Repository navigation
docs(node): verify Docker images with build provenance attestations - #1130
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| ```bash | ||
| # Install the GitHub CLI: https://cli.github.com/ | ||
| gh attestation verify oci://ghcr.io/tempoxyz/tempo:<tag> \ | ||
| --repo tempoxyz/tempo |
There was a problem hiding this comment.
🟡 (optional) Readers who only install gh and paste the new verify command will see it fail with a login prompt rather than a verification result. The snippet's comment only says to install the GitHub CLI. Without --bundle-from-oci, gh attestation verify fetches attestations from the GitHub API and needs gh auth login first. Fix: tell readers to run gh auth login, as line 106 already does for tempoup. Or, if the attestations really are pushed to the registry, add --bundle-from-oci to both examples (lines 155 and 164).
Why this was flagged
A node operator follows the Docker Image Provenance section at installation.mdx:153-156. They install the GitHub CLI as the comment says and run gh attestation verify oci://ghcr.io/tempoxyz/tempo:<tag> --repo tempoxyz/tempo. Without --bundle-from-oci, gh gets the attestation from the GitHub attestations API, which needs an authenticated gh. The command stops and asks the user to run gh auth login without verifying anything. On the base branch, the cosign verify example needed no account. The same section, at line 106, does say to "Install and authenticate gh" for tempoup, but the new snippet and the pinned-digest example at line 164 leave that step out. The text says the attestation is "stored next to the image in the registry", but the commands never read it from the registry.
Verification: nit. The snippet at installation.mdx:153-157 is only # Install the GitHub CLI: https://cli.github.com/ followed by gh attestation verify oci://ghcr.io/tempoxyz/tempo:<tag> --repo tempoxyz/tempo. Neither example passes --bundle or --bundle-from-oci, and nothing near them mentions authentication. Line 106 tells readers to "Install and authenticate gh". The base's cosign verify example needed no GitHub account.
Attests images this repository publishes from trusted runs with `actions/attest-build-provenance` (`push-to-registry: true`), so the INF-405 Kyverno policy in tempoxyz/k8s#2494 admits them. Private and internal repositories sign in GitHub's private Sigstore instance; this public one uses public-good Sigstore. Existing cosign signing is unchanged. The reusable `attest-images.yml` attests a list of `repository@digest` refs, one matrix job each, and expands each multi-platform index into its platform manifests (`linux/amd64`, `linux/arm64`) so a platform-pinned digest verifies as well as the index or a tag; `docker.yml` and the zones companion images use it. Because a reusable workflow signs as itself whoever calls it, a fail-closed guard runs before every attest step: the run must be in `tempoxyz/tempo`, triggered by push, schedule or workflow_dispatch, on `main`, an `rc/*` branch or a `tempo/v*`, `zones/v*` or `prover/v*` tag, from `docker.yml`, `zones-docker.yml` or `prover-release.yml` at that same ref. Profiling builds attest only from `main`. **Published but unattested**, intentionally: they build unreviewed or non-release code. They keep their cosign signature until tempoxyz#9286, and keep working while Kyverno is in Audit; plan for them before Deny: - `reth-auto-bump` builds and merge-group Network E2E builds. - `/docker` PR builds, including `/docker nightly`, which moves `nightly` to an unattested PR-head image and still fires the nightly event. - Selected-ref zones and profiling dispatches from refs other than `main` or a release tag. **Tag order:** on runs that attest, images are first published only under their per-commit `sha-` tag. The tags deployments follow (`edge`, `latest`, `nightly`, `stable`, semver) move to the digest only after it is attested (`tag-images` in `docker.yml`, `tag-companion-images` and the promote job in `zones-docker.yml`, via `.github/scripts/move-image-tags.sh`), as a same-repository carbon copy checked against the attested digest. If attestation fails, those tags stay where they were. Unattested flows above still tag at publish time. **EIF toolchain:** reuse requires a main-run attestation with a matching `recipe_sha`; the first main or tag run after merge rebuilds the toolchain once. Only `main` writes the shared `inputs-<sha>` tag; other runs that rebuild push a run-scoped tag. **rc/\***: release-candidate pushes are attested, like their cosign signature before. `rc/*` branches are protected by a ruleset, and the attestation records `refs/heads/rc/...`, so the prod Kyverno policy (main and tags only) still keeps rc images out of prod. **Migration:** `cosign verify` keeps working on every image while cosign signing stays. Consumers move to `gh attestation verify oci://ghcr.io/tempoxyz/tempo:<tag> --repo tempoxyz/tempo` (tag, index digest or platform digest), documented in tempoxyz/docs#1130. Images published before this change carry only a cosign signature.
…ployment tags (tempoxyz#9286) Stacked on tempoxyz#9087. Removes the cosign signing steps from `docker.yml` and the `sign-prover-images` job from `zones-docker.yml`; GitHub build-provenance attestations become the only image signature. The digest list the attest job needs is now collected without signing. Keep as a draft until consumers that verify with `cosign verify` have moved to `gh attestation verify`, and land tempoxyz/docs#1130 first: the node installation guide still tells operators to run `cosign verify`, which fails for every image published after this merges. **Builds left with no signature** once this lands, intentionally (they build unreviewed or non-release code): `/docker` PR builds (including `/docker nightly`), merge-group Network E2E builds, `reth-auto-bump` builds, and zones or profiling dispatches from refs other than `main` or a release tag. `rc/*` builds stay covered: tempoxyz#9087 attests them. **Migration note:** - Verify with `gh attestation verify oci://ghcr.io/tempoxyz/tempo:<tag> --repo tempoxyz/tempo`, or a Kyverno or Sigstore policy on the build-provenance attestation. - Platform-pinned digests (`linux/amd64`, `linux/arm64`) verify too: tempoxyz#9087 attests each platform manifest as well as the index. cosign signed them with `--recursive`. - Images published before tempoxyz#9087 have only a cosign signature, and `cosign verify` still works for them. **Also (folded in from tempoxyz#9302):** reusable callers of `docker.yml` (`build-reth-bump-image.yml`, `network-e2e.yml`) run with the caller's ref and event, so a reth-bump dispatch on `main` would push `edge`/`latest` unattested and, after this PR, unsigned. When `docker.yml` runs as another workflow's reusable call, it now keeps only per-build tags (`sha-`, `ci-`, `pr-`), so only an attested `docker.yml` run moves the tags deployments follow.
Docker images now get GitHub build provenance attestations (tempoxyz/tempo#9087), and Cosign signing is being retired (tempoxyz/tempo#9286). This switches the node installation guide from
cosign verifytogh attestation verify, covers multi-platform and platform-pinned digests, and keeps the Cosign command for older images.Land together with tempoxyz/tempo#9087, before tempoxyz/tempo#9286 removes Cosign signing.