Published on

Building the Software Supply Chain on Docker Official Images (DockerCon 2023)

Introduction

Introduction

At DockerCon 2023, James—a Docker engineer focused on Scout and Docker Official Images security—along with Ethan from Bastion Zero, highlighted an exciting collaboration between Docker, Bastion Zero, and the Linux Foundation aimed at creating a robust signing solution. The focus was on enhancing the security of Docker Official Images and addressing challenges related to software supply chain integrity.

Context of Docker Official Images

Docker Official Images are recognized as one of the largest resources of open-source packages, with approximately 150 repositories across numerous platforms and architectures. Ensuring the security of this supply chain is paramount for Docker and its community of maintainers.

The Cybersecurity and Infrastructure Security Agency has identified vulnerabilities and supply chain integrity as critical focus areas for open-source security efforts. While previous discussions have concentrated on vulnerabilities and their remediation, this talk primarily emphasizes supply chain issues, particularly associated with Docker Official Images.

Importance of Signing

Signing images is crucial, but who performs the signing and how these signatures are verified is equally important. Many industries utilize signing mechanisms (like GPG for Maven Central), but without proper verification, these signatures can lose their significance. Thus, ensuring verification is a priority where verification should be treated as a default rather than an opt-in feature.

Tackling Supply Chain Security with TUF

The team explored improving Docker Official Images’ security posture using The Update Framework (TUF) to model their signing process. TUF offers methodologies for incrementally enhancing security, leading Docker toward achieving Salsa Level Three status.

Docker aims for the Distributed repository to cater to various signing technologies, ensuring that, without additional layers of trust, the Docker client's embedded trust policy can verify signatures seamlessly. This also includes a policy that mandates all Docker official images to have signed attestations, presence in the TUF repository, and ensuring that the signing technology used is secure and straightforward.

Introduction to Open Pub Key

Ethan introduced the Open Pub Key protocol, which binds public keys to identities using OpenID Connect. The protocol simplifies key management while further ensuring security without involving additional trusted parties.

The rationale behind Open Pub Key hinges on the necessity of confirming that the public key being used indeed belongs to the identified entity behind the signing action. For instance, if a workload called "Alice" signs an image, how does "Bob" verify Alice's identity through her public key?

Open Pub Key leverages OpenID Connect to tackle this problem and is now an open-source project under the Linux Foundation.

The binding of public keys to identities via this protocol allows for effortless public key management for signing workloads, providing flexibility in key generation while relying solely on trusted identity providers.

Signing Process

  1. ID Token Generation: The workload (e.g., GitHub Action) generates an ID token from the identity provider (IDP). This token contains claims about the workload's identity.

  2. Public Key Inclusion: When generating this token, the workload includes its public key in an audience claim, which the IDP then signs.

  3. PK Token Creation: The original ID token is used as a basis to generate a PK token, which includes signatures proving knowledge of the underlying ID token's signature without revealing that signature itself.

  4. Image Signing: The workload then signs the targeted image using its signing key and uploads it, alongside its signature and the PK token, to the relevant repository.

  5. Verification: When "Bob" wants to verify the signature, he retrieves the image, the signature, and the PK token, checking the ID token and ensuring it is originally signed by the IDP.

Challenges and Call to Action

James highlighted several key challenges, including the need for transparency logs, handling of public key rotations, and planning for potential downgrading attacks. He emphasized a call to action for engagement from the community to refine the technologies and build robust systems.

Conclusion

The collaboration between Docker, Bastion Zero, and the Linux Foundation introduces an innovative architecture for enhancing software supply chain security using OpenID Connect and Open Pub Key protocols. This approach makes key management seamless and strengthens the verification process, ensuring a more secure Docker ecosystem.

Keywords

  • Docker Official Images
  • Supply Chain Security
  • Signing Protocols
  • Open Pub Key
  • OpenID Connect
  • The Update Framework (TUF)
  • Identity Verification
  • Transparency Logs

FAQ

  1. What are Docker Official Images? Docker Official Images are curated images that provide a set of libraries and tools for a wide variety of applications across multiple platforms and architectures.

  2. What is Open Pub Key? Open Pub Key is a protocol designed to bind public keys to identities using OpenID Connect, enhancing key management and security.

  3. Why focus on supply chain security? Ensuring supply chain security protects against vulnerabilities and ensures the integrity of the software being used, thus safeguarding the entire ecosystem.

  4. What role does TUF play in this initiative? TUF provides a framework for establishing secure signing practices and consent while managing software updates reliably.

  5. How can the community get involved with this project? The community is encouraged to contribute by raising issues, providing feedback, and participating in discussions around further developing the Open Pub Key protocol and its integration into Docker technologies.

Read More