add signature verification to install.sh (#2941)

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

test/install/0_checksums_test.sh

@@ -38,3 +38,49 @@ test_search_for_asset_snapshot() {
 }
 
 run_test_case test_search_for_asset_snapshot
+
+
+# verify 256 digest of a file
+test_hash_sha256() {
+  target=./test-fixtures/assets/valid/syft_1.5.0_linux_arm64.tar.gz
+
+  # hash_sha256 [target]
+
+  # positive case
+  actual=$(hash_sha256 "${target}")
+  assertEquals "8d57abb57a0dae3ff23c8f0df1f51951b7772822e0d560e860d6f68c24ef6d3d" "${actual}" "mismatched checksum"
+}
+
+run_test_case test_hash_sha256
+
+# verify 256 digest of a file relative to the checksums file
+test_hash_sha256_verify() {
+
+  # hash_sha256_verify [target] [checksums]
+
+
+  # positive case
+
+  checksums=./test-fixtures/assets/valid/checksums.txt
+  target=./test-fixtures/assets/valid/syft_1.5.0_linux_arm64.tar.gz
+
+  hash_sha256_verify "${target}" "${checksums}"
+  assertEquals "0" "$?" "mismatched checksum"
+
+
+  # negative case
+
+  # we are expecting error messages, which is confusing to look at in passing tests... disable logging for now
+  log_set_priority -1
+
+  checksums=./test-fixtures/assets/invalid/checksums.txt
+  target=./test-fixtures/assets/invalid/syft_1.5.0_linux_arm64.tar.gz
+
+  hash_sha256_verify "${target}" "${checksums}"
+  assertEquals "1" "$?" "verification did not catch mismatched checksum"
+
+  # restore logging...
+  log_set_priority 0
+}
+
+run_test_case test_hash_sha256_verify

test/install/1_download_snapshot_asset_test.sh

@@ -63,7 +63,7 @@ test_negative_snapshot_download_asset() {
 test_sboms_have_packages() {
   find "$(snapshot_dir)/" -name "*.sbom" -print0 | while IFS= read -r -d '' file; do
       count=$(cat "$file" | jq ".artifacts | length")
-      if [ "$count" -gt 80 ]; then
+      if [ "$count" -lt 80 ]; then
           echo "not enough packages found for file: $file"
           exit 1
       fi

test/install/2_download_release_asset_test.sh

@@ -31,6 +31,10 @@ test_download_release_asset() {
 release=$(get_release_tag "${OWNER}" "${REPO}" "latest" )
 
 # exercise all possible assets against a real github release (based on asset listing from https://github.com/anchore/syft/releases/tag/v0.36.0)
+
+# verify all downloads against the checksums file + checksums file signature
+VERIFY_SIGN=true
+
 run_test_case test_download_release_asset "${release}" "darwin" "amd64" "tar.gz" "application/gzip"
 run_test_case test_download_release_asset "${release}" "darwin" "arm64" "tar.gz" "application/gzip"
 run_test_case test_download_release_asset "${release}" "linux" "amd64" "tar.gz" "application/gzip"

test/install/4_prep_signature_verification_test.sh

@@ -0,0 +1,89 @@
+. test_harness.sh
+
+test_compare_semver() {
+  # compare_semver [version1] [version2]
+
+  # positive cases (version1 >= version2)
+  compare_semver "0.32.0" "0.32.0"
+  assertEquals "0" "$?" "+ versions should equal"
+
+  compare_semver "0.32.1" "0.32.0"
+  assertEquals "0" "$?" "+ patch version should be greater"
+
+  compare_semver "0.33.0" "0.32.0"
+  assertEquals "0" "$?" "+ minor version should be greater"
+
+  compare_semver "0.333.0" "0.32.0"
+  assertEquals "0" "$?" "+ minor version should be greater (different length)"
+
+  compare_semver "00.33.00" "0.032.0"
+  assertEquals "0" "$?" "+ minor version should be greater (different length reversed)"
+
+  compare_semver "1.0.0" "0.9.9"
+  assertEquals "0" "$?" "+ major version should be greater"
+
+  compare_semver "v1.0.0" "1.0.0"
+  assertEquals "0" "$?" "+ can remove leading 'v' from version"
+
+  # negative cases (version1 < version2)
+  compare_semver "0.32.0" "0.32.1"
+  assertEquals "1" "$?" "- patch version should be less"
+
+  compare_semver "0.32.7" "0.33.0"
+  assertEquals "1" "$?" "- minor version should be less"
+
+  compare_semver "00.00032.070" "0.33.0"
+  assertEquals "1" "$?" "- minor version should be less (different length)"
+
+  compare_semver "0.32.7" "00.0033.000"
+  assertEquals "1" "$?" "- minor version should be less (different length reversed)"
+
+  compare_semver "1.9.9" "2.0.1"
+  assertEquals "1" "$?" "- major version should be less"
+
+  compare_semver "1.0.0" "v2.0.0"
+  assertEquals "1" "$?" "- can remove leading 'v' from version"
+}
+
+run_test_case test_compare_semver
+
+# ensure that various signature verification pre-requisites are correctly checked for
+test_prep_signature_verification() {
+  # prep_sign_verification [version]
+
+  # we are expecting error messages, which is confusing to look at in passing tests... disable logging for now
+  log_set_priority -1
+
+  # backup original values...
+  OG_COSIGN_BINARY=${COSIGN_BINARY}
+
+  # check the verification path...
+  VERIFY_SIGN=true
+
+  # release does not support signature verification
+  prep_signature_verification "0.103.0"
+  assertEquals "1" "$?" "release does not support signature verification"
+
+  # check that the COSIGN binary exists
+  COSIGN_BINARY=fake-cosign-that-doesnt-exist
+  prep_signature_verification "0.105.0"
+  assertEquals "1" "$?" "cosign binary verification failed"
+  # restore original values...
+  COSIGN_BINARY=${OG_COSIGN_BINARY}
+
+  # ignore any failing conditions since we are not verifying the signature
+  VERIFY_SIGN=false
+  prep_signature_verification "0.103.0"
+  assertEquals "0" "$?" "release support verification should not have been triggered"
+
+  COSIGN_BINARY=fake-cosign-that-doesnt-exist
+  prep_signature_verification "0.105.0"
+  assertEquals "0" "$?" "cosign binary verification should not have been triggered"
+  # restore original values...
+  COSIGN_BINARY=${OG_COSIGN_BINARY}
+
+  # restore logging...
+  log_set_priority 0
+}
+
+run_test_case test_prep_signature_verification

test/install/Makefile

@@ -1,18 +1,22 @@
 NAME=syft
 
+# for local testing (not testing within containers) use the binny-managed version of cosign.
+# this also means that the user does not need to install cosign on their system to run tests.
+COSIGN_BINARY=../../.tool/cosign
+
 IMAGE_NAME=$(NAME)-install.sh-env
 UBUNTU_IMAGE=$(IMAGE_NAME):ubuntu-20.04
 ALPINE_IMAGE=$(IMAGE_NAME):alpine-3.6
-BUSYBOX_IMAGE=busybox:1.36.1-musl
+BUSYBOX_IMAGE=$(IMAGE_NAME):busybox-1.36
 
 ENVS=./environments
 DOCKER_RUN=docker run --rm -t -w /project/test/install -v $(shell pwd)/../../:/project
-UNIT=make unit-local
+UNIT=make unit-run
 
 # acceptance testing is running the current install.sh against the latest release. Note: this could be a problem down
 # the line if there are breaking changes made that don't align with the latest release (but will be OK with the next
-# release)
-ACCEPTANCE_CMD=sh -c '../../install.sh -b /usr/local/bin  && syft version'
+# release). This tests both installing with signature verification and without.
+ACCEPTANCE_CMD=sh -c '../../install.sh -v -b /usr/local/bin && syft version && rm /usr/local/bin/syft && ../../install.sh -b /usr/local/bin && syft version'
 # we also want to test against a previous release to ensure that install.sh defers execution to a former install.sh
 PREVIOUS_RELEASE=v0.33.0
 ACCEPTANCE_PREVIOUS_RELEASE_CMD=sh -c "../../install.sh -b /usr/local/bin $(PREVIOUS_RELEASE) && syft version"
@@ -28,17 +32,22 @@ endef
 test: unit acceptance
 
 .PHONY: ci-test-mac
-ci-test-mac: unit-local acceptance-local
+ci-test-mac: unit-run acceptance-local
 
 # note: do not add acceptance-local to this list
 .PHONY: acceptance
-acceptance: acceptance-ubuntu-20.04 acceptance-alpine-3.6 acceptance-busybox
+acceptance: acceptance-ubuntu-20.04 acceptance-alpine-3.6 acceptance-busybox-1.36
 
 .PHONY: unit
 unit: unit-ubuntu-20.04
 
 .PHONY: unit-local
 unit-local:
+	$(call title,unit tests)
+	@for f in $(shell ls *_test.sh); do echo "Running unit test suite '$${f}'"; bash -c "COSIGN_BINARY=$(COSIGN_BINARY) ./$${f}" || exit 1; done
+
+.PHONY: unit-run
+unit-run:
 	$(call title,unit tests)
 	@for f in $(shell ls *_test.sh); do echo "Running unit test suite '$${f}'"; bash $${f} || exit 1; done
 
@@ -55,7 +64,7 @@ acceptance-previous-release-local:
 	syft version | grep $(shell echo $(PREVIOUS_RELEASE)| tr -d "v")
 
 .PHONY: save
-save: ubuntu-20.04 alpine-3.6 pull-busybox
+save: ubuntu-20.04 alpine-3.6 busybox-1.36
 	@mkdir cache || true
 	docker image save -o cache/ubuntu-env.tar $(UBUNTU_IMAGE)
 	docker image save -o cache/alpine-env.tar $(ALPINE_IMAGE)
@@ -107,17 +116,17 @@ alpine-3.6:
 
 # note: busybox by default will not have cacerts, so you will get TLS warnings (we want to test under these conditions)
 
-.PHONY: acceptance-busybox
-acceptance-busybox: pull-busybox
-	$(call title,busybox - acceptance)
+.PHONY: acceptance-busybox-1.36
+acceptance-busybox-1.36: busybox-1.36
+	$(call title,busybox-1.36 - acceptance)
 	$(DOCKER_RUN) $(BUSYBOX_IMAGE) \
 		$(ACCEPTANCE_CMD)
 	@echo "\n*** test note: you should see syft spit out a 'x509: certificate signed by unknown authority' error --this is expected ***"
 
-.PHONY: pull-busybox
-pull-busybox:
-	$(call title,busybox - build environment)
-	docker pull $(BUSYBOX_IMAGE)
+.PHONY: busybox-1.36
+busybox-1.36:
+	$(call title,busybox-1.36 - build environment)
+	docker build -t $(BUSYBOX_IMAGE) -f $(ENVS)/Dockerfile-busybox-1.36 .
 
 ## For CI ########################################################
 

test/install/environments/Dockerfile-alpine-3.6

@@ -1,2 +1,5 @@
-FROM alpine:3.6@sha256:66790a2b79e1ea3e1dabac43990c54aca5d1ddf268d9a5a0285e4167c8b24475
-RUN apk update && apk add python3 wget unzip make ca-certificates jq
+FROM alpine:3.6
+RUN apk update && apk add python3 wget curl unzip make ca-certificates
+RUN curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64" && \
+    mv cosign-linux-amd64 /usr/local/bin/cosign && \
+    chmod +x /usr/local/bin/cosign

test/install/environments/Dockerfile-busybox-1.36

@@ -0,0 +1,21 @@
+FROM alpine as certs
+RUN apk update && apk add ca-certificates
+
+# note: using qemu with a multi-arch image results in redirects not working with wget
+# so let docker pull the image that matches the hosts architecture first and then pull the correct asset
+FROM busybox:1.36.1-musl
+
+RUN ARCH=$(uname -m) && \
+    if [ "$ARCH" = "x86_64" ]; then \
+        COSIGN_ARCH="amd64"; \
+    elif [ "$ARCH" = "aarch64" ]; then \
+        COSIGN_ARCH="arm64"; \
+    else \
+        echo "Unsupported architecture: $ARCH" && exit 1; \
+    fi && \
+    echo "Downloading cosign for $COSIGN_ARCH" && \
+    wget https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-${COSIGN_ARCH} && \
+    mv cosign-linux-${COSIGN_ARCH} /bin/cosign && \
+    chmod +x /bin/cosign
+
+COPY --from=certs /etc/ssl/certs /etc/ssl/certs

test/install/environments/Dockerfile-ubuntu-20.04

@@ -1,2 +1,5 @@
-FROM ubuntu:20.04@sha256:33a5cc25d22c45900796a1aca487ad7a7cb09f09ea00b779e3b2026b4fc2faba
-RUN apt update -y && apt install make python3 curl unzip jq -y
+FROM --platform=linux/amd64 ubuntu:20.04@sha256:33a5cc25d22c45900796a1aca487ad7a7cb09f09ea00b779e3b2026b4fc2faba
+RUN apt update -y && apt install make python3 curl unzip -y
+RUN LATEST_VERSION=$(curl https://api.github.com/repos/sigstore/cosign/releases/latest | grep tag_name | cut -d : -f2 | tr -d "v\", ") && \
+    curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_${LATEST_VERSION}_amd64.deb" && \
+    dpkg -i cosign_${LATEST_VERSION}_amd64.deb

test/install/test-fixtures/assets/invalid/.gitignore

@@ -0,0 +1 @@
+!syft_1.5.0_linux_arm64.tar.gz

test/install/test-fixtures/assets/invalid/checksums.txt

@@ -0,0 +1,22 @@
+f459ecbed6621933b4dee4a613a6bdca915631742083f77ab88752f3ae0c6a9d  syft_1.5.0_darwin_amd64.sbom
+605322e3e7043a4f2f3d6e37f75a71389d38f6f290bff2e54bb2aaebbbf4829b  syft_1.5.0_darwin_amd64.tar.gz
+2feb92f6a4d117a3eb0cc5d887ac4b8da9a959ca404986dbe76e81ac83569d76  syft_1.5.0_darwin_arm64.sbom
+fe02d072e7ec9a8eb4ac866ba973396a8beae79829ee870acaadd4d862e5e65a  syft_1.5.0_darwin_arm64.tar.gz
+40562766f99db7221dac4c82c44ccae4d9983a6795a96127f4da955d6797c090  syft_1.5.0_linux_amd64.deb
+9adc0c0a3bbbdb8ce66914ffde5e176373cf5ec70a2a88cc886dc6ec54db0cd2  syft_1.5.0_linux_amd64.rpm
+9de7f1c549020a25df12f07dd58330e6f6dd0c5363cf0de1157eb4f01fc41020  syft_1.5.0_linux_amd64.sbom
+3d10023d46dfaf0fe75288df207b478b43597f7d2fff553f58430817166bd478  syft_1.5.0_linux_amd64.tar.gz
+b661dd1be48b75b735717f9bedc4beea587968af8bf2d8c2752a302ae0a34f89  syft_1.5.0_linux_arm64.deb
+5c311f44cc73fcae58884f8ea3328fc120bdaf3d21f4fe40270a22c6bb981f6d  syft_1.5.0_linux_arm64.rpm
+a74549794fa5dac79ab9f6401ee7000db3bd9589435b302583c3ee4ca13fb8e3  syft_1.5.0_linux_arm64.sbom
+ee2b1289a1e4b0de9409c3a78867949ca42788a5f50072b8a6e6e04e6a269f9c  syft_1.5.0_linux_arm64.tar.gz
+599e66f0a00ba8b5cc7817f774c66c5f23de32e6b935ca9c03a185e4d2554d80  syft_1.5.0_linux_ppc64le.deb
+dc4b8c4a02ffd8dd394ab94695ed44ed2bfceb06bc239835c51e84dd9b84a68c  syft_1.5.0_linux_ppc64le.rpm
+392044f2951ca6522d0bc71de43763202a548d40bf836098caf286041a7c8fa4  syft_1.5.0_linux_ppc64le.sbom
+551d98b67f7476bc2e38453a588177b0b038933850a351a94c4bf360813f01d0  syft_1.5.0_linux_ppc64le.tar.gz
+98cd582d9484f428cccd7351031543038f26d4e3f1481c5916e08e65983f1e21  syft_1.5.0_linux_s390x.deb
+3a5197d43a469feaa87c723448a47a2312cf26456eef4580b59eac447baef9d4  syft_1.5.0_linux_s390x.rpm
+5805bfb3e30452c8860665ea88bfdf356e9536a35c1b8ba28ac5b4717f2e6388  syft_1.5.0_linux_s390x.sbom
+ff15f556660cc4c4279ce41e2475bffe2a0f72eb4423c21edf7380b2484fbf68  syft_1.5.0_linux_s390x.tar.gz
+6b22df07e992d8f4881901535c095d268f79924e10be34fab03dec2b4f9f9ca0  syft_1.5.0_windows_amd64.sbom
+5079c6a88e130f8677d0701cb2689f9eae2088022ecf5fa2b9f341b96d9983d2  syft_1.5.0_windows_amd64.zip

test/install/test-fixtures/assets/invalid/syft_1.5.0_linux_arm64.tar.gz

@@ -0,0 +1 @@
+fake archive

test/install/test-fixtures/assets/valid/.gitignore

@@ -0,0 +1 @@
+!syft_1.5.0_linux_arm64.tar.gz

test/install/test-fixtures/assets/valid/checksums.txt

@@ -0,0 +1,22 @@
+f459ecbed6621933b4dee4a613a6bdca915631742083f77ab88752f3ae0c6a9d  syft_1.5.0_darwin_amd64.sbom
+605322e3e7043a4f2f3d6e37f75a71389d38f6f290bff2e54bb2aaebbbf4829b  syft_1.5.0_darwin_amd64.tar.gz
+2feb92f6a4d117a3eb0cc5d887ac4b8da9a959ca404986dbe76e81ac83569d76  syft_1.5.0_darwin_arm64.sbom
+fe02d072e7ec9a8eb4ac866ba973396a8beae79829ee870acaadd4d862e5e65a  syft_1.5.0_darwin_arm64.tar.gz
+40562766f99db7221dac4c82c44ccae4d9983a6795a96127f4da955d6797c090  syft_1.5.0_linux_amd64.deb
+9adc0c0a3bbbdb8ce66914ffde5e176373cf5ec70a2a88cc886dc6ec54db0cd2  syft_1.5.0_linux_amd64.rpm
+9de7f1c549020a25df12f07dd58330e6f6dd0c5363cf0de1157eb4f01fc41020  syft_1.5.0_linux_amd64.sbom
+3d10023d46dfaf0fe75288df207b478b43597f7d2fff553f58430817166bd478  syft_1.5.0_linux_amd64.tar.gz
+b661dd1be48b75b735717f9bedc4beea587968af8bf2d8c2752a302ae0a34f89  syft_1.5.0_linux_arm64.deb
+5c311f44cc73fcae58884f8ea3328fc120bdaf3d21f4fe40270a22c6bb981f6d  syft_1.5.0_linux_arm64.rpm
+a74549794fa5dac79ab9f6401ee7000db3bd9589435b302583c3ee4ca13fb8e3  syft_1.5.0_linux_arm64.sbom
+8d57abb57a0dae3ff23c8f0df1f51951b7772822e0d560e860d6f68c24ef6d3d  syft_1.5.0_linux_arm64.tar.gz
+599e66f0a00ba8b5cc7817f774c66c5f23de32e6b935ca9c03a185e4d2554d80  syft_1.5.0_linux_ppc64le.deb
+dc4b8c4a02ffd8dd394ab94695ed44ed2bfceb06bc239835c51e84dd9b84a68c  syft_1.5.0_linux_ppc64le.rpm
+392044f2951ca6522d0bc71de43763202a548d40bf836098caf286041a7c8fa4  syft_1.5.0_linux_ppc64le.sbom
+551d98b67f7476bc2e38453a588177b0b038933850a351a94c4bf360813f01d0  syft_1.5.0_linux_ppc64le.tar.gz
+98cd582d9484f428cccd7351031543038f26d4e3f1481c5916e08e65983f1e21  syft_1.5.0_linux_s390x.deb
+3a5197d43a469feaa87c723448a47a2312cf26456eef4580b59eac447baef9d4  syft_1.5.0_linux_s390x.rpm
+5805bfb3e30452c8860665ea88bfdf356e9536a35c1b8ba28ac5b4717f2e6388  syft_1.5.0_linux_s390x.sbom
+ff15f556660cc4c4279ce41e2475bffe2a0f72eb4423c21edf7380b2484fbf68  syft_1.5.0_linux_s390x.tar.gz
+6b22df07e992d8f4881901535c095d268f79924e10be34fab03dec2b4f9f9ca0  syft_1.5.0_windows_amd64.sbom
+5079c6a88e130f8677d0701cb2689f9eae2088022ecf5fa2b9f341b96d9983d2  syft_1.5.0_windows_amd64.zip

test/install/test-fixtures/assets/valid/syft_1.5.0_linux_arm64.tar.gz

@@ -0,0 +1 @@
+fake archive