Skip to content

Verification of Argo CD Artifacts

Prerequisites

Release Assets

Asset Description
argocd-darwin-amd64 CLI Binary
argocd-darwin-arm64 CLI Binary
argocd-linux_amd64 CLI Binary
argocd-linux_arm64 CLI Binary
argocd-linux_ppc64le CLI Binary
argocd-linux_s390x CLI Binary
argocd-windows_amd64 CLI Binary
argocd-cli.intoto.jsonl Attestation of CLI binaries
cli_checksums.txt Checksums of binaries
sbom.tar.gz Sbom
sbom.tar.gz.pem Certificate used to sign sbom
sbom.tar.gz.sig Signature of sbom

Verification of container images

Argo CD container images are signed by cosign using identity-based ("keyless") signing and transparency. Executing the following command can be used to verify the signature of a container image:

cosign verify \
--certificate-identity-regexp https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@refs/tags/v \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
quay.io/argoproj/argocd:v2.7.0 | jq

The command should output the following if the container image was correctly verified:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - Any certificates were verified against the Fulcio roots.
[
  {
    "critical": {
      "identity": {
        "docker-reference": "quay.io/argoproj/argo-cd"
      },
      "image": {
        "docker-manifest-digest": "sha256:63dc60481b1b2abf271e1f2b866be8a92962b0e53aaa728902caa8ac8d235277"
      },
      "type": "cosign container image signature"
    },
    "optional": {
      "1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com",
      "1.3.6.1.4.1.57264.1.2": "push",
      "1.3.6.1.4.1.57264.1.3": "a6ec84da0eaa519cbd91a8f016cf4050c03323b2",
      "1.3.6.1.4.1.57264.1.4": "Publish ArgoCD Release",
      "1.3.6.1.4.1.57264.1.5": "argoproj/argo-cd",
      "1.3.6.1.4.1.57264.1.6": "refs/tags/<version>",
      ...

Verification of container image attestations

A SLSA Level 3 provenance is generated using slsa-github-generator.

The following command will verify the signature of an attestation and how it was issued. It will contain the payloadType, payload, and signature.

cosign verify-attestation --type slsaprovenance \
--certificate-identity-regexp https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
quay.io/argoproj/argocd:v2.7.0 | jq

The payload is a non-falsifiable provenance which is base64 encoded and can be viewed by using the command below:

cosign verify-attestation --type slsaprovenance \
--certificate-identity-regexp https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
quay.io/argoproj/argocd:v2.7.0 | jq -r .payload | base64 -d | jq

Tip

cosign or slsa-verifier can both be used to verify image attestations. Check the documentation of each binary for detailed instructions.

Verification of CLI artifacts with attestations

A single attestation (argocd-cli.intoto.jsonl) from each release is provided. This can be used with slsa-verifier to verify that a CLI binary was generated using Argo CD workflows on GitHub and ensures it was cryptographically signed.

slsa-verifier verify-artifact argocd-linux-amd64 --provenance-path argocd-cli.intoto.jsonl  --source-uri github.com/argoproj/argo-cd

Verifying an artifact and output the provenance

slsa-verifier verify-artifact argocd-linux-amd64 --provenance-path argocd-cli.intoto.jsonl  --source-uri github.com/argoproj/argo-cd --print-provenance | jq

Verification of Sbom

cosign verify-blob --signature sbom.tar.gz.sig --certificate sbom.tar.gz.pem \
--certificate-identity-regexp ^https://github.com/argoproj/argo-cd/.github/workflows/release.yaml@refs/tags/v \
--certificate-oidc-issuer https://token.actions.githubusercontent.com  \
 ~/Downloads/sbom.tar.gz | jq

Verification on Kubernetes

Policy controllers

Note

We encourage all users to verify signatures and provenances with your admission/policy controller of choice. Doing so will verify that an image was built by us before it's deployed on your Kubernetes cluster.

Cosign signatures and SLSA provenances are compatible with several types of admission controllers. Please see the cosign documentation and slsa-github-generator for supported controllers.