engine Entirely CRD-based https://kyverno.io

Slide 77

Slide 77 text

Demo: Part Deux

Slide 78

Slide 78 text

Demo Recap ● Installed Kyverno ● Attempted to create a Pod with an unsigned container image ● Successfully created a Pod with a signed container image Task Failed Successfully!

Slide 79

Slide 79 text

Demo Recap ● Installed the Kyverno ● Attempted to create a Pod with an unsigned container image ● Successfully created a Pod with a signed container image Task Failed Successfully!

Slide 80

Slide 80 text

kyverno is https://kyverno.io powerful configurable complicated

Slide 81

Slide 81 text

Let’s Talk Automation

Slide 82

Slide 82 text

https://github.blog/2021-12-06-safeguard-container-signing-capability-actions/

Slide 83

Slide 83 text

https://github.blog/2021-12-06-safeguard-container-signing-capability-actions/

Slide 84

Slide 84 text

GitHub Action jobs: test_cosign_action: runs-on: ubuntu-latest permissions: {} name: Install Cosign and test presence in path steps: - name: Install Cosign uses: sigstore/cosign-installer@main - name: Check install! run: cosign version https://github.com/sigstore/cosign-installer

Slide 85

Slide 85 text

GitHub Action … - name: Sign image with a key run: | cosign sign --key env://COSIGN_PRIVATE_KEY ${TAGS} env: TAGS: ${{ steps.docker_meta.outputs.tags }} COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}} COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}} https://github.com/sigstore/cosign-installer

Slide 86

Slide 86 text

Batteries included support for cosign Create a secret called signing-secrets with the following structure: ● cosign.key ● cosign.password cosign generate-key-pair k8s://tekton-chains/signing-secrets Tekton (Chains)

Slide 87

Slide 87 text

“Demo”: The Third

Slide 88

Slide 88 text

Demo Recap ● Set up GitHub Action ● Use cosign to sign the image ● Use SLSA tooling to generate attestation ● User cosign to attach attestation in rekor ● Inspected and veriﬁed the image and SLSA payload

Slide 89

Slide 89 text

sigstore: Not Just Containers

Slide 90

Slide 90 text

Rust Crate Signing

Slide 91

Slide 91 text

PyPi Signing https://pypi.org/project/sigstore/

Slide 92

Slide 92 text

sigstore: Not Just Artifacts

Slide 93

Slide 93 text

gitsign Keyless Git signing with Sigstore! Homebrew: brew install sigstore/tap/gitsign Go: go install github.com/sigstore/gitsign@latest

Slide 94

Slide 94 text

gitsign # Sign all commits git config --global commit.gpgsign true # Sign all tags git config --global tag.gpgsign true # Use gitsign for signing git config --global gpg.x509.program gitsign # gitsign expects x509 args git config --global gpg.format x509 https://github.com/sigstore/gitsign

Slide 95

Slide 95 text

Demo #4

Slide 96

Slide 96 text

Demo Recap ● Signed a git commit with gitsign ● Inspected the rekor log of the commit

Slide 97

Slide 97 text

Tutorial Recap ● Supply chain security is an increasing concern when building, shipping, and running code. ● The SLSA framework can be used to enable or improve trust in the software that we build and run.

Slide 98

Slide 98 text

Tutorial Recap ● sigstore looks to solve supply chain security with an end to end solution based on linking Identity and TLS certiﬁcates ● Automating SLSA provenance generation and artifact signing lowers the mental load on developers shipping software

Slide 99

Slide 99 text

Tutorial Recap ● Starts with Containers / OCI-compliant artifacts ● Already moving further down the stack to packages

Slide 100

Slide 100 text

Secure Distribution By Default

Slide 101

Slide 101 text

Thanks + Q&A A @mrbobbytables + @jeefy Production

Slide 102

Slide 102 text

Graveyard

Slide 103

Slide 103 text

No content

Slide 104

Slide 104 text

SLSA Framework Build Integrity ● Modiﬁcation of code after source control ● Compromised build platforms ● Bypassing CI/CD Source Integrity ● Available change history ● Code review ● Compromised source control systems Dependencies ● Applying SLSA checks recursively to dependencies ● Dependency confusion