Use Keyfactor SignServer for attestation signing

Summary

Chainloop CLI can sign attestations using a preconfigured SignServer instance, by providing a key reference during the signing process:

> chainloop attestation push --key signserver://mysignserver/PlainSigner --signserver-ca-path mysignserver-chain.pem

SignServer is a platform for digitally signing code, documents and timestamps. Check it out at https://www.signserver.org/about/.

Setting up SignServer

If your organization doesn’t have it already, you can follow these tutorials for a basic setup of Keyfactor’s KPI solutions:

Finally, you must have a Crypto and Signing workers configured in SignServer. You can follow this Cosign tutorial, since the steps for worker configuration are similar. Once you have it configured, you can reach SignServer signer worker at, for example, https://mysignserver/PlainSigner. Note that, at this moment, SignServer authentication is not implemented.

Signing Chainloop attestations with SignServer

Using the CLI options above, Chainloop will prepare the signed In-toto payload and send it to SignServer for signing. The returned signature is then included in the final attestation and sent to Chainloop Evidence Store for storage. This is an example of a Chainloop session integrated with SignServer: Crafting and signing an attestation.

➜ chainloop att init --workflow mywf --project myproject
INF Attestation initialized! now you can check its status or add materials to it
┌───────────────────┬──────────────────────────────────────┐
│ Initialized At    │ 18 Jun 24 09:10 UTC                  │
├───────────────────┼──────────────────────────────────────┤
│ Attestation ID    │ 32c7eeed-ae4d-4a07-8a85-44a6b05458dc │
│ Name              │ mywf                                 │
│ Team              │                                      │
│ Project           │ myproject                            │
│ Contract Revision │ 1                                    │
└───────────────────┴──────────────────────────────────────┘

➜ chainloop att add --value evidence.txt
INF material kind detected kind=ARTIFACT
INF material added to attestation

➜ chainloop att push --key signserver://localhost:8443/PlainSigner --bundle mybundle.json --signserver-ca-path ../keyfactor/localhost-chain.pem
INF generating Sigstore bundle mybundle.json
INF push completed
┌───────────────────┬──────────────────────────────────────┐
│ Initialized At    │ 18 Jun 24 09:10 UTC                  │
├───────────────────┼──────────────────────────────────────┤
│ Attestation ID    │ 32c7eeed-ae4d-4a07-8a85-44a6b05458dc │
│ Name              │ mywf                                 │
│ Team              │                                      │
│ Project           │ myproject                            │
│ Contract Revision │ 1                                    │
└───────────────────┴──────────────────────────────────────┘
┌────────────────────────────────────────────────────────────────────────────────────┐
│ Materials                                                                          │
├──────────┬─────────────────────────────────────────────────────────────────────────┤
│ Name     │ material-1718701829813801000                                            │
│ Type     │ ARTIFACT                                                                │
│ Set      │ Yes                                                                     │
│ Required │ No                                                                      │
│ Value    │ evidence.txt                                                            │
│ Digest   │ sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 │
└──────────┴─────────────────────────────────────────────────────────────────────────┘
Attestation Digest: sha256:8b247c21e201e1bd1367add9ee8bfd12c5a0866add39225fda6240c0ef10a64e%

Using a TLS Client certificate for authentication

If your SignServer signer worker has been configured for client certificate authentication, you can add the flag --signserver-client-cert to the push command:

➜ chainloop att push --key signserver://localhost:8443/PlainSigner --signserver-ca-path ../keyfactor/localhost-chain.pem --signserver-client-cert ../keyfactor/client.pem

Verifying the attestation

Verifying the attestation requires the signing cert and root CA (both provided by your organization out-of-band):

➜ chainloop workflow run describe --digest sha256:8b247c21e201e1bd1367add9ee8bfd12c5a0866add39225fda6240c0ef10a64e --verify true --cert PlainSigner.pem --chain ManagementCA.pem
┌──────────────────────────────────────────────────────────────────────────────────────────┐
│ Workflow                                                                                 │
├────────────────┬─────────────────────────────────────────────────────────────────────────┤
│ ID             │ eb7b4633-96e2-4efe-b23f-f667f3f7acdc                                    │
│ Name           │ mywf                                                                    │
│ Team           │                                                                         │
│ Project        │ myproject                                                               │
├────────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Workflow Run   │                                                                         │
├────────────────┼─────────────────────────────────────────────────────────────────────────┤
│ ID             │ ea1a7d69-21ef-406a-aef3-d6ccd360775c                                    │
│ Initialized At │ 18 Jun 24 09:25 UTC                                                     │
│ Finished At    │ 18 Jun 24 09:25 UTC                                                     │
│ State          │ success                                                                 │
│ Runner Link    │                                                                         │
├────────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Statement      │                                                                         │
├────────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Payload Type   │ application/vnd.in-toto+json                                            │
│ Digest         │ sha256:8b247c21e201e1bd1367add9ee8bfd12c5a0866add39225fda6240c0ef10a64e │
│ Verified       │ true                                                                    │
└────────────────┴─────────────────────────────────────────────────────────────────────────┘
┌────────────────────────────────────────────────────────────────────────────────────┐
│ Materials                                                                          │
├──────────┬─────────────────────────────────────────────────────────────────────────┤
│ Name     │ material-1718702726579398000                                            │
│ Type     │ ARTIFACT                                                                │
│ Filename │ evidence.txt                                                            │
│ Digest   │ sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 │
└──────────┴─────────────────────────────────────────────────────────────────────────┘

Getting Started

Concepts

Guides

References

Misc

Use Keyfactor SignServer for attestation signing

Summary

Setting up SignServer

Signing Chainloop attestations with SignServer

Using a TLS Client certificate for authentication

Verifying the attestation

​Summary

​Setting up SignServer

​Signing Chainloop attestations with SignServer

​Using a TLS Client certificate for authentication

​Verifying the attestation

Summary

Setting up SignServer

Signing Chainloop attestations with SignServer

Using a TLS Client certificate for authentication

Verifying the attestation