Azure Container Registry (ACR) - Failed to verify signature of trust data root

[dansbot]

I am attempting to follow these instructions to connect an ACR:
https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notaryv1.md#using-azure-container-registry

I created a signing pair with:

docker trust key generate root

which returns something like:

-----BEGIN PUBLIC KEY-----
role: root

<MY PUBLIC KEY>
-----END PUBLIC KEY-----

With this public key I have pushed and signed images to my acr with the following commands:

docker login myacr.azurecr.io --username <my-service-principal-appId> --password <my-service-principal-password>
docker trust signer add --key root.pub root myacr.azurecr.io/image
docker push myacr.azurecr.io/image:signed --disable-content-trust=false

I can verify that the image was properly signed by running:

docker trust inspect myacr.azurecr.io/image:signed --pretty

which returns something like:

Signatures for myacr.azurecr.io/image:signed

SIGNED TAG   DIGEST                                                             SIGNERS
signed       ************************   root

List of signers and their keys for myacr.azurecr.io/image:signed

SIGNER          KEYS
root   **********

Administrative keys for myacr.azurecr.io/image:signed

  Repository Key:       ************************************
  Root Key:     ************************************

I then edit the values.yaml to look like:

validators:
- name: default
  type: notaryv1
  host: myacr.azurecr.io
  is_acr: true
  trust_roots:
    - name: default
       key: | 
        -----BEGIN PUBLIC KEY-----
        <MY PUBLIC KEY>
        -----END PUBLIC KEY-----
    auth:
      username: <my-service-principal-appId>
      password: <my-service-principal-password>

policy:
  - pattern: "*:*"

I then update my connaisseur on my cluster with:

helm upgrade connaisseur connaisseur/connaisseur -n connaisseur --wait -f values.yaml

Which appears to execute successfully.
I then run:

kubectl run test --image=myacr.azurecr.io/image:signed

Which results in the following error:

Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: Failed to verify signature of trust data root.

Here are the logs:

kubectl logs -n connaisseur connaisseur-deployment-7645f7d7db-qcpvl
[2022-06-23 20:35:10,873] ERROR: {'message': 'Failed to verify signature of trust data root.', 'context': {'trust_data_kind': 'root', 'detection_mode': False, 'user': 'masterclient', 'operation': 'CREATE', 'kind': 'Pod', 'name': 'test', 'namespace': 'default'}}
[2022-06-23 20:35:10,874] INFO: 10.244.0.10 - - [23/Jun/2022 20:35:10] "POST /mutate?timeout=30s HTTP/1.1" 200 -

I don't understand what I am doing wrong. Why is this not working?

[xopham]

@dansbot I think this should be easy to fix. It seems that you added a signer with name "root" to your notary. However, the key used to pin the signature validation in helm/values.yaml must be the actual root public key of your notary repo. It should be the one referenced under "Root Key" in your docker trust inspect output.

[dansbot]

@xopham thanks for the response!

I tried to follow this part of the walk-through to do just that:
https://github.com/sse-secure-systems/connaisseur/blob/master/docs/validators/notaryv1.md#getting-the-public-root-key

Unfortunately, this command doesn't work with ACR:

docker run --rm docker.io/securesystemsengineering/get-public-root-key -i myacr.azrecr.io/image -s myacr.azurecr.io

So, I run

docker trust inspect myacr.azurecr.io/image:signed --pretty

Which returns

Signatures for myacr.azurecr.io/image:signed

SIGNED TAG   DIGEST                                                             SIGNERS
signed       <digest>   root

List of signers and their keys for myacr.azurecr.io/image:signed

SIGNER          KEYS
root   <signer-root-key>

Administrative keys for myacr.azurecr.io/image:signed

  Repository Key:       <repository-key>
  Root Key:     <root-key>

Then I look in .docker\trust\tuf\myacr.azurecr.io\run\metadata\root.json, which looks like:

{'signatures': [{'keyid': <root-key>,
                 'method': 'ecdsa',
                 'sig': <sig>}],
 'signed': {'_type': 'Root',
            'consistent_snapshot': False,
            'expires': '2032-06-20T13:25:25.2194374-07:00',
            'keys': {<root-key>: {'keytype': 'ecdsa-x509', 'keyval': {'private': None, 'public': <root-public-key>}},
                     <other1-key>: {'keytype': 'ecdsa', 'keyval': {'private': None, 'public': <other1-public-key>}},
                     <other2-key>: {'keytype': 'ecdsa', 'keyval': {'private': None, 'public': <other2-public-key>}}},
                     <other3-key>: {'keytype': 'ecdsa', 'keyval': {'private': None, 'public': <other3-public-key>}}},
            'roles': {'root': {'keyids': [<root-key>'],
                               'threshold': 1},
                      'snapshot': {'keyids': [<other1-key>],
                                   'threshold': 1},
                      'targets': {'keyids': [<other2-key>],
                                  'threshold': 1},
                      'timestamp': {'keyids': [<other3-key>],
                                    'threshold': 1}},
            'version': 1}}

The I update values.yaml with the root-public-key

validators:
  - name: default
    type: notaryv1
    host: myacr.azurecr.io
    is_acr: true
    trust_roots:
      - name: default
         key: | 
          -----BEGIN PUBLIC KEY-----
          <root-public-key>
          -----END PUBLIC KEY-----
      auth:
        username: <my-service-principal-appId>
        password: <my-service-principal-password>

policy:
  - pattern: "*:*"

And it still throws the same error:

Error from server: admission webhook "connaisseur-svc.connaisseur.svc" denied the request: Failed to verify signature of trust data root.

What am I missing?

[phbelitz]

Have you extracted the public key from the root certificate? The thing is, the root.json has stored the root key as a certificate, in contrast to all the other keys, so you have to do some more manual extra steps.

The value in the root.json is base64 encoded, so decode that, put it in a temp file and then run openssl thouth it.

$ echo "<base64-root-cert>" | base64 -d > /tmp/tmp.crt
$ openssl x509 -pubkey -noout

That should give you the right key.