CKSKubernetes 1.35

Exercises

Exercise: SBOM and a signature you can verify

updated 2026-10-22 by seed

Host: controlplane · Time: 12 min · Domain: Supply Chain Security

Task

  • Generate an SBOM for registry.example.com/app:1.4.2 in SPDX format.
  • Sign the image by digest with a key you generate.
  • Show that verification fails for an unsigned image.

Acceptance criteria

  • An sbom.spdx file exists and lists at least one package.
  • cosign verify --key cosign.pub <image> succeeds for the signed image.
  • The same command fails for an unsigned image.

Solution

bom generate --image registry.example.com/app:1.4.2 -o sbom.spdx
bom document outline sbom.spdx | head

DIGEST=$(crane digest registry.example.com/app:1.4.2)   # or: skopeo inspect --format '{{.Digest}}'
cosign generate-key-pair
cosign sign --key cosign.key registry.example.com/app@$DIGEST
cosign verify --key cosign.pub registry.example.com/app:1.4.2

cosign verify --key cosign.pub registry.k8s.io/pause:3.10   # must fail

Sign the digest, not the tag: a tag can be repointed, a digest cannot.