From 5c095715665074febcf4e2c2982fc086a6c41344 Mon Sep 17 00:00:00 2001 From: Lars Francke Date: Tue, 14 Jul 2026 22:54:53 +0200 Subject: [PATCH] chore(hardening): verify cosign download, pin base images, hide Jenkins secret - Verify the cosign RPM against a pinned sha256 before `rpm -ivh` (monitor-oci-artifacts, harbor-sbom-browser) so a tampered release asset can't be installed. HTTPS gives transport security, not artifact integrity. - Pin the ubi-minimal base images by digest (harbor-gc, nexus-gc -> ubi8 8.10; monitor-oci -> ubi9 9.6, matching harbor-sbom-browser) for reproducible builds. - jobbuilder.groovy: pass the bot password to the container via env pass-through (`--env JENKINS_PASSWORD`) instead of `--env JENKINS_PASSWORD=$VALUE`, which put the secret in the docker process arguments (visible via host `ps`). --- jenkins/jobbuilder.groovy | 6 ++++-- tools/harbor-garbage-collector/Dockerfile | 2 +- tools/harbor-sbom-browser/Dockerfile | 2 ++ tools/monitor-oci-artifacts/Dockerfile | 4 +++- tools/nexus-garbage-collector/Dockerfile | 2 +- 5 files changed, 11 insertions(+), 5 deletions(-) diff --git a/jenkins/jobbuilder.groovy b/jenkins/jobbuilder.groovy index c585e73..f05f481 100644 --- a/jenkins/jobbuilder.groovy +++ b/jenkins/jobbuilder.groovy @@ -44,10 +44,12 @@ pipeline { steps { withCredentials([usernamePassword(credentialsId: 'JENKINS_BOT_CREDENTIALS', passwordVariable: 'JENKINS_BOT_PASSWORD', usernameVariable: 'JENKINS_BOT_USERNAME')]) { sh ''' + JENKINS_USERNAME="$JENKINS_BOT_USERNAME" \ + JENKINS_PASSWORD="$JENKINS_BOT_PASSWORD" \ docker run --rm \ --env JENKINS_URL=https://testing.stackable.tech \ - --env JENKINS_USERNAME=$JENKINS_BOT_USERNAME \ - --env JENKINS_PASSWORD=$JENKINS_BOT_PASSWORD \ + --env JENKINS_USERNAME \ + --env JENKINS_PASSWORD \ oci.stackable.tech/jenkins-job-builder:latest ''' } diff --git a/tools/harbor-garbage-collector/Dockerfile b/tools/harbor-garbage-collector/Dockerfile index 8383a72..b701542 100644 --- a/tools/harbor-garbage-collector/Dockerfile +++ b/tools/harbor-garbage-collector/Dockerfile @@ -1,6 +1,6 @@ FROM oci.stackable.tech/sdp/ubi8-rust-builder AS builder -FROM registry.access.redhat.com/ubi8/ubi-minimal AS operator +FROM registry.access.redhat.com/ubi8/ubi-minimal:8.10@sha256:578b238953144445a9b5bb2487eb1d95df4886f98d1f73c4a070b27535f51688 AS operator ARG VERSION ARG RELEASE="1" diff --git a/tools/harbor-sbom-browser/Dockerfile b/tools/harbor-sbom-browser/Dockerfile index c1bfd93..2776463 100644 --- a/tools/harbor-sbom-browser/Dockerfile +++ b/tools/harbor-sbom-browser/Dockerfile @@ -9,6 +9,8 @@ ARG RELEASE="1" RUN microdnf install -y yum \ && yum -y update-minimal --security --sec-severity=Important --sec-severity=Critical \ && curl -L -O https://github.com/sigstore/cosign/releases/download/v3.0.2/cosign-3.0.2-1.x86_64.rpm \ + && echo "7b6ae0f1e8da49d196f89245d4014887747c01c215e2e7f41e4853c98a28ed9b cosign-3.0.2-1.x86_64.rpm" > cosign-3.0.2-1.x86_64.rpm.sha256 \ + && sha256sum -c cosign-3.0.2-1.x86_64.rpm.sha256 \ && rpm -ivh cosign-3.0.2-1.x86_64.rpm \ && yum clean all \ && microdnf clean all diff --git a/tools/monitor-oci-artifacts/Dockerfile b/tools/monitor-oci-artifacts/Dockerfile index a3916b7..e3728ce 100644 --- a/tools/monitor-oci-artifacts/Dockerfile +++ b/tools/monitor-oci-artifacts/Dockerfile @@ -1,6 +1,6 @@ FROM oci.stackable.tech/sdp/ubi9-rust-builder AS builder -FROM registry.access.redhat.com/ubi9/ubi-minimal AS operator +FROM registry.access.redhat.com/ubi9/ubi-minimal:9.6@sha256:7c5495d5fad59aaee12abc3cbbd2b283818ee1e814b00dbc7f25bf2d14fa4f0c AS operator ARG VERSION ARG RELEASE="1" @@ -9,6 +9,8 @@ ARG RELEASE="1" RUN microdnf install -y yum \ && yum -y update-minimal --security --sec-severity=Important --sec-severity=Critical \ && curl -L -O https://github.com/sigstore/cosign/releases/download/v3.0.2/cosign-3.0.2-1.x86_64.rpm \ + && echo "7b6ae0f1e8da49d196f89245d4014887747c01c215e2e7f41e4853c98a28ed9b cosign-3.0.2-1.x86_64.rpm" > cosign-3.0.2-1.x86_64.rpm.sha256 \ + && sha256sum -c cosign-3.0.2-1.x86_64.rpm.sha256 \ && rpm -ivh cosign-3.0.2-1.x86_64.rpm \ && yum clean all \ && microdnf clean all diff --git a/tools/nexus-garbage-collector/Dockerfile b/tools/nexus-garbage-collector/Dockerfile index 9890e92..e427ae3 100644 --- a/tools/nexus-garbage-collector/Dockerfile +++ b/tools/nexus-garbage-collector/Dockerfile @@ -1,6 +1,6 @@ FROM oci.stackable.tech/sdp/ubi8-rust-builder AS builder -FROM registry.access.redhat.com/ubi8/ubi-minimal AS operator +FROM registry.access.redhat.com/ubi8/ubi-minimal:8.10@sha256:578b238953144445a9b5bb2487eb1d95df4886f98d1f73c4a070b27535f51688 AS operator ARG VERSION ARG RELEASE="1"