SLSA, the supply chain security project, as a model for attesting and verifing software artifacts. The project documentation has a whole section on software attestations. The SUSE SLE Base Container Images (BCI) are attested and you can verify them.

Basic Example

To follow along with the examples you will need to have cosign installed. This software lets you attest and verify images.

Here’s an example…

$ COSIGN_EXPERIMENTAL=1 cosign  verify-attestation --type slsaprovenance --key https://ftp.suse.com/pub/projects/security/keys/container–key.pem registry.suse.com/bci/golang@sha256:35bc38ce40811b587a56bcfa328ef077c0703732e3bbedf4dbdf47f612cca04b

Verification for registry.suse.com/bci/golang@sha256:35bc38ce40811b587a56bcfa328ef077c0703732e3bbedf4dbdf47f612cca04b --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The claims were present in the transparency log
  - The signatures were integrated into the transparency log when the certificate was valid
  - The signatures were verified against the specified public key
{"payloadType":"application/vnd.in-toto+json","payload":"eyJfdH...

Note: this example uses experimental work that may change over time.

Let’s break down the command:

• Setting COSIGN_EXPERIMENTAL=1 as an environment variable which enables experimental features. These features add more checks to happen when verify-attestation is run.
• cosign is the application and verify-attesation is the specific command being run. There are other commands to create attestations and perform other signing and verification.
• --type slsaprovenance, which is not the default, tells cosign to verify the SLSA provenance.
• --key sets the public Key to use related to the signing and verification. The value here is the location of the SUSE public key needed for verification.
• The argument is the image and the specific revision. Each revision needs to be attested and verified separately.

Registry Images vs Image List

In the example command you’ll notice the digest is used to refer to the image instead of the tag. There is a reason for this. Tags are pointers to digests that reference manifests. For the purposes here, it’s important to know that manifests for images can point to a single image or a list of images. A list of images is often due to having multiple images for different architectures. For example, the SLE BCI images are built for arm64, x86_64, and other architectures. Each architecture get its own image.

When you have a list of images, cosign doesn’t know which one to pick and verify. The way to tell it the specific image is to use the digest for it. But, how do you get the digest for the specific image? For that we turn to crane.

$ crane digest --platform linux/amd64 registry.suse.com/bci/golang:latest
sha256:35bc38ce40811b587a56bcfa328ef077c0703732e3bbedf4dbdf47f612cca04b

This digest can be used with the cosign commands. If you have a different platform you can change that to others including linux/arm64 and linux/s390x.