DCT (notary) sandbox documentation out of date

[KevinCathcart]

File: engine/security/trust/trust_sandbox.md

The documentation on this page is slightly out of date.

The image specified to use for the notary service is a specific CI build that is really old, and no new versions are being built since the CI has changed. The test fixture certs included have since expired, so it no longer works.

I am not aware of there being any newer images that include the test fixture certs, so I'm not really sure how best to suggest updating this. The easy way to get a working environment with the test fixture certs is to clone the notary repo, and use it's docker-compose file. However that docker-compose file lacks the registry and docker-in-docker images that the DCT sandbox wants.

@HuKeping @justincormack As the people who seem to merge PRs for notary in recent times any thoughts? The goal being to have some easy way to set up some environment where users can test the workflow of DCT, without needing to jump through all the hoops of setting up certs for notary.

A set of steps that actually works to create a working sandbox environment right now is below. The concern I have with suggesting this is that it could easily become out of date if changes are made to the notary repository, since the below steps are run in the cloned notary repository to be able to access the test fixture certs, but the compose file would live in the documentation, and thus be easier to forget to update. Alternatives include be adding a compose file for this scenario to the notary repo, or having some published image with the test fixture certs available.

Steps to create a working DCT sandbox environment right now:

1. git clone https://github.com/theupdateframework/notary trustsandbox
2. cd trustsandbox
3. Create docker-compose.dctsandbox.yml with the following contents (based partially on the notary repo's compose file, and partially on the out of date documentation).:

version: "2"
services:
  notaryserver:
    build:
      context: .
      dockerfile: server.Dockerfile
    networks:
       - sandbox
    ports:
      - "8080"
      - "4443:4443"
    entrypoint: /usr/bin/env sh
    command: -c "notary-server -config=fixtures/server-config-local.json"
    environment:
      - NOTARY_SERVER_TRUST_SERVICE_TYPE=local
    container_name: notaryserver
  sandboxregistry:
    image: registry
    networks:
      - sandbox
    container_name: sandboxregistry
  trustsandbox:
    image: docker:dind
    networks:
      - sandbox
    volumes:
      - ./fixtures/root-ca.crt:/notarycerts/root-ca.crt
    privileged: true
    container_name: trustsandbox
    entrypoint: ""
    command: |-
        sh -c '
            cp /notarycerts/root-ca.crt /usr/local/share/ca-certificates/root-ca.crt &&
            update-ca-certificates &&
            dockerd-entrypoint.sh --insecure-registry sandboxregistry:5000'
networks:
  sandbox:
    external: false

4. docker-compose -f docker-compose.dctsandbox.yml up -d

[sudo-bmitch]

I went down this path recently and ended up with the following script that I run from a config folder that I then mount in the containers as /var/lib/notary/fixtures and /notarycerts for the server and sandbox respectively. It's a rework of the existing script to run outside of the git repo:

#!/bin/sh

cd "$(dirname "$0")"

# Script to be used for generating testing certs only for notary-server and notary-signer
# Will also create a root-ca and intermediate-ca, deleting those keys when finished

OPENSSLCNF=
for path in /etc/openssl/openssl.cnf /etc/ssl/openssl.cnf /usr/local/etc/openssl/openssl.cnf; do
    if [ -e ${path} ]; then
        OPENSSLCNF=${path}
    fi
done
if [ -z ${OPENSSLCNF} ]; then
    printf "Could not find openssl.cnf"
    exit 1
fi

# First generates root-ca
if [ -f "root-ca.key" ]; then
  chmod 600 "root-ca.key"
else
  openssl genrsa -out "root-ca.key" 4096
fi
openssl req -new -key "root-ca.key" -out "root-ca.csr" -sha256 \
        -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=Notary Testing CA'

cat > "root-ca.cnf" <<EOL
[root_ca]
basicConstraints = critical,CA:TRUE,pathlen:1
keyUsage = critical, nonRepudiation, cRLSign, keyCertSign
subjectKeyIdentifier=hash
EOL

openssl x509 -req -days 3650 -in "root-ca.csr" -signkey "root-ca.key" -sha256 \
        -out "root-ca.crt" -extfile "root-ca.cnf" -extensions root_ca

rm "root-ca.cnf" "root-ca.csr"

# Then generate intermediate-ca
openssl genrsa -out "intermediate-ca.key" 4096
openssl req -new -key "intermediate-ca.key" -out "intermediate-ca.csr" -sha256 \
        -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=Notary Intermediate Testing CA'

cat > "intermediate-ca.cnf" <<EOL
[intermediate_ca]
authorityKeyIdentifier=keyid,issuer
basicConstraints = critical,CA:TRUE,pathlen:0
extendedKeyUsage=serverAuth,clientAuth
keyUsage = critical, nonRepudiation, cRLSign, keyCertSign
subjectKeyIdentifier=hash
EOL

openssl x509 -req -days 3650 -in "intermediate-ca.csr" -sha256 \
        -CA "root-ca.crt" -CAkey "root-ca.key"  -CAcreateserial \
        -out "intermediate-ca.crt" -extfile "intermediate-ca.cnf" -extensions intermediate_ca

rm "intermediate-ca.cnf" "intermediate-ca.csr"
rm "root-ca.srl"
chmod 000 "root-ca.key"

# Then generate notary-server
if [ ! -f "notary-server.key" ]; then
  openssl genrsa -out "notary-server.key" 4096
fi
# else use the existing notary-server key
openssl req -new -key "notary-server.key" -out "notary-server.csr" -sha256 \
        -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=notary-server'

cat > "notary-server.cnf" <<EOL
[notary_server]
authorityKeyIdentifier=keyid,issuer
basicConstraints = critical,CA:FALSE
extendedKeyUsage=serverAuth,clientAuth
keyUsage = critical, digitalSignature, keyEncipherment
subjectAltName = DNS:notary-server, DNS:notaryserver, DNS:localhost, IP:127.0.0.1
subjectKeyIdentifier=hash
EOL

openssl x509 -req -days 750 -in "notary-server.csr" -sha256 \
        -CA "intermediate-ca.crt" -CAkey "intermediate-ca.key"  -CAcreateserial \
        -out "notary-server.crt" -extfile "notary-server.cnf" -extensions notary_server
# append the intermediate cert to this one to make it a proper bundle
cat "intermediate-ca.crt" >> "notary-server.crt"

rm "notary-server.cnf" "notary-server.csr"

# Then generate notary-signer
if [ ! -f "notary-signer.key" ]; then
  openssl genrsa -out "notary-signer.key" 4096
fi
# else use the existing notary-signer key
openssl req -new -key "notary-signer.key" -out "notary-signer.csr" -sha256 \
        -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=notary-signer'

cat > "notary-signer.cnf" <<EOL
[notary_signer]
authorityKeyIdentifier=keyid,issuer
basicConstraints = critical,CA:FALSE
extendedKeyUsage=serverAuth,clientAuth
keyUsage = critical, digitalSignature, keyEncipherment
subjectAltName = DNS:notary-signer, DNS:notarysigner, DNS:localhost, IP:127.0.0.1
subjectKeyIdentifier=hash
EOL

openssl x509 -req -days 750 -in "notary-signer.csr" -sha256 \
        -CA "intermediate-ca.crt" -CAkey "intermediate-ca.key"  -CAcreateserial \
        -out "notary-signer.crt" -extfile "notary-signer.cnf" -extensions notary_signer
# append the intermediate cert to this one to make it a proper bundle
cat "intermediate-ca.crt" >> "notary-signer.crt"

rm "notary-signer.cnf" "notary-signer.csr"

# Then generate notary-escrow
if [ ! -f "notary-escrow.key" ]; then
  openssl genrsa -out "notary-escrow.key" 4096
fi
# else use the existing notary-escrow key
openssl req -new -key "notary-escrow.key" -out "notary-escrow.csr" -sha256 \
        -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=notary-escrow'

cat > "notary-escrow.cnf" <<EOL
[notary_escrow]
authorityKeyIdentifier=keyid,issuer
basicConstraints = critical,CA:FALSE
extendedKeyUsage=serverAuth,clientAuth
keyUsage = critical, digitalSignature, keyEncipherment
subjectAltName = DNS:notary-escrow, DNS:notaryescrow, DNS:localhost, IP:127.0.0.1
subjectKeyIdentifier=hash
EOL

openssl x509 -req -days 750 -in "notary-escrow.csr" -sha256 \
        -CA "intermediate-ca.crt" -CAkey "intermediate-ca.key"  -CAcreateserial \
        -out "notary-escrow.crt" -extfile "notary-escrow.cnf" -extensions notary_escrow
# append the intermediate cert to this one to make it a proper bundle
cat "intermediate-ca.crt" >> "notary-escrow.crt"

rm "notary-escrow.cnf" "notary-escrow.csr"


# Then generate secure.example.com
if [ ! -f "secure.example.com.key" ]; then
  openssl genrsa -out "secure.example.com.key" 4096
fi
# else use the existing secure.example.com key
openssl req -new -key "secure.example.com.key" -out "secure.example.com.csr" -sha256 \
        -subj '/C=US/ST=CA/L=San Francisco/O=Docker/CN=secure.example.com'

cat > "secure.example.com.cnf" <<EOL
[secure.example.com]
authorityKeyIdentifier=keyid,issuer
basicConstraints = critical,CA:FALSE
extendedKeyUsage=serverAuth,clientAuth
keyUsage = critical, digitalSignature, keyEncipherment
subjectAltName = DNS:secure.example.com, DNS:localhost, IP:127.0.0.1
subjectKeyIdentifier=hash
EOL

openssl x509 -req -days 750 -in "secure.example.com.csr" -sha256 \
        -CA "intermediate-ca.crt" -CAkey "intermediate-ca.key"  -CAcreateserial \
        -out "secure.example.com.crt" -extfile "secure.example.com.cnf" -extensions secure.example.com
rm "secure.example.com.cnf" "secure.example.com.csr"
rm "intermediate-ca.key" "intermediate-ca.srl"


# generate self-signed_docker.com-notary.crt and self-signed_secure.example.com
for selfsigned in self-signed_docker.com-notary self-signed_secure.example.com; do
        subj='/O=Docker/CN=docker.com\/notary'
        if echo "${selfsigned}" | grep -q "example.com"; then
                subj='/O=secure.example.com/CN=secure.example.com'
        fi

        openssl ecparam -name prime256v1 -genkey -out "${selfsigned}.key"
        openssl req -new -key "${selfsigned}.key" -out "${selfsigned}.csr" -sha256 -subj "${subj}"
        cat > "${selfsigned}.cnf" <<EOL
[selfsigned]
basicConstraints = critical,CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage=codeSigning
subjectKeyIdentifier=hash
EOL

        openssl x509 -req -days 750 -in "${selfsigned}.csr" -signkey "${selfsigned}.key" \
                -out "${selfsigned}.crt" -extfile "${selfsigned}.cnf" -extensions selfsigned

        # rm "${selfsigned}.cnf" "${selfsigned}.csr" "${selfsigned}.key"
done

[docker-robott]

There hasn't been any activity on this issue for a long time.
If the problem is still relevant, mark the issue as fresh with a /remove-lifecycle stale comment.
If not, this issue will be closed in 14 days. This helps our maintainers focus on the active issues.

Prevent issues from auto-closing with a /lifecycle frozen comment.

/lifecycle stale

[docker-robott]

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

/lifecycle locked