pal-e-docs

Phase 20c: Supply Chain Signing (Cosign/Sigstore + Syft)

phase-platform-20c-supply-chain-signing Phase

phase
Project

Phase 20c: Supply Chain Signing (Cosign/Sigstore + Syft)

Goal: Sign container images in CI and generate SBOMs for supply chain provenance. Closes the loop with Kyverno admission control — only signed images deploy.
Owner: Dev agent
Repo: Per-service Woodpecker CI configs + forgejo_admin/pal-e-platform (Kyverno verification policy)
Depends on: Phase 19 (Kyverno — ClusterPolicy to enforce signature verification on admission)
DORA: CFR — supply chain integrity prevents compromised or tampered images from deploying. Every unsigned image blocked is a potential incident prevented.

Scope

  • Generate Cosign key pair (stored as k8s Secret in Woodpecker namespace)
  • Add Woodpecker CI step: sign image after kaniko push with Cosign
  • Add Woodpecker CI step: generate SBOM with Syft and attach as OCI artifact to Harbor image
  • Kyverno ClusterPolicy: verify Cosign signature on all images in production namespaces (reject unsigned)
  • Harbor: configure to display SBOM and signature metadata in UI
  • Grafana panel: signed vs unsigned image ratio across repos

Deliverables

  • TBD — filled after completion
  • phase-platform-20-security-deepening — parent phase
  • phase-platform-19-policy-kyverno — Kyverno enforces signed-image-only admission
  • plan-pal-e-platform — parent plan