fix(xpkg): pin Fetch to the verified digest

The CachedClient.Get path was:

  1. fetcher.Head(parsedResolvedRef)              -> resolves tag -> digest D
  2. validator.Validate(ref=D, vc)                -> cosign verifies D
  3. fetcher.Fetch(parsedResolvedRef)              -> remote.Image(tag)
  4. img.Manifest() (called by ExtractPackageYAML) -> GET tag again

Steps 1 and 4 hit the registry independently. A registry that serves
different content between the two requests can have step 2 verify a
benign signed digest while step 4 returns an unsigned malicious
manifest, and the consumer (Crossplane) installs the malicious package
despite the ImageConfig signature verification succeeding.

Pin the Fetch (and the validator call) to digestRef so the digest we
verify is the digest we pull.

Signed-off-by: tonghuaroot <tonghuaroot@gmail.com>

Author: tonghuaroot

pkg/xpkg/client.go

@@ -317,15 +317,21 @@ func (c *CachedClient) Get(ctx context.Context, ref string, opts ...GetOption) (
 	if err != nil {
 		return nil, errors.Wrap(err, "cannot get image verification config")
 	}
+	// Pin all subsequent registry interactions to the digest resolved by
+	// Head. Pulling by the original tag would let a registry that serves
+	// different content between Head and Fetch slip an unsigned image past
+	// the verifier (the verifier above attests `digest`, not whatever bytes
+	// the tag happens to resolve to a few milliseconds later).
+	digestRef := parsedResolvedRef.Context().Digest(digest)
+
 	if vc != nil {
-		ref := parsedResolvedRef.Context().Digest(digest)
-		if err := c.validator.Validate(ctx, ref, vc, secrets...); err != nil {
+		if err := c.validator.Validate(ctx, digestRef, vc, secrets...); err != nil {
 			return nil, errors.Wrap(err, "signature verification failed")
 		}
 		applied = append(applied, ImageConfig{Name: name, Reason: ImageConfigReasonVerify})
 	}
 
-	img, err := c.fetcher.Fetch(ctx, parsedResolvedRef, secrets...)
+	img, err := c.fetcher.Fetch(ctx, digestRef, secrets...)
 	if err != nil {
 		return nil, errors.Wrapf(err, "cannot fetch package %s", resolvedRef)
 	}