[prototype] feat: add ratify containerd plugin

[akashsinghal]

This is a very experimental and rudimentary ratify binary for the new image verifier containerd plugin proposal. It's purely used as POC.

Setup:

Use containerd version on main branch

Use a custom config.toml with contents:

version = 2

[plugins]
  [plugins."io.containerd.image-verifier.v1.bindir"]
    bin_dir = "/home/devuser/code/ratify/containerd-plugins"
    max_verifiers = 10
    per_verifier_timeout = "10s"

Start containerd:

sudo bin/containerd -c config.toml -l debug

Sample ctr command of image being blocked:

> sudo bin/ctr image pull --local=false wabbitnetworks.azurecr.io/test/notary-image:unsigned
ctr: rpc error: code = Unknown desc = image verifier bindir blocked pull of wabbitnetworks.azurecr.io/test/notary-image:unsigned with digest sha256:17490f904cf278d4314a1ccba407fc8fd00fb45303589b8cc7f5174ac35554f4 for reason: verifier ratify rejected image (exit code 1): {
  "isSuccess": false,
  "verifierReports": [
    {
      "subject": "wabbitnetworks.azurecr.io/test/notary-image:unsigned@sha256:17490f904cf278d4314a1ccba407fc8fd00fb45303589b8cc7f5174ac35554f4",
      "isSuccess": false,
      "message": "verification failed: no referrers found for this artifact"
    }
  ]
}

Sample ctr command of image passing verification:

> sudo bin/ctr image pull --local=false wabbitnetworks.azurecr.io/test/notary-image:signed

# Output from the containerd logs
DEBU[2023-05-27T00:36:52.223126601Z] Verifying image pull                          digest="sha256:8e3d01113285a0e4aa574da8eb9c0f112a1eb979d72f73399d7175ba3cdb1c1b" name="wabbitnetworks.azurecr.io/test/notary-image:signed" verifier=bindir
DEBU[2023-05-27T00:36:52.252267490Z] time="2023-05-27T00:36:52Z" level=info msg="Setting log level to info"  image_verifier=ratify
DEBU[2023-05-27T00:36:52.252314489Z] warning: GOCOVERDIR not set, no coverage data emitted  image_verifier=ratify
DEBU[2023-05-27T00:36:52.252633187Z] time="2023-05-27T00:36:52Z" level=info msg="selected default auth provider: dockerConfig"  image_verifier=ratify
DEBU[2023-05-27T00:36:52.278756698Z] time="2023-05-27T00:36:52Z" level=info msg="defaultPluginPath set to /home/devuser/.ratify/plugins"  image_verifier=ratify
DEBU[2023-05-27T00:36:52.278918597Z] time="2023-05-27T00:36:52Z" level=info msg="selected policy provider: configPolicy"  image_verifier=ratify
DEBU[2023-05-27T00:36:52.511484911Z] time="2023-05-27T00:36:52Z" level=info msg="Resolve of the image completed successfully the digest is sha256:8e3d01113285a0e4aa574da8eb9c0f112a1eb979d72f73399d7175ba3cdb1c1b"  image_verifier=ratify
DEBU[2023-05-27T00:36:52.546894954Z] time="2023-05-27T00:36:52Z" level=info msg="1 notary verification certificates loaded from path '/home/devuser/code/ratify/notary.crt'"  image_verifier=ratify
DEBU[2023-05-27T00:36:52.546933254Z] time="2023-05-27T00:36:52Z" level=warning msg="Invalid path '/home/devuser/.ratify/ratify-certs/notary/truststore' skipped, error lstat /home/devuser/.ratify/ratify-certs/notary/truststore: no such file or directory"  image_verifier=ratify
DEBU[2023-05-27T00:36:52.546955753Z] time="2023-05-27T00:36:52Z" level=info msg="0 notary verification certificates loaded from path '/home/devuser/.ratify/ratify-certs/notary/truststore'"  image_verifier=ratify
DEBU[2023-05-27T00:36:52.552758811Z] Image verifier allowed pull                   digest="sha256:8e3d01113285a0e4aa574da8eb9c0f112a1eb979d72f73399d7175ba3cdb1c1b" name="wabbitnetworks.azurecr.io/test/notary-image:signed" ok=true reason="ratify => { \"isSuccess\": true, \"verifierReports\": [ { \"subject\": \"wabbitnetworks.azurecr.io/test/notary-image@sha256:8e3d01113285a0e4aa574da8eb9c0f112a1eb979d72f73399d7175ba3cdb1c1b\", \"isSuccess\": true, \"name\": \"notaryv2\", \"message\": \"signature verification success\", \"extensions\": { \"Issuer\": \"CN=wabbit-networks.io,O=Notary,L=Seattle,ST=WA,C=US\", \"SN\": \"CN=wabbit-networks.io,O=Notary,L=Seattle,ST=WA,C=US\" }, \"artifactType\": \"application/vnd.cncf.notary.signature\" } ] }\nratify verification succeeded" verifier=bindir

Note: if you have an existing containerd instance running, you may need to stop the service temporarily so the custom instance can use the same sock. I'm sure there are better ways to get around this but I just did this: sudo systemctl stop containerd.service