Sign the generated BOMs (#1794)

Signed-off-by: Prabhu Subramanian <[email protected]>

Author: prabhu

.github/workflows/image-build.yml

@@ -86,19 +86,32 @@ jobs:
           push: true
           tags: ${{ steps.cdxgen-metadata.outputs.tags }}
           labels: ${{ steps.cdxgen-metadata.outputs.labels }}
+      - name: save private key to file
+        run: |
+          echo $SBOM_SIGN_PRIVATE_KEY_DATA > private.key
+        env:
+          SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
       - name: Attach cdx sbom to base
         run: |
           corepack pnpm install --config.strict-dep-builds=true --package-import-method copy --frozen-lockfile
           node bin/cdxgen.js -t docker -o sbom-oci-base-image.cdx.json ${{ fromJSON(steps.base-metadata.outputs.json).tags[0] }}
+          node bin/verify.js -i sbom-oci-base-image.cdx.json --public-key contrib/bom-signer/public.key
           oras attach --artifact-type sbom/cyclonedx ${{ fromJSON(steps.base-metadata.outputs.json).tags[0] }} ./sbom-oci-base-image.cdx.json:application/json
           oras discover --format tree ${{ fromJSON(steps.base-metadata.outputs.json).tags[0] }}
         continue-on-error: true
         if: github.ref == 'refs/heads/master'
+        env:
+          SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+          SBOM_SIGN_PRIVATE_KEY: private.key
       - name: Attach cdx sbom
         run: |
           corepack pnpm install --config.strict-dep-builds=true --package-import-method copy --frozen-lockfile
           node bin/cdxgen.js -t docker -o sbom-oci-image.cdx.json ${{ fromJSON(steps.cdxgen-metadata.outputs.json).tags[0] }}
+          node bin/verify.js -i sbom-oci-base-image.cdx.json --public-key contrib/bom-signer/public.key
           oras attach --artifact-type sbom/cyclonedx ${{ fromJSON(steps.cdxgen-metadata.outputs.json).tags[0] }} ./sbom-oci-image.cdx.json:application/json
           oras discover --format tree ${{ fromJSON(steps.cdxgen-metadata.outputs.json).tags[0] }}
         continue-on-error: true
         if: ${{ startsWith(github.ref, 'refs/tags/') && ! fromJSON(inputs.image).cdxgen-image.skip-tags }}
+        env:
+          SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+          SBOM_SIGN_PRIVATE_KEY: private.key

.github/workflows/npm-release.yml

@@ -124,14 +124,23 @@ jobs:
         nydusify check --target ${{ steps.meta.outputs.tags }}-nydus
       if: github.ref == 'refs/heads/master'
       continue-on-error: true
+    - name: save private key to file
+      run: |
+        echo $SBOM_SIGN_PRIVATE_KEY_DATA > private.key
+      env:
+        SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
     - name: Attach cdx sbom
       run: |
         corepack pnpm install --config.strict-dep-builds=true --package-import-method copy --frozen-lockfile
         node bin/cdxgen.js -t docker -o cdxgen-oci-image.cdx.json ghcr.io/cyclonedx/cdxgen:latest
+        node bin/verify.js -i cdxgen-oci-image.cdx.json --public-key contrib/bom-signer/public.key
         oras attach --artifact-type sbom/cyclonedx ghcr.io/cyclonedx/cdxgen:latest ./cdxgen-oci-image.cdx.json:application/json
         oras discover --format tree ghcr.io/cyclonedx/cdxgen:latest
       continue-on-error: true
       if: startsWith(github.ref, 'refs/tags/')
+      env:
+        SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+        SBOM_SIGN_PRIVATE_KEY: private.key
     - name: Attach cdx sbom to release
       uses: softprops/action-gh-release@v2
       if: startsWith(github.ref, 'refs/tags/')
@@ -174,14 +183,23 @@ jobs:
           push: true
           tags: ${{ steps.meta2.outputs.tags }}
           labels: ${{ steps.meta2.outputs.labels }}
+      - name: save private key to file
+        run: |
+          echo $SBOM_SIGN_PRIVATE_KEY_DATA > private.key
+        env:
+          SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
       - name: Attach cdx sbom
         run: |
           corepack pnpm install --config.strict-dep-builds=true --package-import-method copy --frozen-lockfile
           node bin/cdxgen.js -t docker -o cdxgen-secure-oci-image.cdx.json ghcr.io/cyclonedx/cdxgen-secure:latest
+          node bin/verify.js -i cdxgen-secure-oci-image.cdx.json --public-key contrib/bom-signer/public.key
           oras attach --artifact-type sbom/cyclonedx ghcr.io/cyclonedx/cdxgen-secure:latest ./cdxgen-secure-oci-image.cdx.json:application/json
           oras discover --format tree ghcr.io/cyclonedx/cdxgen-secure:latest
         continue-on-error: true
         if: startsWith(github.ref, 'refs/tags/')
+        env:
+          SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+          SBOM_SIGN_PRIVATE_KEY: private.key
       - name: Attach cdx secure sbom to release
         uses: softprops/action-gh-release@v2
         if: startsWith(github.ref, 'refs/tags/')
@@ -235,14 +253,23 @@ jobs:
         push: true
         tags: ${{ steps.meta2.outputs.tags }}
         labels: ${{ steps.meta2.outputs.labels }}
+    - name: save private key to file
+      run: |
+        echo $SBOM_SIGN_PRIVATE_KEY_DATA > private.key
+      env:
+        SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
     - name: Attach cdx sbom
       run: |
         corepack pnpm install --config.strict-dep-builds=true --package-import-method copy --frozen-lockfile
         node bin/cdxgen.js -t docker -o cdxgen-deno-oci-image.cdx.json ghcr.io/cyclonedx/cdxgen-deno:latest
+        node bin/verify.js -i cdxgen-deno-oci-image.cdx.json --public-key contrib/bom-signer/public.key
         oras attach --artifact-type sbom/cyclonedx ghcr.io/cyclonedx/cdxgen-deno:latest ./cdxgen-deno-oci-image.cdx.json:application/json
         oras discover --format tree ghcr.io/cyclonedx/cdxgen-deno:latest
       continue-on-error: true
       if: startsWith(github.ref, 'refs/tags/')
+      env:
+        SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+        SBOM_SIGN_PRIVATE_KEY: private.key
     - name: Attach cdx deno sbom to release
       uses: softprops/action-gh-release@v2
       if: startsWith(github.ref, 'refs/tags/')
@@ -342,14 +369,23 @@ jobs:
         push: true
         tags: ${{ steps.meta5.outputs.tags }}
         labels: ${{ steps.meta5.outputs.labels }}
+    - name: save private key to file
+      run: |
+        echo $SBOM_SIGN_PRIVATE_KEY_DATA > private.key
+      env:
+        SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
     - name: Attach cdx sbom
       run: |
         corepack pnpm install --config.strict-dep-builds=true --package-import-method copy --frozen-lockfile
         node bin/cdxgen.js -t docker -o cdxgen-bun-oci-image.cdx.json ghcr.io/cyclonedx/cdxgen-bun:latest
+        node bin/verify.js -i cdxgen-bun-oci-image.cdx.json --public-key contrib/bom-signer/public.key
         oras attach --artifact-type sbom/cyclonedx ghcr.io/cyclonedx/cdxgen-bun:latest ./cdxgen-bun-oci-image.cdx.json:application/json
         oras discover --format tree ghcr.io/cyclonedx/cdxgen-bun:latest
       continue-on-error: true
       if: startsWith(github.ref, 'refs/tags/')
+      env:
+        SBOM_SIGN_ALGORITHM: ${{ secrets.SBOM_SIGN_ALGORITHM }}
+        SBOM_SIGN_PRIVATE_KEY: private.key
     - name: Attach cdx bun sbom to release
       uses: softprops/action-gh-release@v2
       if: startsWith(github.ref, 'refs/tags/')

contrib/bom-signer/README.md

@@ -0,0 +1,10 @@
+# Signed BOMs
+
+BOMs generated by cdxgen for the released artifacts are signed with a default private key (stored as a repository secret). Use the public key in this directory to verify the BOMs.
+
+```shell
+export SBOM_SIGN_ALGORITHM=RS512
+export SBOM_SIGN_PUBLIC_KEY=public.key
+
+cdx-verify -i bom.json --public-key /path/to/public.key
+```

contrib/bom-signer/public.key

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtcQyHqd3UHoZixi/cRTs
+bdrsBpf31aGlcsRF6hfnFRSw2JvSI//JzAngheVymIbq+KNHI31t7oR6oOHqORap
+FlIgRhR03ftNMzi0+VpRR8ztWha5eU7+7eDV3QsRVePninVr3MxzOczprEdqcOuO
+CAlflRjw67FoRLMZCJBRbRNbw95GBhBdsHCfbPSMA+5xhiPywYOc3Z1D+k8s3dBh
+42kjCNBl3RwCNsocW1eTcEIFV+sZfVxT3kOwZ+EN9BfU6mcBW8eFMLtTzmT9wdpY
+r6CEE+eaCpbi7X/rD674WdDa5QaOUO/Bu/mnuRlQ7tAP9/jAVOidVvkLWMXuIpMB
+w/YEDgGa6qeVikrQmZdkMF3vaLmnXcRtgfUd7PmTp3K9yjEajP6CtNbfIigz4yWD
+KGp6nYalW1Bl3w+qKNmGWCVqjE6RlktxaZYJlXuA0l9RWL/YMtTxOvf+s+4GQru0
+T3RMZfpSS2V1dRBwllEaDI5lupmqUpuX2wHAFRKAKAXh4DAcg+sR5UXzXOxzfuxf
+Rt0AtbaoWFALUR6BpwJW1fcaBCYAakNe6aZgdWCa7lldI6fepyEq5wiyjE+7W5xm
+r+irUPeENIDvz4Tf8GWJ8CELT7VkZaY4SntcXhi+HF4Yk+n+ziESj/ZO+7r3A9mF
+H6fu+s5F5YkZESJ3FGkKt1MCAwEAAQ==
+-----END PUBLIC KEY-----

docs/LESSON3.md

@@ -44,3 +44,11 @@ cdxgen --generate-key-and-sign -t docker -o bom.json docker.io/<repo>/sign-test:
 oras attach --artifact-type sbom/cyclonedx docker.io/<repo>/sign-test:latest ./bom.json:application/json
 oras discover -o tree docker.io/<repo>/sign-test:latest
 ```
+
+To download the SBOM attachment from the OCI image, use the `oras pull` command with the correct digest from the `discover` command.
+
+```shell
+IMAGE_REF=$(oras discover --format json --artifact-type sbom/cyclonedx docker.io/<repo>/sign-test:latest | jq -r '.manifests[0].reference')
+oras pull $IMAGE_REF -o sbom_output_dir
+ls -l sbom_output_dir/bom.json
+```