Verifying build provenance for signed Inso CLI binaries

Kong produces build provenance for Inso CLI docker container images, which can be verified using cosign or slsa-verifier with attestations published to a Docker Hub repository.

This guide provides steps to verify build provenance for signed Inso CLI Docker images in two different ways:

• A minimal example, used to verify an image without leveraging any annotations
• A complete example, leveraging optional annotations for increased trust

For the minimal example, you only need a Docker manifest digest and a GitHub repo name.

The Docker manifest digest is required for build provenance verification. The manifest digest can be different from the platform-specific image digest for a specific distribution.

For the complete example, you need the same details as the minimal example, as well as any of the optional annotations you want to verify:

Because Kong uses GitHub Actions to build and release, Kong also uses GitHub’s OIDC identity to generate build provenance for images, which is why many of these details are GitHub-related.

For both examples, you need to:

• Ensure cosign or slsa-verifier is installed.

• Ensure regctl is installed.

• Collect the necessary image details.

• Parse the manifest digest for the image using regctl.

   IMAGE_DIGEST=$(regctl manifest digest kong/inso:9.3.0)
  

• Set the COSIGN_REPOSITORY environment variable:

   export COSIGN_REPOSITORY=kong/notary
  

The GitHub owner is case-sensitive (Kong/insomnia vs kong/insomnia).