Add cosign signature verification for plugin inventory image to ensure integrity of plugins #106

prkalle · 2023-03-10T23:03:37Z

What this PR does / why we need it

This PR adds cosign signature verification functionality in CLI to ensure the plugins integrity downloaded and installed from the central repository

-Added signature verification of plugin inventory(DB) image to ensure the integrity of plugin downloaded and installed from the repository

Also embedded the default public key in the CLI required to verify the cosign signature
If the signature verification fails, CLI would throw error and users can choose to skip this validation by setting the environment variable TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST with the discovery image url. User can also choose to suppress signature verification failure warning by setting TANZU_CLI_SUPPRESS_SKIP_SIGNATURE_VERIFICATION_WARNING to true.

Plugin Discovery(inventory database) Image contains index of each plugin. So, by signing the plugin discovery image and ensuring the Image is signed by CLI before installing the plugins would ensure the integrity of the plugin user is supposed to install. The plugin plublishing workflow(out of the context of this PR) would make sure to sign the Plugin Discovery Image using cosign. CLI would verify the signature of the plugin discovery image using the public key embedded in the CLI.

Which issue(s) this PR fixes

Fixes #107

Describe testing done for PR

Compiled the CLI and plugins and published to repository:harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1
Later, tried to executing tanzu plugin search which would validate the plugin inventory image signature and throws Warning message to User.

❯ export PLUGIN_PUBLISH_REPOSITORY="harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1"
❯ make cross-build
build linux-amd64 CLI with version: v0.0.2-dev
build windows-amd64 CLI with version: v0.0.2-dev
build darwin-amd64 CLI with version: v0.0.2-dev
/Users/pkalle/projects/tanzu-cli/bin/builder plugin build \
		--path ./cmd/plugin \
		--binary-artifacts /Users/pkalle/projects/tanzu-cli/artifacts/plugins \
		--version v0.0.2-dev-25-ge4083254 \
		--ldflags "-X 'github.com/vmware-tanzu/tanzu-plugin-runtime/plugin/buildinfo.Date=2023-03-10' -X 'github.com/vmware-tanzu/tanzu-plugin-runtime/plugin/buildinfo.SHA=e4083254' -X 'github.com/vmware-tanzu/tanzu-plugin-runtime/plugin/buildinfo.Version=v0.0.2-dev-25-ge4083254'" \
		--os-arch linux_amd64 \
		--match "*"
...[snap]...

2023-03-10T14:29:07-08:00 [i] Saved plugin manifest at "/Users/pkalle/projects/tanzu-cli/artifacts/packages/plugin_manifest.yaml"
/Users/pkalle/projects/tanzu-cli/bin/builder plugin publish-package \
		--package-artifacts /Users/pkalle/projects/tanzu-cli/artifacts/packages \
		--publisher tzcli \
		--vendor vmware \
		--repository harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1

--[snap]----
2023-03-10T14:30:20-08:00 [i] Published plugin at 'harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/vmware/tzcli/windows/amd64/global/test:v0.0.2-dev-25-ge4083254'
/Users/pkalle/projects/tanzu-cli/bin/builder inventory init \
		--repository harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1 \
		--plugin-inventory-image-tag latest \
		--override
2023-03-10T14:30:20-08:00 [i] created database locally at: "/var/folders/fz/4qtr7ntn2wvd2ptvthc459y80000gq/T/plugin_inventory.db"
2023-03-10T14:30:20-08:00 [i] publishing database at: "harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest"
2023-03-10T14:30:22-08:00 [i] successfully published plugin inventory database
/Users/pkalle/projects/tanzu-cli/bin/builder inventory plugin insert \
		--repository harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1 \
		--plugin-inventory-image-tag latest \
		--publisher tzcli \
		--vendor vmware \
		--manifest /Users/pkalle/projects/tanzu-cli/artifacts/packages/plugin_manifest.yaml
2023-03-10T14:30:22-08:00 [i] Pulling plugin inventory database from: "harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest"


2023-03-10T14:30:49-08:00 [i] Publishing plugin inventory database
2023-03-10T14:30:51-08:00 [i] Successfully published plugin inventory database at: "harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest"

Plugin Search command failed(below) and also shows Fatal message that Signature verification failed as the plugin discovery image is not signed yet

❯ export TANZU_CLI_PRE_RELEASE_REPO_IMAGE=harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1
❯ ./artifacts/darwin/arm64/cli/core/v0.0.2-dev/tanzu-cli-darwin_arm64 plugin clean
[ok] successfully cleaned up all plugins


❯ ./bin/tanzu plugin search
[!] Unable to verify the plugins discovery image signature: failed validating the signature of the image harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest :no matching signatures:
[x] Fatal, plugins discovery image signature verification failed. The `tanzu` CLI can not ensure the integrity of the plugins to be installed. To ignore this validation please set the environment variable "TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST" to "harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest" .  This is NOT RECOMMENDED and could put your environment at risk!

You can skip the discovery image signature by setting the TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST to harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest

❯ export TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST=harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest
❯ ./bin/tanzu plugin search
[!] Skipping the plugins discovery image signature verification for "harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest"

  NAME                DESCRIPTION                           TARGET      VERSION                  STATUS         CONTEXT
  builder             Build Tanzu components                global      v0.0.2-dev-21-gb558a9df  not installed
  test                Test the CLI                          global      v0.0.2-dev-21-gb558a9df  not installed
  cluster             Kubernetes cluster operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  feature             Operate on features and featuregates  kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  kubernetes-release  Kubernetes release operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc

You can notice in the above log a warning message showing the discovery image signature verification is skipped. If user choose to skip this warning message, user has to set TANZU_CLI_SUPPRESS_SKIP_SIGNATURE_VERIFICATION_WARNING to true

❯ export TANZU_CLI_SUPPRESS_SKIP_SIGNATURE_VERIFICATION_WARNING=true
❯ ./bin/tanzu plugin search
  NAME                DESCRIPTION                           TARGET      VERSION                  STATUS         CONTEXT
  builder             Build Tanzu components                global      v0.0.2-dev-21-gb558a9df  not installed
  test                Test the CLI                          global      v0.0.2-dev-21-gb558a9df  not installed
  cluster             Kubernetes cluster operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  feature             Operate on features and featuregates  kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  kubernetes-release  Kubernetes release operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc

Signed the plugin inventory OCI Image with the private key using cosign

❯ cosign sign --key ~/co-sign/tanzu-cli-keys/cosign.key harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest
Enter password for private key:
WARNING: Image reference harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest uses a tag, not a digest, to identify the image to sign.

This can lead you to sign a different image than the intended one. Please use a
digest (example.com/ubuntu@sha256:abc123...) rather than tag
(example.com/ubuntu:latest) for the input to cosign. The ability to refer to
images by tag will be removed in a future release.
Pushing signature to: harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory

Now you can see tanzu plugin search and tanzu plugin install command can be run without any failures

❯ ./bin/tanzu plugin search
  NAME                DESCRIPTION                           TARGET      VERSION                  STATUS         CONTEXT
  builder             Build Tanzu components                global      v0.0.2-dev-21-gb558a9df  not installed
  test                Test the CLI                          global      v0.0.2-dev-21-gb558a9df  not installed
  cluster             Kubernetes cluster operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  feature             Operate on features and featuregates  kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  kubernetes-release  Kubernetes release operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc


❯ ./bin/tanzu plugin install builder
[i] Installing plugin 'builder:v0.0.2-dev-21-gb558a9df' with target 'global'
[ok] successfully installed 'builder' plugin
❯ ./bin/tanzu plugin search
  NAME                DESCRIPTION                           TARGET      VERSION                  STATUS         CONTEXT
  builder             Build Tanzu components                global      v0.0.2-dev-21-gb558a9df  installed
  test                Test the CLI                          global      v0.0.2-dev-21-gb558a9df  not installed
  cluster             Kubernetes cluster operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  feature             Operate on features and featuregates  kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  kubernetes-release  Kubernetes release operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc

If the Tanzu CLI publickey is not valid anymore, users can export the env variableTANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_PUBLIC_KEY_PATH to specify the latest valid public key. In the below logs, you can notice initially, the tanzu plugin search command fails as the key is invalid, but after the user specifies the new public key using the environment variable it doesn't show warning/errors and it is successful

❯ ./bin/tanzu plugin search
[!] Unable to verify the plugins discovery image signature: failed unmarshalling PEM encoded default public key: PEM decoding failed
[x] Fatal, plugins discovery image signature verification failed. The `tanzu` CLI can not ensure the integrity of the plugins to be installed. To ignore this validation please set the environment variable "TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST" to "harbor-repo.vmware.com/tanzu_cli/pkalle/plugins/plugin-inventory:latest" .  This is NOT RECOMMENDED and could put your environment at risk!


❯ export TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_PUBLIC_KEY_PATH=/Users/pkalle/co-sign/tanzu-cli-keys/cosign.pub
❯ ~/temp/tanzu_with_invalid_pubkey plugin search
  NAME                DESCRIPTION                           TARGET      VERSION                  STATUS         CONTEXT
  builder             Build Tanzu components                global      v0.0.2-dev-21-gb558a9df  installed
  test                Test the CLI                          global      v0.0.2-dev-21-gb558a9df  installed
  cluster             Kubernetes cluster operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  feature             Operate on features and featuregates  kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc
  kubernetes-release  Kubernetes release operations         kubernetes  v0.25.0-dev              not installed  tkg-aws-cc-capi115-upg-mc

Release note

Added cosign signature verification for plugin inventory image to ensure integrity of plugins

Additional information

NOTE: User can also skip the validation by exporting the environment variable: TANZU_CLI_SKIP_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION .

Some additional delay is observed for validating the image signature.( This shouldn't be an issue once we add caching for plugin DB image)

Special notes for your reviewer

marckhouzam

I wasn't part of the security discussions, so I'm sorry if I'm suggesting something that was already discussed.

If the signature verification fails, CLI would show the warning message but would not throw error and users can choose to skip this validation by setting the environment variable SKIP_PLUGIN_METADATA_SIGNATURE_VERIFY

This approach implies that if a user tries to install a plugin from a hacked DB, a warning will be printed but the plugin will be installed. Part of installing a plugin is to run <plugin> info, which means the possibly hacked plugin will be run before the user has a chance to decide NOT to install it. I think the plugin install should fail unless the SKIP variable is set.

==

When will the real signing be done? Probably in the publishing pipeline that calls the builder plugin. Should we therefore update the builder plugin to sign the DB? The private key location would have to be specified through an env var or a flag I guess.

==

Also, can we work together to sign the local test central repo? That way we can use the full security feature while testing locally.
We probably want to add the cosign command for each of the four DB images in hack/central-repo/upload-plugins.sh

==

Finally, how can I test the use of PLUGIN_METADATA_SIGNATURE_CUSTOM_PUBLIC_KEY_PATH? I don't understand what the variable should be set to if I want to use a different key.

pkg/discovery/oci_dbbacked.go

marckhouzam · 2023-03-17T20:16:41Z

pkg/discovery/oci_dbbacked.go

+	cosignVerifier := cosignhelper.NewCosignVerifier(customPublicKeyPath)
+	if err := od.verifyInventoryImageSignature(cosignVerifier); err != nil {
+		log.Warningf("Unable to verify Plugin metadata signature: %v", err)
+		log.Warningf("Warning, Plugin metadata signature verification failed and therefore CLI couldn't ensure the integrity of the plugins to be installed. If you choose to ignore the validation please set environment variable SKIP_PLUGIN_METADATA_SIGNATURE_VERIFY to true ")


I think this is an important message. I made the below suggestion but I would like us to agree on the proper warning. @vuil @anujc25 @prkalle

I think we also need to tell the user what to do if they don't want to skip the validation.

Suggested change

log.Warningf("Warning, Plugin metadata signature verification failed and therefore CLI couldn't ensure the integrity of the plugins to be installed. If you choose to ignore the validation please set environment variable SKIP_PLUGIN_METADATA_SIGNATURE_VERIFY to true ")

log.Warningf("Warning, plugins metadata signature verification failed. The `tanzu` CLI can not ensure the integrity of the plugins to be installed. To ignore this validation please set the environment variable SKIP_PLUGIN_METADATA_SIGNATURE_VERIFY to true. This is NOT RECOMMENDED and could put your environment at risk!")

Also, could we not hard-code the variable name in the message, but inject it in the message using the constant constants.SkipPluginMetadataSignatureVerification?

think this is an important message. I made the below suggestion but I would like us to agree on the proper warning.

Thanks @marckhouzam for the suggestion. Yes, we should discuss and agree on the proper warning. I would be glad to hear suggestions.

Update: CLI would fail always if the discovery image signature fails (unless user sets TANZU_CLI_SKIP_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION to true )and would show the below message when the discovery image signature verification fails.

Sample log:

❯ ./bin/tanzu plugin search [!] Unable to verify the plugins discovery image signature: failed unmarshalling PEM encoded default public key: PEM decoding failed [x] Fatal, plugins discovery image signature verification failed. The `tanzu` CLI can not ensure the integrity of the plugins to be installed. To ignore this validation please set the environment variable "TANZU_CLI_SKIP_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION" to true. This is NOT RECOMMENDED and could put your environment at risk!

Update: After discussion, the proposed global skip verification environment variable TANZU_CLI_SKIP_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION is changed to TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST and would contain a comma separated list of plugin discovery image urls. CLI would skip validating the image signature for these discovery images

ex: TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST=harbor-repo.vmware.com/tanzu_cli/pkalle/test/v1/plugin-inventory:latest,harbor-repo.vmware.com/tanzu_cli/pkalle/plugins/plugin-inventory:latest

pkg/discovery/oci_dbbacked.go

pkg/discovery/oci_dbbacked_test.go

pkg/cosignhelper/cosignverify.go

marckhouzam · 2023-03-19T22:31:14Z

@prkalle My comments are based on the assumption that this is the final iteration of this security feature. If this is instead a first version for a pre-release, some of the comments may not apply as you may have been planning to address them in a future PR.

prkalle · 2023-03-20T17:28:31Z

I wasn't part of the security discussions, so I'm sorry if I'm suggesting something that was already discussed.

If the signature verification fails, CLI would show the warning message but would not throw error and users can choose to skip this validation by setting the environment variable SKIP_PLUGIN_METADATA_SIGNATURE_VERIFY

This approach implies that if a user tries to install a plugin from a hacked DB, a warning will be printed but the plugin will be installed. Part of installing a plugin is to run <plugin> info, which means the possibly hacked plugin will be run before the user has a chance to decide NOT to install it. I think the plugin install should fail unless the SKIP variable is set.

Very good point @marckhouzam. I am still thinking to have a prompt message in the oci_backed discovery and asking user whether to continue or else to panic (until the user sets environment variable SKIP_PLUGIN_METADATA_SIGNATURE_VERIFY to skip validation as it is a security issue). Do you think it would be fine or would it be an issue? I will look into plugin install flow and see if it would be still an issue if we prompt/panic if the singature validation fails.

==

When will the real signing be done? Probably in the publishing pipeline that calls the builder plugin. Should we therefore update the builder plugin to sign the DB? The private key location would have to be specified through an env var or a flag I guess.

Yes, the real signing be done in publishing pipeline, but it would not be part of the builder plugin. In the publish pipeline, once the publishing is done and the DB OCI image is updated, there would be an extra step to sign the DB image with the private key as we cannot share the private key.

==

Also, can we work together to sign the local test central repo? That way we can use the full security feature while testing locally. We probably want to add the cosign command for each of the four DB images in hack/central-repo/upload-plugins.sh

Sure, we can work together. We might need to address the issue with respect to local registry certs configuration for cosign to work with local registry. This is something we can look into.

==

Finally, how can I test the use of PLUGIN_METADATA_SIGNATURE_CUSTOM_PUBLIC_KEY_PATH? I don't understand what the variable should be set to if I want to use a different key.

I updated the PR description with the steps to show how users can use the environment variable TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_PUBLIC_KEY_PATH to use a different key(downloaded from a well known location or distributed by some means)

pkg/constants/env_variables.go

pkg/discovery/oci_dbbacked.go

chandrareddyp · 2023-03-24T16:22:54Z

I feel better giving some context about how and when we are signing the db image

chandrareddyp

LGTM added few comments

pkg/discovery/oci_dbbacked.go

pkg/cosignhelper/interface.go

pkg/cosignhelper/cosignverify.go

chandrareddyp · 2023-03-24T16:24:03Z

Please do create an issue/story for E2E tooling & test case implementation

prkalle · 2023-03-24T19:25:27Z

Please do create an issue/story for E2E tooling & test case implementation

Filed Issue: #133 for E2E tests.

marckhouzam

Looks great @prkalle !
Once last thing: if the central repo is badly configured, the signature errors show and I feel would lead the user the wrong way, which would make it very hard to figure out they just badly configured the repo:

$ tz config set env.TANZU_CLI_PRE_RELEASE_REPO_IMAGE typo # imagine the typo is not that obvious :-)
$ tz plugin search
[!] Unable to verify the plugins discovery image signature: failed validating the signature of the image typo :GET https://index.docker.io/v2/library/typo/manifests/latest: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:library/typo Type:repository]]
failed validating the signature of the image typo :GET https://index.docker.io/v2/library/typo/manifests/latest: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:library/typo Type:repository]]
[x] Fatal, plugins discovery image signature verification failed. The `tanzu` CLI can not ensure the integrity of the plugins to be installed. To ignore this validation please append "typo" to the comma-separated list in the environment variable "TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST".  This is NOT RECOMMENDED and could put your environment at risk!

anujc25

LGTM. Thanks for all the changes and for addressing the comments.

chandrareddyp

LGTM! Great work!

…e integrity of plugins -Added signature verification of plugin inventory(DB) image to ensure the integrity of plugin downloaded and installed from the repository - Also embedded the default public key in the CLI required to verify the cosign signature - If the signature verification fails, CLI would show the warning message but would not throw error and users can choose to skip this validation by setting the environment variable TANZU_CLI_PLUGIN_DISCOVERY_IMAGE_SIGNATURE_VERIFICATION_SKIP_LIST with the discovery image url. User can also choose to suppress signature verification failure warning by setting TANZU_CLI_SUPPRESS_SKIP_SIGNATURE_VERIFICATION_WARNING to true. Signed-off-by: Prem Kumar Kalle <pkalle@vmware.com>

marckhouzam

Thank you very much @prkalle for your work solving all my requests!
I think this feature is really great and with good UX.

LGTM

prkalle requested a review from a team as a code owner March 10, 2023 23:03

vmwclabot added the cla-not-required label Mar 10, 2023

prkalle force-pushed the add/secure_instal branch 6 times, most recently from 163cf58 to 6fec923 Compare March 17, 2023 21:56

prkalle force-pushed the add/secure_instal branch from 6fec923 to 869bf39 Compare March 18, 2023 00:20

marckhouzam reviewed Mar 19, 2023

View reviewed changes

anujc25 reviewed Mar 21, 2023

View reviewed changes

pkg/constants/env_variables.go Outdated Show resolved Hide resolved

prkalle force-pushed the add/secure_instal branch 7 times, most recently from ccc1a1d to c12bb6f Compare March 23, 2023 19:46

marckhouzam reviewed Mar 23, 2023

View reviewed changes

pkg/discovery/oci_dbbacked.go Outdated Show resolved Hide resolved

prkalle force-pushed the add/secure_instal branch from c12bb6f to 2f7dfc2 Compare March 23, 2023 22:54

chandrareddyp reviewed Mar 24, 2023

View reviewed changes

pkg/discovery/oci_dbbacked.go Outdated Show resolved Hide resolved

chandrareddyp reviewed Mar 24, 2023

View reviewed changes

pkg/discovery/oci_dbbacked.go Show resolved Hide resolved

pkg/discovery/oci_dbbacked.go Outdated Show resolved Hide resolved

pkg/cosignhelper/interface.go Show resolved Hide resolved

pkg/cosignhelper/cosignverify.go Outdated Show resolved Hide resolved

prkalle force-pushed the add/secure_instal branch from 2f7dfc2 to f220610 Compare March 24, 2023 19:12

marckhouzam reviewed Mar 27, 2023

View reviewed changes

anujc25 approved these changes Mar 28, 2023

View reviewed changes

chandrareddyp approved these changes Mar 28, 2023

View reviewed changes

prkalle force-pushed the add/secure_instal branch from f220610 to 92379ba Compare March 28, 2023 22:03

prkalle force-pushed the add/secure_instal branch from 92379ba to 2301127 Compare March 28, 2023 22:04

marckhouzam reviewed Mar 29, 2023

View reviewed changes

marckhouzam approved these changes Mar 29, 2023

View reviewed changes

prkalle merged commit b1b4e6e into vmware-tanzu:main Mar 29, 2023

vuil added the kind/feature Categorizes issue or PR as related to a new feature label Apr 7, 2023

marckhouzam added this to the v0.90.0 milestone Oct 20, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add cosign signature verification for plugin inventory image to ensure integrity of plugins #106

Add cosign signature verification for plugin inventory image to ensure integrity of plugins #106

prkalle commented Mar 10, 2023 •

edited

Loading

marckhouzam left a comment

marckhouzam Mar 17, 2023

marckhouzam Mar 17, 2023

prkalle Mar 20, 2023 •

edited

Loading

prkalle Mar 21, 2023 •

edited

Loading

prkalle Mar 23, 2023 •

edited

Loading

marckhouzam commented Mar 19, 2023

prkalle commented Mar 20, 2023 •

edited

Loading

chandrareddyp commented Mar 24, 2023

chandrareddyp left a comment

chandrareddyp commented Mar 24, 2023

prkalle commented Mar 24, 2023

marckhouzam left a comment

anujc25 left a comment

chandrareddyp left a comment

marckhouzam left a comment

	log.Warningf("Warning, Plugin metadata signature verification failed and therefore CLI couldn't ensure the integrity of the plugins to be installed. If you choose to ignore the validation please set environment variable SKIP_PLUGIN_METADATA_SIGNATURE_VERIFY to true ")
	log.Warningf("Warning, plugins metadata signature verification failed. The `tanzu` CLI can not ensure the integrity of the plugins to be installed. To ignore this validation please set the environment variable SKIP_PLUGIN_METADATA_SIGNATURE_VERIFY to true. This is NOT RECOMMENDED and could put your environment at risk!")

Add cosign signature verification for plugin inventory image to ensure integrity of plugins #106

Add cosign signature verification for plugin inventory image to ensure integrity of plugins #106

Conversation

prkalle commented Mar 10, 2023 • edited Loading

What this PR does / why we need it

Which issue(s) this PR fixes

Describe testing done for PR

Release note

Additional information

Special notes for your reviewer

marckhouzam left a comment

Choose a reason for hiding this comment

marckhouzam Mar 17, 2023

Choose a reason for hiding this comment

marckhouzam Mar 17, 2023

Choose a reason for hiding this comment

prkalle Mar 20, 2023 • edited Loading

Choose a reason for hiding this comment

prkalle Mar 21, 2023 • edited Loading

Choose a reason for hiding this comment

prkalle Mar 23, 2023 • edited Loading

Choose a reason for hiding this comment

marckhouzam commented Mar 19, 2023

prkalle commented Mar 20, 2023 • edited Loading

chandrareddyp commented Mar 24, 2023

chandrareddyp left a comment

Choose a reason for hiding this comment

chandrareddyp commented Mar 24, 2023

prkalle commented Mar 24, 2023

marckhouzam left a comment

Choose a reason for hiding this comment

anujc25 left a comment

Choose a reason for hiding this comment

chandrareddyp left a comment

Choose a reason for hiding this comment

marckhouzam left a comment

Choose a reason for hiding this comment

prkalle commented Mar 10, 2023 •

edited

Loading

prkalle Mar 20, 2023 •

edited

Loading

prkalle Mar 21, 2023 •

edited

Loading

prkalle Mar 23, 2023 •

edited

Loading

prkalle commented Mar 20, 2023 •

edited

Loading