From 1d4e04bed101ea767a4fc8930c317210cc6618ec Mon Sep 17 00:00:00 2001 From: Tonis Tiigi Date: Thu, 4 Dec 2025 17:16:21 -0800 Subject: [PATCH] api: add inspect identity base type to expose trusted image origin Signed-off-by: Tonis Tiigi Signed-off-by: Sebastiaan van Stijn --- api/types/image/build_identity.go | 15 +++++ api/types/image/identity.go | 15 +++++ api/types/image/image_inspect.go | 29 ++++++++++ api/types/image/pull_identity.go | 8 +++ api/types/image/signature_identity.go | 26 +++++++++ api/types/image/signature_timestamp.go | 12 ++++ api/types/image/signer_identity.go | 57 +++++++++++++++++++ .../moby/api/types/image/build_identity.go | 15 +++++ .../moby/moby/api/types/image/identity.go | 15 +++++ .../moby/api/types/image/image_inspect.go | 29 ++++++++++ .../moby/api/types/image/pull_identity.go | 8 +++ .../api/types/image/signature_identity.go | 26 +++++++++ .../api/types/image/signature_timestamp.go | 12 ++++ .../moby/api/types/image/signer_identity.go | 57 +++++++++++++++++++ 14 files changed, 324 insertions(+) create mode 100644 api/types/image/build_identity.go create mode 100644 api/types/image/identity.go create mode 100644 api/types/image/pull_identity.go create mode 100644 api/types/image/signature_identity.go create mode 100644 api/types/image/signature_timestamp.go create mode 100644 api/types/image/signer_identity.go create mode 100644 vendor/github.com/moby/moby/api/types/image/build_identity.go create mode 100644 vendor/github.com/moby/moby/api/types/image/identity.go create mode 100644 vendor/github.com/moby/moby/api/types/image/pull_identity.go create mode 100644 vendor/github.com/moby/moby/api/types/image/signature_identity.go create mode 100644 vendor/github.com/moby/moby/api/types/image/signature_timestamp.go create mode 100644 vendor/github.com/moby/moby/api/types/image/signer_identity.go diff --git a/api/types/image/build_identity.go b/api/types/image/build_identity.go new file mode 100644 index 0000000000..1e827dc430 --- /dev/null +++ b/api/types/image/build_identity.go @@ -0,0 +1,15 @@ +package image + +import ( + "time" +) + +// BuildIdentity contains build reference information if image was created via build. +type BuildIdentity struct { + // Ref is the identifier for the build request. This reference can be used to + // look up the build details in BuildKit history API. + Ref string `json:"Ref,omitempty"` + + // CreatedAt is the time when the build ran. + CreatedAt time.Time `json:"CreatedAt,omitempty"` +} diff --git a/api/types/image/identity.go b/api/types/image/identity.go new file mode 100644 index 0000000000..3e03045634 --- /dev/null +++ b/api/types/image/identity.go @@ -0,0 +1,15 @@ +package image + +// Identity holds information about the identity and origin of the image. +// This is trusted information verified by the daemon and cannot be modified +// by tagging an image to a different name. +type Identity struct { + // Signature contains the properties of verified signatures for the image. + Signature []SignatureIdentity `json:"Signature,omitzero"` + // Pull contains remote location information if image was created via pull. + // If image was pulled via mirror, this contains the original repository location. + // After successful push this images also contains the pushed repository location. + Pull []PullIdentity `json:"Pull,omitzero"` + // Build contains build reference information if image was created via build. + Build []BuildIdentity `json:"Build,omitzero"` +} diff --git a/api/types/image/image_inspect.go b/api/types/image/image_inspect.go index 66a277e557..df09c9511b 100644 --- a/api/types/image/image_inspect.go +++ b/api/types/image/image_inspect.go @@ -105,4 +105,33 @@ type InspectResponse struct { // WARNING: This is experimental and may change at any time without any backward // compatibility. Manifests []ManifestSummary `json:"Manifests,omitempty"` + + // Identity holds information about the identity and origin of the image. + // This is trusted information verified by the daemon and cannot be modified + // by tagging an image to a different name. + Identity *Identity `json:"Identity,omitempty"` } + +// SignatureTimestampType is the type of timestamp used in the signature. +type SignatureTimestampType string + +const ( + SignatureTimestampTlog SignatureTimestampType = "Tlog" + SignatureTimestampAuthority SignatureTimestampType = "TimestampAuthority" +) + +// SignatureType is the type of signature format. +type SignatureType string + +const ( + SignatureTypeBundleV03 SignatureType = "bundle-v0.3" + SignatureTypeSimpleSigningV1 SignatureType = "simplesigning-v1" +) + +// KnownSignerIdentity is an identifier for a special signer identity that is known to the implementation. +type KnownSignerIdentity string + +const ( + // KnownSignerDHI is the known identity for Docker Hardened Images. + KnownSignerDHI KnownSignerIdentity = "DHI" +) diff --git a/api/types/image/pull_identity.go b/api/types/image/pull_identity.go new file mode 100644 index 0000000000..711492b5c5 --- /dev/null +++ b/api/types/image/pull_identity.go @@ -0,0 +1,8 @@ +package image + +// PullIdentity contains remote location information if image was created via pull. +// If image was pulled via mirror, this contains the original repository location. +type PullIdentity struct { + // Repository is the remote repository location the image was pulled from. + Repository string `json:"Repository,omitempty"` +} diff --git a/api/types/image/signature_identity.go b/api/types/image/signature_identity.go new file mode 100644 index 0000000000..243c2997c4 --- /dev/null +++ b/api/types/image/signature_identity.go @@ -0,0 +1,26 @@ +package image + +// SignatureIdentity contains the properties of verified signatures for the image. +type SignatureIdentity struct { + // Name is a textual description summarizing the type of signature. + Name string `json:"Name,omitempty"` + // Timestamps contains a list of verified signed timestamps for the signature. + Timestamps []SignatureTimestamp `json:"Timestamps,omitzero"` + // KnownSigner is an identifier for a special signer identity that is known to the implementation. + KnownSigner KnownSignerIdentity `json:"KnownSigner,omitempty"` + // DockerReference is the Docker image reference associated with the signature. + // This is an optional field only present in older hashedrecord signatures. + DockerReference string `json:"DockerReference,omitempty"` + // Signer contains information about the signer certificate used to sign the image. + Signer *SignerIdentity `json:"Signer,omitempty"` + // SignatureType is the type of signature format. E.g. "bundle-v0.3" or "hashedrecord". + SignatureType SignatureType `json:"SignatureType,omitempty"` + + // Error contains error information if signature verification failed. + // Other fields will be empty in this case. + Error string `json:"Error,omitempty"` + // Warnings contains any warnings that occurred during signature verification. + // For example, if there was no internet connectivity and cached trust roots were used. + // Warning does not indicate a failed verification but may point to configuration issues. + Warnings []string `json:"Warnings,omitzero"` +} diff --git a/api/types/image/signature_timestamp.go b/api/types/image/signature_timestamp.go new file mode 100644 index 0000000000..a975ef0eea --- /dev/null +++ b/api/types/image/signature_timestamp.go @@ -0,0 +1,12 @@ +package image + +import ( + "time" +) + +// SignatureTimestamp contains information about a verified signed timestamp for an image signature. +type SignatureTimestamp struct { + Type SignatureTimestampType `json:"Type"` + URI string `json:"URI"` + Timestamp time.Time `json:"Timestamp"` +} diff --git a/api/types/image/signer_identity.go b/api/types/image/signer_identity.go new file mode 100644 index 0000000000..87419e1484 --- /dev/null +++ b/api/types/image/signer_identity.go @@ -0,0 +1,57 @@ +package image + +// SignerIdentity contains information about the signer certificate used to sign the image. +// This is [certificate.Summary] with deprecated fields removed and keys in Moby uppercase style. +// +// [certificate.Summary]: https://pkg.go.dev/github.com/sigstore/sigstore-go/pkg/fulcio/certificate#Summary +type SignerIdentity struct { + CertificateIssuer string `json:"CertificateIssuer"` + SubjectAlternativeName string `json:"SubjectAlternativeName"` + // The OIDC issuer. Should match `iss` claim of ID token or, in the case of + // a federated login like Dex it should match the issuer URL of the + // upstream issuer. The issuer is not set the extensions are invalid and + // will fail to render. + Issuer string `json:"Issuer,omitempty"` // OID 1.3.6.1.4.1.57264.1.8 and 1.3.6.1.4.1.57264.1.1 (Deprecated) + + // Reference to specific build instructions that are responsible for signing. + BuildSignerURI string `json:"BuildSignerURI,omitempty"` // 1.3.6.1.4.1.57264.1.9 + + // Immutable reference to the specific version of the build instructions that is responsible for signing. + BuildSignerDigest string `json:"BuildSignerDigest,omitempty"` // 1.3.6.1.4.1.57264.1.10 + + // Specifies whether the build took place in platform-hosted cloud infrastructure or customer/self-hosted infrastructure. + RunnerEnvironment string `json:"RunnerEnvironment,omitempty"` // 1.3.6.1.4.1.57264.1.11 + + // Source repository URL that the build was based on. + SourceRepositoryURI string `json:"SourceRepositoryURI,omitempty"` // 1.3.6.1.4.1.57264.1.12 + + // Immutable reference to a specific version of the source code that the build was based upon. + SourceRepositoryDigest string `json:"SourceRepositoryDigest,omitempty"` // 1.3.6.1.4.1.57264.1.13 + + // Source Repository Ref that the build run was based upon. + SourceRepositoryRef string `json:"SourceRepositoryRef,omitempty"` // 1.3.6.1.4.1.57264.1.14 + + // Immutable identifier for the source repository the workflow was based upon. + SourceRepositoryIdentifier string `json:"SourceRepositoryIdentifier,omitempty"` // 1.3.6.1.4.1.57264.1.15 + + // Source repository owner URL of the owner of the source repository that the build was based on. + SourceRepositoryOwnerURI string `json:"SourceRepositoryOwnerURI,omitempty"` // 1.3.6.1.4.1.57264.1.16 + + // Immutable identifier for the owner of the source repository that the workflow was based upon. + SourceRepositoryOwnerIdentifier string `json:"SourceRepositoryOwnerIdentifier,omitempty"` // 1.3.6.1.4.1.57264.1.17 + + // Build Config URL to the top-level/initiating build instructions. + BuildConfigURI string `json:"BuildConfigURI,omitempty"` // 1.3.6.1.4.1.57264.1.18 + + // Immutable reference to the specific version of the top-level/initiating build instructions. + BuildConfigDigest string `json:"BuildConfigDigest,omitempty"` // 1.3.6.1.4.1.57264.1.19 + + // Event or action that initiated the build. + BuildTrigger string `json:"BuildTrigger,omitempty"` // 1.3.6.1.4.1.57264.1.20 + + // Run Invocation URL to uniquely identify the build execution. + RunInvocationURI string `json:"RunInvocationURI,omitempty"` // 1.3.6.1.4.1.57264.1.21 + + // Source repository visibility at the time of signing the certificate. + SourceRepositoryVisibilityAtSigning string `json:"SourceRepositoryVisibilityAtSigning,omitempty"` // 1.3.6.1.4.1.57264.1.22 +} diff --git a/vendor/github.com/moby/moby/api/types/image/build_identity.go b/vendor/github.com/moby/moby/api/types/image/build_identity.go new file mode 100644 index 0000000000..1e827dc430 --- /dev/null +++ b/vendor/github.com/moby/moby/api/types/image/build_identity.go @@ -0,0 +1,15 @@ +package image + +import ( + "time" +) + +// BuildIdentity contains build reference information if image was created via build. +type BuildIdentity struct { + // Ref is the identifier for the build request. This reference can be used to + // look up the build details in BuildKit history API. + Ref string `json:"Ref,omitempty"` + + // CreatedAt is the time when the build ran. + CreatedAt time.Time `json:"CreatedAt,omitempty"` +} diff --git a/vendor/github.com/moby/moby/api/types/image/identity.go b/vendor/github.com/moby/moby/api/types/image/identity.go new file mode 100644 index 0000000000..3e03045634 --- /dev/null +++ b/vendor/github.com/moby/moby/api/types/image/identity.go @@ -0,0 +1,15 @@ +package image + +// Identity holds information about the identity and origin of the image. +// This is trusted information verified by the daemon and cannot be modified +// by tagging an image to a different name. +type Identity struct { + // Signature contains the properties of verified signatures for the image. + Signature []SignatureIdentity `json:"Signature,omitzero"` + // Pull contains remote location information if image was created via pull. + // If image was pulled via mirror, this contains the original repository location. + // After successful push this images also contains the pushed repository location. + Pull []PullIdentity `json:"Pull,omitzero"` + // Build contains build reference information if image was created via build. + Build []BuildIdentity `json:"Build,omitzero"` +} diff --git a/vendor/github.com/moby/moby/api/types/image/image_inspect.go b/vendor/github.com/moby/moby/api/types/image/image_inspect.go index 66a277e557..df09c9511b 100644 --- a/vendor/github.com/moby/moby/api/types/image/image_inspect.go +++ b/vendor/github.com/moby/moby/api/types/image/image_inspect.go @@ -105,4 +105,33 @@ type InspectResponse struct { // WARNING: This is experimental and may change at any time without any backward // compatibility. Manifests []ManifestSummary `json:"Manifests,omitempty"` + + // Identity holds information about the identity and origin of the image. + // This is trusted information verified by the daemon and cannot be modified + // by tagging an image to a different name. + Identity *Identity `json:"Identity,omitempty"` } + +// SignatureTimestampType is the type of timestamp used in the signature. +type SignatureTimestampType string + +const ( + SignatureTimestampTlog SignatureTimestampType = "Tlog" + SignatureTimestampAuthority SignatureTimestampType = "TimestampAuthority" +) + +// SignatureType is the type of signature format. +type SignatureType string + +const ( + SignatureTypeBundleV03 SignatureType = "bundle-v0.3" + SignatureTypeSimpleSigningV1 SignatureType = "simplesigning-v1" +) + +// KnownSignerIdentity is an identifier for a special signer identity that is known to the implementation. +type KnownSignerIdentity string + +const ( + // KnownSignerDHI is the known identity for Docker Hardened Images. + KnownSignerDHI KnownSignerIdentity = "DHI" +) diff --git a/vendor/github.com/moby/moby/api/types/image/pull_identity.go b/vendor/github.com/moby/moby/api/types/image/pull_identity.go new file mode 100644 index 0000000000..711492b5c5 --- /dev/null +++ b/vendor/github.com/moby/moby/api/types/image/pull_identity.go @@ -0,0 +1,8 @@ +package image + +// PullIdentity contains remote location information if image was created via pull. +// If image was pulled via mirror, this contains the original repository location. +type PullIdentity struct { + // Repository is the remote repository location the image was pulled from. + Repository string `json:"Repository,omitempty"` +} diff --git a/vendor/github.com/moby/moby/api/types/image/signature_identity.go b/vendor/github.com/moby/moby/api/types/image/signature_identity.go new file mode 100644 index 0000000000..243c2997c4 --- /dev/null +++ b/vendor/github.com/moby/moby/api/types/image/signature_identity.go @@ -0,0 +1,26 @@ +package image + +// SignatureIdentity contains the properties of verified signatures for the image. +type SignatureIdentity struct { + // Name is a textual description summarizing the type of signature. + Name string `json:"Name,omitempty"` + // Timestamps contains a list of verified signed timestamps for the signature. + Timestamps []SignatureTimestamp `json:"Timestamps,omitzero"` + // KnownSigner is an identifier for a special signer identity that is known to the implementation. + KnownSigner KnownSignerIdentity `json:"KnownSigner,omitempty"` + // DockerReference is the Docker image reference associated with the signature. + // This is an optional field only present in older hashedrecord signatures. + DockerReference string `json:"DockerReference,omitempty"` + // Signer contains information about the signer certificate used to sign the image. + Signer *SignerIdentity `json:"Signer,omitempty"` + // SignatureType is the type of signature format. E.g. "bundle-v0.3" or "hashedrecord". + SignatureType SignatureType `json:"SignatureType,omitempty"` + + // Error contains error information if signature verification failed. + // Other fields will be empty in this case. + Error string `json:"Error,omitempty"` + // Warnings contains any warnings that occurred during signature verification. + // For example, if there was no internet connectivity and cached trust roots were used. + // Warning does not indicate a failed verification but may point to configuration issues. + Warnings []string `json:"Warnings,omitzero"` +} diff --git a/vendor/github.com/moby/moby/api/types/image/signature_timestamp.go b/vendor/github.com/moby/moby/api/types/image/signature_timestamp.go new file mode 100644 index 0000000000..a975ef0eea --- /dev/null +++ b/vendor/github.com/moby/moby/api/types/image/signature_timestamp.go @@ -0,0 +1,12 @@ +package image + +import ( + "time" +) + +// SignatureTimestamp contains information about a verified signed timestamp for an image signature. +type SignatureTimestamp struct { + Type SignatureTimestampType `json:"Type"` + URI string `json:"URI"` + Timestamp time.Time `json:"Timestamp"` +} diff --git a/vendor/github.com/moby/moby/api/types/image/signer_identity.go b/vendor/github.com/moby/moby/api/types/image/signer_identity.go new file mode 100644 index 0000000000..87419e1484 --- /dev/null +++ b/vendor/github.com/moby/moby/api/types/image/signer_identity.go @@ -0,0 +1,57 @@ +package image + +// SignerIdentity contains information about the signer certificate used to sign the image. +// This is [certificate.Summary] with deprecated fields removed and keys in Moby uppercase style. +// +// [certificate.Summary]: https://pkg.go.dev/github.com/sigstore/sigstore-go/pkg/fulcio/certificate#Summary +type SignerIdentity struct { + CertificateIssuer string `json:"CertificateIssuer"` + SubjectAlternativeName string `json:"SubjectAlternativeName"` + // The OIDC issuer. Should match `iss` claim of ID token or, in the case of + // a federated login like Dex it should match the issuer URL of the + // upstream issuer. The issuer is not set the extensions are invalid and + // will fail to render. + Issuer string `json:"Issuer,omitempty"` // OID 1.3.6.1.4.1.57264.1.8 and 1.3.6.1.4.1.57264.1.1 (Deprecated) + + // Reference to specific build instructions that are responsible for signing. + BuildSignerURI string `json:"BuildSignerURI,omitempty"` // 1.3.6.1.4.1.57264.1.9 + + // Immutable reference to the specific version of the build instructions that is responsible for signing. + BuildSignerDigest string `json:"BuildSignerDigest,omitempty"` // 1.3.6.1.4.1.57264.1.10 + + // Specifies whether the build took place in platform-hosted cloud infrastructure or customer/self-hosted infrastructure. + RunnerEnvironment string `json:"RunnerEnvironment,omitempty"` // 1.3.6.1.4.1.57264.1.11 + + // Source repository URL that the build was based on. + SourceRepositoryURI string `json:"SourceRepositoryURI,omitempty"` // 1.3.6.1.4.1.57264.1.12 + + // Immutable reference to a specific version of the source code that the build was based upon. + SourceRepositoryDigest string `json:"SourceRepositoryDigest,omitempty"` // 1.3.6.1.4.1.57264.1.13 + + // Source Repository Ref that the build run was based upon. + SourceRepositoryRef string `json:"SourceRepositoryRef,omitempty"` // 1.3.6.1.4.1.57264.1.14 + + // Immutable identifier for the source repository the workflow was based upon. + SourceRepositoryIdentifier string `json:"SourceRepositoryIdentifier,omitempty"` // 1.3.6.1.4.1.57264.1.15 + + // Source repository owner URL of the owner of the source repository that the build was based on. + SourceRepositoryOwnerURI string `json:"SourceRepositoryOwnerURI,omitempty"` // 1.3.6.1.4.1.57264.1.16 + + // Immutable identifier for the owner of the source repository that the workflow was based upon. + SourceRepositoryOwnerIdentifier string `json:"SourceRepositoryOwnerIdentifier,omitempty"` // 1.3.6.1.4.1.57264.1.17 + + // Build Config URL to the top-level/initiating build instructions. + BuildConfigURI string `json:"BuildConfigURI,omitempty"` // 1.3.6.1.4.1.57264.1.18 + + // Immutable reference to the specific version of the top-level/initiating build instructions. + BuildConfigDigest string `json:"BuildConfigDigest,omitempty"` // 1.3.6.1.4.1.57264.1.19 + + // Event or action that initiated the build. + BuildTrigger string `json:"BuildTrigger,omitempty"` // 1.3.6.1.4.1.57264.1.20 + + // Run Invocation URL to uniquely identify the build execution. + RunInvocationURI string `json:"RunInvocationURI,omitempty"` // 1.3.6.1.4.1.57264.1.21 + + // Source repository visibility at the time of signing the certificate. + SourceRepositoryVisibilityAtSigning string `json:"SourceRepositoryVisibilityAtSigning,omitempty"` // 1.3.6.1.4.1.57264.1.22 +}