Repository navigation
feat: sign images with cosign and verify them on upgrade - #3401
Open
vpetersson-bot wants to merge 2 commits into
Open
vpetersson-bot wants to merge 2 commits into
vpetersson-bot wants to merge 2 commits into
Conversation
- Keyless-sign every pushed anthias-{server,viewer,redis} digest with
cosign in docker-build.yaml (GHCR hard-fail, Docker Hub best-effort)
- Install a checksum-pinned cosign v3.1.4 on devices via ansible
- Add bin/verify_image_signatures.sh, which checks the pulled digest of
each Anthias image against the docker-build.yaml@master identity
- upgrade_containers.sh refuses to start images that fail verification
and leaves the device on its current release
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: multica-agent <github@multica.ai>
There was a problem hiding this comment.
Copilot encountered an error: Your billing is not configured or you have Copilot licenses from multiple standalone organizations or enterprises. To use premium requests, select a billing entity via the GitHub site, under Settings > Copilot > Features.
- Use [[ ]] for conditionals in the new signing/verification code - Add an explicit return to pulled_digest Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: multica-agent <github@multica.ai>
There was a problem hiding this comment.
Copilot encountered an error: Your billing is not configured or you have Copilot licenses from multiple standalone organizations or enterprises. To use premium requests, select a billing entity via the GitHub site, under Settings > Copilot > Features.
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Devices pull
ghcr.io/screenly/anthias-*images and run them without checking where they came from. If someone pushed an image to those tags by hand, or from a compromised token, or from some other workflow,upgrade_containers.shwould start it with no questions asked.This change signs the images in the release pipeline and checks them on the device before an upgrade starts them.
Signing (
docker-build.yaml)sigstore/cosign-installer, pinned by SHA) and keyless-sign theserver,viewerandredisdigests for each board. The new.github/workflows/scripts/cosign-sign-images.shdoes the signing, retrying transient registry errors the same waymirror-latest-tags.shdoes.latest-<board>tags thatpublish-latestpoints at those manifests are covered too.continue-on-error), for the same rate-limit reason as its attestations.Verification (device)
ansible/roles/system/tasks/cosign.ymlinstalls the cosign v3.1.4 static binary for amd64, arm64 or armhf, pinned by sha256.bin/verify_image_signatures.shtakes the image list, looks up the digest the daemon actually pulled for each Anthias image, and runscosign verifyagainst the identityhttps://github.com/Screenly/Anthias/.github/workflows/docker-build.yaml@refs/heads/masterwith the GitHub Actions OIDC issuer. A fork, another workflow in this repo, or a branch build doesn't match. Images that aren't ours, such as the Caddy SSL sidecar, are skipped. If cosign is missing, verification fails.upgrade_containers.shruns it aftercompose pull(pull mode only) and before anything is started. On failure it brings back the viewer and celery containers the low-RAM path stopped, on their existing images, and exits non-zero. The device stays on its current release.ANTHIAS_SKIP_IMAGE_VERIFICATION=1lets an operator who deliberately runs their own images opt out, with a warning.Rollout: with this identity, cosign v3 also accepts the build-provenance attestation this workflow already pushes, because it is signed under the same identity. I checked current
latest-pi2,latest-pi3,latest-pi4-64andlatest-x86images with cosign v3.1.4 and they verify today. A different workflow identity was rejected. So devices that upgrade before the first signed build lands won't fail. Older tagged releases are unaffected, sinceinstall.shfetchesupgrade_containers.shfrom the release ref.Balena deployments don't use
upgrade_containers.shand aren't covered by this change.Testing
tests/test_verify_image_signatures.py: 7 cases using fakedocker/cosignshims. They cover signed, unsigned, the digest from the wrong repo, an image that was never pulled, third-party images skipped, cosign missing, and no arguments.cosign verifyby hand against the live GHCR images, as described above.Checklist
🤖 Generated with Claude Code