Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move TLS authentication material to registry credentials object #195

Merged
merged 4 commits into from
Aug 29, 2023

Conversation

wagoodman
Copy link
Contributor

@wagoodman wagoodman commented Aug 28, 2023

#169 added support for providing client certificate and key for MTLS authentication with a registry as well as the ability to validate cert chains with a self-signed cert. This augments that PR by moving this client cert configuration to a per-registry configuration while expanding the ca cert configuration on registry options.

Though the CAFile on the go tlsconfig options does not replace the root cert pool with the single user-provided cert, having a singular field for this (instead of per-registry) prevents the ability to provide multiple CA certs for use with multiple registries that may have certs from unrelated CAs. The larger issue is that ClientCert would be presented to any registry, even though it should only apply to a single registry.

The specific changes made are:

  • change the CAFile option to allow for either a single cert file or directory of *.crt, *.cert, *.pem files (new item is CAFileOrDir).
  • Move ClientCert and ClientKey to the RegistryCredentials object.
  • Add RegistryOptions.TLSOptions to handle crafting TLS options for MTLS.
  • Add ability to select and order the most specific credentials based on authority. This means that config items with a matching authority are preferred over config items with no authority specified.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
@github-actions
Copy link

github-actions bot commented Aug 28, 2023

Benchmark Test Results

Benchmark results from the latest changes vs base branch
latest: Pulling from library/ubuntu
b237fe92c417: Pull complete
tar: Option --mtime: Treating date 'UTC 2019-09-16' as 2019-09-16 00:00:00
goos: linux
goarch: amd64
pkg: github.com/anchore/stereoscope/pkg/file
cpu: Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz
docker: 
           │ ./.tmp/benchmark-a402d50.txt │
           │            sec/op            │
TarIndex-2                   53.21µ ± ∞ ¹
¹ need >= 6 samples for confidence interval at level 0.95

           │ ./.tmp/benchmark-a402d50.txt │
           │             B/op             │
TarIndex-2                  5.561Ki ± ∞ ¹
¹ need >= 6 samples for confidence interval at level 0.95

           │ ./.tmp/benchmark-a402d50.txt │
           │          allocs/op           │
TarIndex-2                    93.00 ± ∞ ¹
¹ need >= 6 samples for confidence interval at level 0.95

pkg: github.com/anchore/stereoscope/test/integration
                                      │ ./.tmp/benchmark-a402d50.txt │
                                      │            sec/op            │
SimpleImage_GetImage/docker-archive-2                   1.915m ± ∞ ¹
SimpleImage_GetImage/oci-archive-2                      1.784m ± ∞ ¹
SimpleImage_GetImage/oci-dir-2                          1.300m ± ∞ ¹
geomean                                                 1.643m
¹ need >= 6 samples for confidence interval at level 0.95

                                      │ ./.tmp/benchmark-a402d50.txt │
                                      │             B/op             │
SimpleImage_GetImage/docker-archive-2                  325.2Ki ± ∞ ¹
SimpleImage_GetImage/oci-archive-2                     645.9Ki ± ∞ ¹
SimpleImage_GetImage/oci-dir-2                         413.1Ki ± ∞ ¹
geomean                                                442.7Ki
¹ need >= 6 samples for confidence interval at level 0.95

                                      │ ./.tmp/benchmark-a402d50.txt │
                                      │          allocs/op           │
SimpleImage_GetImage/docker-archive-2                   2.658k ± ∞ ¹
SimpleImage_GetImage/oci-archive-2                      1.570k ± ∞ ¹
SimpleImage_GetImage/oci-dir-2                          1.354k ± ∞ ¹
geomean                                                 1.781k
¹ need >= 6 samples for confidence interval at level 0.95

docker: Error response from daemon: Get "http://localhost/v2/": dial tcp [::1]:80: connect: connection refused.
                                                   │ ./.tmp/benchmark-a402d50.txt │
                                                   │            sec/op            │
SimpleImage_FetchSquashedContents/docker-archive-2                   21.77µ ± ∞ ¹
¹ need >= 6 samples for confidence interval at level 0.95

                                                   │ ./.tmp/benchmark-a402d50.txt │
                                                   │             B/op             │
SimpleImage_FetchSquashedContents/docker-archive-2                  2.648Ki ± ∞ ¹
¹ need >= 6 samples for confidence interval at level 0.95

                                                   │ ./.tmp/benchmark-a402d50.txt │
                                                   │          allocs/op           │
SimpleImage_FetchSquashedContents/docker-archive-2                    21.00 ± ∞ ¹
¹ need >= 6 samples for confidence interval at level 0.95

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
…ic sources

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
@wagoodman wagoodman self-assigned this Aug 29, 2023
@wagoodman wagoodman requested a review from a team August 29, 2023 13:52
@wagoodman wagoodman marked this pull request as ready for review August 29, 2023 13:53
@wagoodman wagoodman added the enhancement New feature or request label Aug 29, 2023
@wagoodman wagoodman merged commit 334c222 into main Aug 29, 2023
@wagoodman wagoodman deleted the couple-tls-options-to-registry-creds branch August 29, 2023 14:26
wagoodman added a commit to 5p2O5pe25ouT/syft that referenced this pull request Aug 29, 2023
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman added a commit to 5p2O5pe25ouT/grype that referenced this pull request Aug 29, 2023
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman added a commit to anchore/syft that referenced this pull request Aug 29, 2023
* add registry certificate verification support

* replace stereoscope version

* modify go.mod

* pull in stereoscope update

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename registry cert options, add docs, and add test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update to account for changes in anchore/stereoscope#195

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: lishituo <24578666@qq.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
wagoodman added a commit to anchore/grype that referenced this pull request Aug 29, 2023
* add registry certificate verification support

* modify go.mod

* rename registry cert options, add docs, and add test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update to account for changes in anchore/stereoscope#195

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: lishituo <24578666@qq.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
GijsCalis pushed a commit to GijsCalis/syft that referenced this pull request Feb 19, 2024
* add registry certificate verification support

* replace stereoscope version

* modify go.mod

* pull in stereoscope update

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* rename registry cert options, add docs, and add test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update to account for changes in anchore/stereoscope#195

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix cli tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: lishituo <24578666@qq.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants