WIP: Hypotenuse - a tool for extracting the base images out of a Dockerfile.

[dlorenc]

I'm sending this one up for fun and discussion! This should not be merged as is :)

This introduces a small tool that can be used to parse a Dockerfile and extract the base images from inside it. The tool fully resolves those base image entries to a digest (hopefully the same one that would be used in the docker build that's about to follow. These references are then passed over stdout, one per line, where they can be consumed by other tools. Like cosign!

You can use this to verify the base images in a Dockerfile have all been signed before you do a build. This is related and complementary to #188.

See this gif!

The name hypotenuse is probably my worst pun yet.

[ahmetb]

Several different experiences come to mind:

1. hypotenuse command works as you illustrated, but we make cosign verify accept the input for IMAGE from stdin (one image reference per line)

2. we directly integrate this into cosign verify, e.g. -f Dockerfile since cosign is meant to be end-user friendly. if we want a print-only mode, we can do -print-only that just resolves image references. This way, user doesn't need to see a new hypotenuse command.

[dlorenc]

2. we directly integrate this into cosign verify, e.g. -f Dockerfile since cosign is meant to be end-user friendly. if we want a print-only mode, we can do -print-only that just resolves image references. This way, user doesn't need to see a new hypotenuse command.

Yup! @jonjohnsonjr had some other ideas on using this to rewrite (or pin the Dockerfiles), or intercept and pass back into docker build . -f <(...)

[font]

Neat @dlorenc ! I was thinking of something like this, but was hoping it was possible to do this from an already built image. I didn't immediately find anything meaningful though.

[dlorenc]

@font i have some ideas here with @imjasonh. When do you need something by? I can hack something up pretty quickly as a POC.

[dekkagaijin]

Obsoleted by #395