Generate and verify cosign signatures using openssl

Snippet that uses openssl to verify a cosign signature
Demonstrates the manifest and image hash calculation using cosign
ref
# start with an image
export IMAGE="gcr.io/distroless/static-debian11@sha256:e7e79fb2947f38ce0fab6061733f7e1959c12b843079042fe13f56ca7b9d178c"

# create a private key manually to import into cosign
openssl genrsa -out priv.pem 2048

cosign import-key-pair --key priv.pem

# sign using cosign
cosign sign --key=import-cosign.key  --tlog-upload=false  -a timestamp=12344 --upload=false --output-signature=signature.dat --output-payload=payload.dat --tlog-upload=false  $IMAGE


$ cat payload.dat | jq '.'
{
  "critical": {
    "identity": {
      "docker-reference": "gcr.io/distroless/static-debian11"
    },
    "image": {
      "docker-manifest-digest": "sha256:e7e79fb2947f38ce0fab6061733f7e1959c12b843079042fe13f56ca7b9d178c"
    },
    "type": "cosign container image signature"
  },
  "optional": {
    "timestamp": "12344"
  }
}

$ cat signature.dat 
    I26TU/Z2j194EgoR83Np7X2rhStZQ82uZrWZ5pKGxAqFn864fNCRAPc0ELfo6xlfRYp1COmtscSFJ6wjM+wiiF1F6MY4Qfm1GZaEjPmnOCW8ecMUB85HrN9CoYyIs8EkMwh52s8sAU5qvfG7rQIHkS+D+Tbphw9XG7pnAYYYu9opUY6bORt8eHwfwC7R8RP+BgDh2uv4sJMun9Q6nYOyx0hE4xtTNRE5hbqi8weOvFOcFQVclOFOuywWLqijYBoAfDN78Gi7IFN4+Cw202PTX9UgNZC40qVe3UD5sK9BBshh0eYlQDKBqgaLDkDDA03PvqIdLSrMhDx4E+QuwjW88w=

# verify using cosign
$ cosign verify  --key import-cosign.pub --signature=signature.dat --payload=payload.dat --insecure-ignore-tlog=true $IMAGE | jq '.'


Verification for gcr.io/distroless/static-debian11@sha256:e7e79fb2947f38ce0fab6061733f7e1959c12b843079042fe13f56ca7b9d178c --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
[
  {
    "critical": {
      "identity": {
        "docker-reference": "gcr.io/distroless/static-debian11"
      },
      "image": {
        "docker-manifest-digest": "sha256:e7e79fb2947f38ce0fab6061733f7e1959c12b843079042fe13f56ca7b9d178c"
      },
      "type": "cosign container image signature"
    },
    "optional": {
      "timestamp": "12344"
    }
  }
]





# use crane to create the manifest
$ crane  manifest $IMAGE  > manifest.json

# calculate the hash of the manifest; this is the image digest itself
$ sha256sum manifest.json
    e7e79fb2947f38ce0fab6061733f7e1959c12b843079042fe13f56ca7b9d178c  manifest.json

# now create the cosign signature JSON file itself.  note this includes the manifest/digest from above
$ cosign generate  -a timestamp=12344 $IMAGE | jq '.'
{
  "critical": {
    "identity": {
      "docker-reference": "gcr.io/distroless/static-debian11"
    },
    "image": {
      "docker-manifest-digest": "sha256:e7e79fb2947f38ce0fab6061733f7e1959c12b843079042fe13f56ca7b9d178c"
    },
    "type": "cosign container image signature"
  },
  "optional": {
    "timestamp": "12344"
  }
}
    
## as a side note,  "type" field is different for GCP binary authorization signature attachments: 
   
$ gcloud beta container binauthz create-signature-payload --artifact-url=$IMAGE 
{
  "critical": {
    "identity": {
      "docker-reference": "gcr.io/distroless/static-debian11"
    },
    "image": {
      "docker-manifest-digest": "sha256:a01d47d4036cae5a67a9619e3d06fa14a6811a2247b4da72b4233ece4efebd57"
    },
    "type": "Google cloud binauthz container signature"
  }
}
    

# now put it all together and use the raw private key and openssl to sign the json above
$ cosign generate -a timestamp=12344  $IMAGE | awk '{ printf "%s", $0 }' - | openssl dgst -sha256 -sign priv.pem -out /tmp/sign.sha256  -

# we now got back the json from above
$ base64 /tmp/sign.sha256 --wrap=0
    I26TU/Z2j194EgoR83Np7X2rhStZQ82uZrWZ5pKGxAqFn864fNCRAPc0ELfo6xlfRYp1COmtscSFJ6wjM+wiiF1F6MY4Qfm1GZaEjPmnOCW8ecMUB85HrN9CoYyIs8EkMwh52s8sAU5qvfG7rQIHkS+D+Tbphw9XG7pnAYYYu9opUY6bORt8eHwfwC7R8RP+BgDh2uv4sJMun9Q6nYOyx0hE4xtTNRE5hbqi8weOvFOcFQVclOFOuywWLqijYBoAfDN78Gi7IFN4+Cw202PTX9UgNZC40qVe3UD5sK9BBshh0eYlQDKBqgaLDkDDA03PvqIdLSrMhDx4E+QuwjW88w==srashid@srashid12
priv.pem
salrashid123/cosign.md

Select an option

No results found

Select an option

No results found
