Manifest lists break signatures verification? about image HOT 5 CLOSED

We’ve been somewhat discussing these things before, e.g. #25 .

I’m not sure what the best way to handle signatures for manifest lists is ATM. From a security POV, a signed manifest list implicitly authenticates the signed manifests, so, yes, a manifest signature could be accepted for the manifests listed in there.

OTOH that semantics may get messy: 1) download a manifest list 2) choose an item in the list, see the manifest digest; 3) publish/note the digest of the chosen manifest. Now, the user, given 3), can pull withmanifestlist@sha256:digestfromstep3 to refer to an individual manifest, and there is no obvious way to to from sha256:digestfromstep3 to the original manifest list (its digest, and tag, if any, are not known), so the signatures on the manifest list cannot be applied to the individual manifest. So, this would argue for attaching signatures to the individual images, not to the manifest list.

To a big extent extent all of this strongly depends on whether the tools (are there any in widespread use?) present manifest lists more as a single “fat” image or more as a directory of individually managed images; the signature UX model should be consistent with the non-signature manifest list UX model.

from image.

OTOH that semantics may get messy: 1) download a manifest list 2) choose an item in the list, see the manifest digest; 3) publish/note the digest of the chosen manifest. Now, the user, given 3), can pull withmanifestlist@sha256:digestfromstep3 to refer to an individual manifest, and there is no obvious way to to from sha256:digestfromstep3 to the original manifest list (its digest, and tag, if any, are not known), so the signatures on the manifest list cannot be applied to the individual manifest. So, this would argue for attaching signatures to the individual images, not to the manifest list.

Right...

I’m not sure what the best way to handle signatures for manifest lists is ATM. From a security POV, a signed manifest list implicitly authenticates the signed manifests, so, yes, a manifest signature could be accepted for the manifests listed in there.

is #115 in line with this though for now?

from image.

#115 is, AFAICS, OK WRT signing security.

from image.

@mtrmac @vrothberg What is the state of this issue. It is two years old, can we close it?

from image.

We’ve settled on signing individual images, not the manifest list itself.

from image.