From b4b2ceb2fd5edaf5725879d18e9b9da129e7dfbe Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Sun, 25 Jan 2026 07:24:40 +0100
Subject: [PATCH] fix(ci): verify akmods, brew, common with local key (#1665)

Previously we were fetching the public keys over the network, this method
was not resilient against bad actors who take over one of our
dependencies and publish malicious images with those keys.
---
 Justfile                           | 23 +++++++++--------------
 ghcr.io-get-aurora-dev.pub         |  4 ++++
 quay.io-fedora-ostree-desktops.pub |  4 ++++
 3 files changed, 17 insertions(+), 14 deletions(-)
 create mode 100644 ghcr.io-get-aurora-dev.pub
 create mode 100644 quay.io-fedora-ostree-desktops.pub

diff --git a/Justfile b/Justfile
index da355304..6b17561e 100644
--- a/Justfile
+++ b/Justfile
@@ -130,7 +130,8 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline
     fedora_version=$({{ just }} fedora_version '{{ image }}' '{{ tag }}' '{{ flavor }}' '{{ kernel_pin }}')
 
     # Verify Base Image with cosign
-    {{ just }} verify-container ${base_image_name}:${fedora_version} quay.io/fedora-ostree-desktops "https://gitlab.com/fedora/ostree/ci-test/-/raw/main/quay.io-fedora-ostree-desktops.pub?ref_type=heads"
+    {{ just }} verify-container quay.io-fedora-ostree-desktops.pub quay.io/fedora-ostree-desktops/${base_image_name}:${fedora_version}
+
     # Kernel Release/Pin
     if [[ -z "${kernel_pin:-}" ]]; then
         kernel_release=$(skopeo inspect --retry-times 3 docker://ghcr.io/ublue-os/akmods:"${akmods_flavor}"-"${fedora_version}" | jq -r '.Labels["ostree.linux"]')
@@ -139,17 +140,17 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline
     fi
 
     # Verify Containers with Cosign
-    {{ just }} verify-container "akmods:${akmods_flavor}-${fedora_version}-${kernel_release}"
+    {{ just }} verify-container cosign.pub "ghcr.io/ublue-os/akmods:${akmods_flavor}-${fedora_version}-${kernel_release}"
     if [[ "${akmods_flavor}" =~ coreos ]]; then
-        {{ just }} verify-container "akmods-zfs:${akmods_flavor}-${fedora_version}-${kernel_release}"
+        {{ just }} verify-container cosign.pub "ghcr.io/ublue-os/akmods-zfs:${akmods_flavor}-${fedora_version}-${kernel_release}"
     fi
     if [[ "${flavor}" =~ nvidia-open ]]; then
-        {{ just }} verify-container "akmods-nvidia-open:${akmods_flavor}-${fedora_version}-${kernel_release}"
+        {{ just }} verify-container cosign.pub "ghcr.io/ublue-os/akmods-nvidia-open:${akmods_flavor}-${fedora_version}-${kernel_release}"
     fi
 
-    {{ just }} verify-container "common:latest@${common_image_sha}" ghcr.io/get-aurora-dev https://raw.githubusercontent.com/get-aurora-dev/common/refs/heads/main/cosign.pub
+    {{ just }} verify-container ghcr.io-get-aurora-dev.pub "ghcr.io/get-aurora-dev/common:latest@${common_image_sha}"
 
-    {{ just }} verify-container "brew:latest@${brew_image_sha}"
+    {{ just }} verify-container cosign.pub "ghcr.io/ublue-os/brew:latest@${brew_image_sha}"
 
     # Get Version
     if [[ "${tag}" =~ stable ]]; then
@@ -470,7 +471,7 @@ changelogs branch="stable" handwritten="":
 
 # Verify Container with Cosign
 [group('Utility')]
-verify-container container="" registry="ghcr.io/ublue-os" key="":
+verify-container key="" container="":
     #!/usr/bin/bash
     set -eou pipefail
 
@@ -489,14 +490,8 @@ verify-container container="" registry="ghcr.io/ublue-os" key="":
         fi
     fi
 
-    # Public Key for Container Verification
-    key={{ key }}
-    if [[ -z "${key:-}" ]]; then
-        key="https://raw.githubusercontent.com/ublue-os/main/main/cosign.pub"
-    fi
-
     # Verify Container using cosign public key
-    if ! cosign verify --key "${key}" "{{ registry }}"/"{{ container }}" >/dev/null; then
+    if ! cosign verify --key "{{ key }}" "{{ container }}" >/dev/null; then
         echo "NOTICE: Verification failed. Please ensure your public key is correct."
         exit 1
     fi
diff --git a/ghcr.io-get-aurora-dev.pub b/ghcr.io-get-aurora-dev.pub
new file mode 100644
index 00000000..18f9d87e
--- /dev/null
+++ b/ghcr.io-get-aurora-dev.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAELIik8ZM9ytEYEy1OWPs17Af7OEFH
++WE9xOdw+1Bk04RudI7qGgbfp6FIFZSZ1qUzmvN2yRsJ911+eBxOtu+MNw==
+-----END PUBLIC KEY-----
diff --git a/quay.io-fedora-ostree-desktops.pub b/quay.io-fedora-ostree-desktops.pub
new file mode 100644
index 00000000..fb5fc378
--- /dev/null
+++ b/quay.io-fedora-ostree-desktops.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoyz2L+WsK8aLrK+j5D/rNNZojlg4
+KMcGKGooo4ds3MIkqYMuClwkSUa1mmoT4sF5eMAGRvHZZejUQ/uShKUsNg==
+-----END PUBLIC KEY-----