Using Cosign to verify Konflux build signatures & attestations

Konflux uses Tekton Chains to sign the images created by Konflux build pipelines, and to create signed attestations that include details about the Tekton pipeline run that created the image.

It’s possible to verify these signatures and view the attestation directly using cosign. This does require that you know the image ref of the container image that was created, (i.e. the container repository and a tag or digest), of the image that was created, and that you have access to that repository.

When validating an image, from an application component for example, it is recommended to always use an image reference includes a digest. The Konflux build pipelines emit results that contain this information. They are called IMAGE_URL and IMAGE_DIGEST. Combine the two with the @ to create the image reference with a digest. For example, if IMAGE_URL is quay.io/konflux-ci/user-workload, and IMAGE_DIGEST is sha256:de1c78cd8321ec999187dfc95ed5470b4a5b2bf5121a2482dba7b5965868253d, the image reference that should be used during validatin is quay.io/konflux-ci/user-workload@sha256:de1c78cd8321ec999187dfc95ed5470b4a5b2bf5121a2482dba7b5965868253d.

It is also possible to obtain the image reference from the Web UI.

Currently, Konflux uses a long-lived key for signing. This key can be retrieved from the corresponding member cluster:

The first step in validating an image is verifying it has been signed with the proper signature. This is to ensure the image was indeed built in a Konflux build pipeline.

Next, validate that the image contains the expected SLSA Provenance attestations. Images built by the Konflux build pipeline will have two of them. One representing the Tekton TaskRun in which the image was built, and one representing the Tekton PipelineRun that contains the previously mentioned TaskRun. The attestation for the PipelineRun is useful in understanding all the steps used when building the image.

The output of the cosign verify-attestation command displays the attestations themselves. The snippet above saves those attestations into a file, called slsa-provenance-attestations.json.

At this point, a policy engine like OPA or conftest can be used to validate the contents of the attestations.

At the moment, the Software Bill of Materials (SBOM) attachment is not signed. However, it can be inspected via the cosign download sbom command. It is important to note that this command offers no guarantee that the SBOM attachment was produced as part of the Konflux build pipeline.

The snippet above saves the SBOM into a file named sbom.json. This file could also be used as input to a policy engine. However, beware that since it is not signed, it is susceptible to modifications outside the Konflux build pipeline.

cosign tree is a useful command that lists all related entities for an image, such as image signatures, image attestations, and Software Bill of Materials (SBOM) attachments.

For example:

Although cosign tree is not necessary for validation, it is a powerful command to inspect the current state of an image.