Skip to content

Build provenance for secureblue-based image #55

Description

@HastD

Secureblue generates SLSA build provenance for its images, and verifies provenance client-side before downloading and installing updates. This improves security by verifying that the uploaded container images were in fact generated by the GitHub Actions workflows in the repo, therefore protecting against a scenario with compromised credentials being used to push a malicious container image.

Some secureblue functionality, including automatic system updates and the optional upgrade-on-boot feature, do this provenance verification and will be broken if build provenance isn't available. Provenance verification is done in a script located at /usr/libexec/secureblue/verify-provenance.sh; if you add build provenance, you'd also need to patch this script in the kinoite-hardened variant to change a couple lines to refer to your container registry and source repo: https://github.com/secureblue/secureblue/blob/4e5ca77124601c06f737ca171acab9f2bca35081/files/system/usr/libexec/secureblue/verify-provenance.sh#L15-L16

(Alternatively, you could replace that script with a stub to disable provenance verification; this is a security degradation, but is still preferable to automatic updates not working.)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions