Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CNAB Security 300 #253

Merged
merged 2 commits into from
Feb 5, 2020
Merged

CNAB Security 300 #253

merged 2 commits into from
Feb 5, 2020

Conversation

trishankatdatadog
Copy link
Member

@trishankatdatadog trishankatdatadog commented Aug 15, 2019 •
edited
Loading

Major TODOs:

  • Add a threat model to basically guide what
  • Talk about signing only bundles, not images, so simplify security levels
  • Discuss use cases to talk about what should be possible (e.g., we are doing this to support that use case)
  • Explain that it doesn't matter where you store bundles or metadata, or whether it's a think or thick bundle, because verification would exactly the same

Minor TODOs:

  • Replace links to ITEs

Sub-PRs:

@msftclas
Copy link

msftclas commented Aug 15, 2019 •
edited
Loading

CLA assistant check
All CLA requirements met.

radu-matei
radu-matei reviewed Aug 15, 2019
View reviewed changes
Copy link
Member

@radu-matei radu-matei left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a great start, thanks a lot for putting this together, @trishankatdatadog!
I have a few comments, mainly about wording.

As per our conversation, I would propose the following:

  • renaming repositories to metadata repositories, in order to avoid confusions with image repositories (term which already has a meaning for containers).

  • suggest the possibility of using a single metadata repository (trusted collection in TUF) for a project, which could contain signed bundle and image metadata, together with relevant in-toto metadata.

  • suggest / propose (but not impose) a scaffolding for the project layout - with a root layout that describes the bundle provenance, and optional sublayouts for the components referenced in the bundle.

  • introduce the idea of verification images (similar to invocation images) - container images that define the environment where the in-toto verification would take place at runtime.

Thanks a lot for starting this discussion!

300-CNAB-security.md Outdated Show resolved Hide resolved
300-CNAB-security.md Outdated Show resolved Hide resolved
300-CNAB-security.md Outdated Show resolved Hide resolved
300-CNAB-security.md Outdated Show resolved Hide resolved
300-CNAB-security.md Outdated Show resolved Hide resolved
300-CNAB-security.md Show resolved Hide resolved
300-CNAB-security.md Outdated Show resolved Hide resolved
@trishankatdatadog
Copy link
Member Author

trishankatdatadog commented Sep 13, 2019 •
edited
Loading

Okay, I've decided to split everything up, and am using 300 as a roadmap. The pieces are as follows:

More to come. Stay tuned!

This was referenced Sep 16, 2019
Merged
Merged
@trishankatdatadog trishankatdatadog changed the title Cloud Native Application Bundles Security (CNAB-Sec) 1.0 WD CNAB Security 300 Sep 16, 2019
@trishankatdatadog trishankatdatadog mentioned this pull request Sep 16, 2019
Merged
1 task
vdice
vdice reviewed Dec 26, 2019
View reviewed changes
Copy link
Member

@vdice vdice left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reads great; only a few typos/suggestions.

300-CNAB-security.md Outdated Show resolved Hide resolved
300-CNAB-security.md Outdated Show resolved Hide resolved
300-CNAB-security.md Outdated Show resolved Hide resolved
300-CNAB-security.md Outdated Show resolved Hide resolved
@trishankatdatadog
Copy link
Member Author

Thanks for your feedback @vdice!

chris-crone
chris-crone reviewed Jan 29, 2020
View reviewed changes
300-CNAB-security.md Outdated Show resolved Hide resolved
@trishankatdatadog trishankatdatadog force-pushed the trishankatdatadog/301 branch 2 times, most recently from 410faca to cd5f449 Compare January 29, 2020 18:49
@trishankatdatadog
Merge remote-tracking branch 'upstream/master'
f6881da
@trishankatdatadog
write introduction
c5da9e9 
Signed-off-by: Trishank K Kuppusamy <[email protected]>

overview and table of contents

Signed-off-by: Trishank K Kuppusamy <[email protected]>

move some text around

Signed-off-by: Trishank K Kuppusamy <[email protected]>

better TOC; abstract; introduction

Signed-off-by: Trishank K Kuppusamy <[email protected]>

fix small grammar issue

Signed-off-by: Trishank K Kuppusamy <[email protected]>

introduce repos

Signed-off-by: Trishank K Kuppusamy <[email protected]>

add some TODOs about image repos

Signed-off-by: Trishank K Kuppusamy <[email protected]>

some clarifications(?)

Signed-off-by: Trishank K Kuppusamy <[email protected]>

break things up a bit

Signed-off-by: Trishank K Kuppusamy <[email protected]>

simplifying assumption: one image registry <=> one image repo

Signed-off-by: Trishank K Kuppusamy <[email protected]>

minor language edits

Signed-off-by: Trishank K Kuppusamy <[email protected]>

WIP on traditional img repos

Signed-off-by: Trishank K Kuppusamy <[email protected]>

WIP

Signed-off-by: Trishank K Kuppusamy <[email protected]>

expand ToC

Signed-off-by: Trishank K Kuppusamy <[email protected]>

defer community image repos

Signed-off-by: Trishank K Kuppusamy <[email protected]>

some minor fixes

Signed-off-by: Trishank K Kuppusamy <[email protected]>

introduce idea of gradual security

Signed-off-by: Trishank K Kuppusamy <[email protected]>

add section on gradual security

Signed-off-by: Trishank K Kuppusamy <[email protected]>

WIP

Signed-off-by: Trishank K Kuppusamy <[email protected]>

end here today

Signed-off-by: Trishank K Kuppusamy <[email protected]>

separate security analysis

Signed-off-by: Trishank K Kuppusamy <[email protected]>

move things around a bit

Signed-off-by: Trishank K Kuppusamy <[email protected]>

wrap up traditional img repos

Signed-off-by: Trishank K Kuppusamy <[email protected]>

add a sentence

Signed-off-by: Trishank K Kuppusamy <[email protected]>

mention PEPs 458 & 480 for community img repos

Signed-off-by: Trishank K Kuppusamy <[email protected]>

add a reference

Signed-off-by: Trishank K Kuppusamy <[email protected]>

draft of signing workflows

Signed-off-by: Trishank K Kuppusamy <[email protected]>

minor language edits

Signed-off-by: Trishank K Kuppusamy <[email protected]>

defer a few things

Signed-off-by: Trishank K Kuppusamy <[email protected]>

one more thing to defer for now

Signed-off-by: Trishank K Kuppusamy <[email protected]>

add some important considerations

Signed-off-by: Trishank K Kuppusamy <[email protected]>

minor edits

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Clarify why bundle.json is mounted in the invocation image (cnabio#228)

* clarify why bundle.json is mounted in the invocation image

Signed-off-by: Trishank K Kuppusamy <[email protected]>

* remove link

Signed-off-by: Trishank K Kuppusamy <[email protected]>

add a CNAB Registry icon (cnabio#232)

![cnab-registry](https://user-images.githubusercontent.com/686194/61753147-2b387a80-ad63-11e9-8a63-f250bcdf06b0.png)

Adds a registry icon, which is a variant of the main CNAB logo.

Signed-off-by: Trishank K Kuppusamy <[email protected]>

add a CNAB Security icon (cnabio#231)

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Remove the `immutable` attribute from parameters

This removes the `immutable` attribute from parameters per Issue cnabio#229

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Remove wording about immutable parameters

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Remove fields from outputs

Signed-off-by: Radu M <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

fix(claim.schema.json): s/underay/underway

Signed-off-by: Trishank K Kuppusamy <[email protected]>

fix(claim.schema.json): s/descripton/description

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Adds information about the Specification Freeze (cnabio#238)

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Update 103-bundle-runtime.md

s/Instance/Installation

Signed-off-by: Trishank K Kuppusamy <[email protected]>

massively simplify 300

Signed-off-by: Trishank K Kuppusamy <[email protected]>

terminology updates

Signed-off-by: Trishank K Kuppusamy <[email protected]>

more fine-grained security levels

Signed-off-by: Trishank K Kuppusamy <[email protected]>

KISS: break up metadata repositories, signing, verification

Signed-off-by: Trishank K Kuppusamy <[email protected]>

fix(400-claims.md): add mention of the custom field in a claim (cnabio#255)

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Update README.md (cnabio#260)

Remove the OCI mailing list info

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Update definitions schema to use a bespoke JSON Schema Version (cnabio#257)

* Update definitions schema to use integer, remove `number` as a type

Fixes cnabio#256

* Incorporate suggestion

Signed-off-by: Trishank K Kuppusamy <[email protected]>

fix: corrected a typo

Signed-off-by: Matt Butcher <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

clearify wording on writeOnly

Signed-off-by: Matt Butcher <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

clarify what to do when multiple invocation images match a pattern

Signed-off-by: Matt Butcher <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

fix: clarify the wording on stateless actions

Signed-off-by: Matt Butcher <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Add clarification to `readOnly` definition

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Clarify parameters are encoded as json strings

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Clarify defaults for outputs and parameters (cnabio#270)

* Clarify how required and default interact

* Clarify output defaults

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Removed extra were

Signed-off-by: Trishank K Kuppusamy <[email protected]>

explain how claims treat parameters and credentials differently, and why (cnabio#267)

Signed-off-by: Matt Butcher <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Update contentDigest wording to clarify behavior (cnabio#261)

* Update contentDigest wording to clarify behavior

Fixes: cnabio#254

* Update markup for contentDigest

* Update comments

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Clarify upgrade version handling responsibility

Signed-off-by: Christopher Crone <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Improve wording

Signed-off-by: Christopher Crone <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Fix OWF Contributor License Agreement link (cnabio#276)

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Clarify failed action handling (cnabio#274)

Signed-off-by: Christopher Crone <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

CNAB Core 1.0 GA

This commit marks the Working Group Acceptance (GA) of the CNAB Core 1.0 specification.

Signed-off-by: Matt Butcher <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Final Approval for CNAB Core 1.0 Specification

This commit indicates that the CNAB specification is now a published final version.

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Update README.md

Co-Authored-By: Carolyn Van Slyck <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Update 100-CNAB.md

Co-Authored-By: Carolyn Van Slyck <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Add mailing list (cnabio#283)

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Bump bundle schemaVersion to 1.0.0 (cnabio#278)

Signed-off-by: Christopher Crone <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Update 103-bundle-runtime.md

fixing the misleading description in the example of setting parameter value in file.

Signed-off-by: Trishank K Kuppusamy <[email protected]>

Define host environment

Signed-off-by: Matt Butcher <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Make status.json a CNAB Output

Signed-off-by: Trishank K Kuppusamy <[email protected]>

fix: remove an unnecessary section

Signed-off-by: Matt Butcher <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

add bundleReference to the claim specification

Signed-off-by: Matt Butcher <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

Update 400-claims.md

Co-Authored-By: Glyn Normington <[email protected]>
Signed-off-by: Trishank K Kuppusamy <[email protected]>

address @vdice feedback

Signed-off-by: Trishank K Kuppusamy <[email protected]>

remove .gitignore

Signed-off-by: Trishank K Kuppusamy <[email protected]>

fix links per @chris-crone feedback

Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
Copy link
Member Author

Could @vdice or @chris-crone please 👀, ✅, and merge? Thanks!

vdice
vdice approved these changes Feb 5, 2020
View reviewed changes
Copy link
Member

@vdice vdice left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🎉

@vdice vdice merged commit a9e46ce into cnabio:master Feb 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vdice vdice vdice approved these changes

@radu-matei radu-matei radu-matei approved these changes

@chris-crone chris-crone Awaiting requested review from chris-crone

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@trishankatdatadog @msftclas @chris-crone @vdice @radu-matei