github.com/argoproj/argo-cd/v2@v2.10.9/docs/operator-manual/signed-release-assets.md (about) 1 # Verification of Argo CD Artifacts 2 3 ## Prerequisites 4 - cosign `v2.0.0` or higher [installation instructions](https://docs.sigstore.dev/cosign/installation) 5 - slsa-verifier [installation instructions](https://github.com/slsa-framework/slsa-verifier#installation) 6 - crane [installation instructions](https://github.com/google/go-containerregistry/blob/main/cmd/crane/README.md) (for container verification only) 7 8 *** 9 ## Release Assets 10 | Asset | Description | 11 |-------------------------|-------------------------------| 12 | argocd-darwin-amd64 | CLI Binary | 13 | argocd-darwin-arm64 | CLI Binary | 14 | argocd-linux_amd64 | CLI Binary | 15 | argocd-linux_arm64 | CLI Binary | 16 | argocd-linux_ppc64le | CLI Binary | 17 | argocd-linux_s390x | CLI Binary | 18 | argocd-windows_amd64 | CLI Binary | 19 | argocd-cli.intoto.jsonl | Attestation of CLI binaries | 20 | cli_checksums.txt | Checksums of binaries | 21 | sbom.tar.gz | Sbom | 22 | sbom.tar.gz.pem | Certificate used to sign sbom | 23 | sbom.tar.gz.sig | Signature of sbom | 24 25 *** 26 ## Verification of container images 27 28 Argo CD container images are signed by [cosign](https://github.com/sigstore/cosign) using identity-based ("keyless") signing and transparency. Executing the following command can be used to verify the signature of a container image: 29 30 ```bash 31 cosign verify \ 32 --certificate-identity-regexp https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@refs/tags/v \ 33 --certificate-oidc-issuer https://token.actions.githubusercontent.com \ 34 quay.io/argoproj/argocd:v2.7.0 | jq 35 ``` 36 The command should output the following if the container image was correctly verified: 37 ```bash 38 The following checks were performed on each of these signatures: 39 - The cosign claims were validated 40 - Existence of the claims in the transparency log was verified offline 41 - Any certificates were verified against the Fulcio roots. 42 [ 43 { 44 "critical": { 45 "identity": { 46 "docker-reference": "quay.io/argoproj/argo-cd" 47 }, 48 "image": { 49 "docker-manifest-digest": "sha256:63dc60481b1b2abf271e1f2b866be8a92962b0e53aaa728902caa8ac8d235277" 50 }, 51 "type": "cosign container image signature" 52 }, 53 "optional": { 54 "1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com", 55 "1.3.6.1.4.1.57264.1.2": "push", 56 "1.3.6.1.4.1.57264.1.3": "a6ec84da0eaa519cbd91a8f016cf4050c03323b2", 57 "1.3.6.1.4.1.57264.1.4": "Publish ArgoCD Release", 58 "1.3.6.1.4.1.57264.1.5": "argoproj/argo-cd", 59 "1.3.6.1.4.1.57264.1.6": "refs/tags/<version>", 60 ... 61 ``` 62 63 *** 64 ## Verification of container image with SLSA attestations 65 66 A [SLSA](https://slsa.dev/) Level 3 provenance is generated using [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator). 67 68 The following command will verify the signature of an attestation and how it was issued. It will contain the payloadType, payload, and signature. 69 70 Run the following command as per the [slsa-verifier documentation](https://github.com/slsa-framework/slsa-verifier/tree/main#containers): 71 72 ```bash 73 # Get the immutable container image to prevent TOCTOU attacks https://github.com/slsa-framework/slsa-verifier#toctou-attacks 74 IMAGE=quay.io/argoproj/argocd:v2.7.0 75 IMAGE="${IMAGE}@"$(crane digest "${IMAGE}") 76 # Verify provenance, including the tag to prevent rollback attacks. 77 slsa-verifier verify-image "$IMAGE" \ 78 --source-uri github.com/argoproj/argo-cd \ 79 --source-tag v2.7.0 80 ``` 81 82 If you only want to verify up to the major or minor verion of the source repository tag (instead of the full tag), use the `--source-versioned-tag` which performs semantic versioning verification: 83 84 ```shell 85 slsa-verifier verify-image "$IMAGE" \ 86 --source-uri github.com/argoproj/argo-cd \ 87 --source-versioned-tag v2 # Note: May use v2.7 for minor version verification. 88 ``` 89 90 The attestation payload contains a non-forgeable provenance which is base64 encoded and can be viewed by passing the `--print-provenance` option to the commands above: 91 92 ```bash 93 slsa-verifier verify-image "$IMAGE" \ 94 --source-uri github.com/argoproj/argo-cd \ 95 --source-tag v2.7.0 96 --print-provenance | jq 97 ``` 98 99 If you prefer using cosign, follow these [instructions](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#cosign). 100 101 !!! tip 102 `cosign` or `slsa-verifier` can both be used to verify image attestations. 103 Check the documentation of each binary for detailed instructions. 104 105 *** 106 107 ## Verification of CLI artifacts with SLSA attestations 108 109 A single attestation (`argocd-cli.intoto.jsonl`) from each release is provided. This can be used with [slsa-verifier](https://github.com/slsa-framework/slsa-verifier#verification-for-github-builders) to verify that a CLI binary was generated using Argo CD workflows on GitHub and ensures it was cryptographically signed. 110 111 ```bash 112 slsa-verifier verify-artifact argocd-linux-amd64 \ 113 --provenance-path argocd-cli.intoto.jsonl \ 114 --source-uri github.com/argoproj/argo-cd \ 115 --source-tag v2.7.0 116 ``` 117 118 If you only want to verify up to the major or minor verion of the source repository tag (instead of the full tag), use the `--source-versioned-tag` which performs semantic versioning verification: 119 120 ```shell 121 slsa-verifier verify-artifact argocd-linux-amd64 \ 122 --provenance-path argocd-cli.intoto.jsonl \ 123 --source-uri github.com/argoproj/argo-cd \ 124 --source-versioned-tag v2 # Note: May use v2.7 for minor version verification. 125 ``` 126 127 The payload is a non-forgeable provenance which is base64 encoded and can be viewed by passing the `--print-provenance` option to the commands above: 128 129 ```bash 130 slsa-verifier verify-artifact argocd-linux-amd64 \ 131 --provenance-path argocd-cli.intoto.jsonl \ 132 --source-uri github.com/argoproj/argo-cd \ 133 --source-tag v2.7.0 \ 134 --print-provenance | jq 135 ``` 136 137 ## Verification of Sbom 138 139 A single attestation (`argocd-sbom.intoto.jsonl`) from each release is provided along with the sbom (`sbom.tar.gz`). This can be used with [slsa-verifier](https://github.com/slsa-framework/slsa-verifier#verification-for-github-builders) to verify that the SBOM was generated using Argo CD workflows on GitHub and ensures it was cryptographically signed. 140 141 ```bash 142 slsa-verifier verify-artifact sbom.tar.gz \ 143 --provenance-path argocd-sbom.intoto.jsonl \ 144 --source-uri github.com/argoproj/argo-cd \ 145 --source-tag v2.7.0 146 ``` 147 148 *** 149 ## Verification on Kubernetes 150 151 ### Policy controllers 152 !!! note 153 We encourage all users to verify signatures and provenances with your admission/policy controller of choice. Doing so will verify that an image was built by us before it's deployed on your Kubernetes cluster. 154 155 Cosign signatures and SLSA provenances are compatible with several types of admission controllers. Please see the [cosign documentation](https://docs.sigstore.dev/cosign/overview/#kubernetes-integrations) and [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#verification) for supported controllers.