From c8899368e76cf734f9717417167dd683e5bed8bd Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Tue, 29 Sep 2026 19:22:03 -0500 Subject: [PATCH] fix(conformance): state the chainsaw supply-chain gap accurately The Containerfile said chainsaw "publishes no per-asset checksum file at a stable URL". Literally true, and misleading: it reads as "no integrity option exists". Checked the release assets via the GitHub API -- v0.2.12 ships per-asset cosign `.sig` + `.pem` and an SBOM alongside each tarball. So verification IS available, it just needs cosign in the builder stage and the right keyless identity for kyverno's release workflow. Comment now says what is actually true: kubectl is sha256-verified, chainsaw rests on tag + TLS, and the cosign path is named as a TODO rather than implied away. Deliberately not implemented here -- picking a trusted signer identity is a supply-chain decision that belongs in its own reviewed change, not a silent addition to a runner image. Noted that infra/devcontainer/Containerfile has the same gap for the same binary. Rebuilt after the edit; the in-image verification still passes. Co-Authored-By: Claude Opus 5 (1M context) --- conformance/incluster/Containerfile | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/conformance/incluster/Containerfile b/conformance/incluster/Containerfile index adae986..5cb395c 100644 --- a/conformance/incluster/Containerfile +++ b/conformance/incluster/Containerfile @@ -67,10 +67,18 @@ RUN set -eux; \ : "${KUBECTL_VERSION:?pass --build-arg KUBECTL_VERSION from infra/devcontainer/versions.env}" # Same URLs and the same arch handling as infra/devcontainer/Containerfile, so the chainsaw -# and kubectl in this image are the same builds the toolbox gate runs with. kubectl's -# published sha256 is verified; chainsaw publishes no per-asset checksum file at a stable -# URL, so its integrity rests on the tag + TLS (and, after the operator pushes, on this -# image's own digest). +# and kubectl in this image are the same builds the toolbox gate runs with. +# +# INTEGRITY, MEASURED NOT ASSUMED. kubectl publishes a plain `.sha256`, so it is verified +# below. chainsaw publishes NO checksums file — the v0.2.12 release assets are the tarballs plus +# per-asset cosign `.sig`/`.pem` and an SBOM (listed via the GitHub releases API). So chainsaw's +# integrity here rests on the tag + TLS, and afterwards on this image's own digest. +# TODO, worth doing and deliberately not smuggled in here: verify chainsaw with +# `cosign verify-blob --certificate chainsaw_linux_amd64.tar.gz.pem +# --signature chainsaw_linux_amd64.tar.gz.sig ...`. That needs cosign in the builder stage and +# the correct keyless identity/issuer for kyverno's release workflow — a supply-chain decision +# that belongs in its own reviewed change, not as a silent addition to a runner image. +# infra/devcontainer/Containerfile has the same gap for the same binary. RUN set -eux; \ mkdir -p /out; \ curl -fsSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl" \