# ✅ 推荐：使用精确的身份匹配
cosign verify \
  --certificate-identity="https://github.com/myorg/myrepo/.github/workflows/build.yml@refs/heads/main" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/myorg/myimage:v1.0.0

# ❌ 避免：使用过于宽泛的匹配
cosign verify \
  --certificate-identity-regexp=".*" \
  --certificate-oidc-issuer-regexp=".*" \
  ghcr.io/myorg/myimage:v1.0.0

# 需要至少两个签名者
apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: require-multi-signatures
spec:
  images:
    - glob: "ghcr.io/myorg/critical-app/**"
  authorities:
    # 安全团队签名
    - key:
        data: |
          -----BEGIN PUBLIC KEY-----
          MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...security-team...
          -----END PUBLIC KEY-----
    # 发布经理签名
    - key:
        data: |
          -----BEGIN PUBLIC KEY-----
          MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...release-manager...
          -----END PUBLIC KEY-----

# ✅ 推荐：使用 digest 查询，而非 tag
cosign verify \
  --key cosign.pub \
  ghcr.io/myorg/myimage@sha256:abc123...

# ❌ 避免：使用 mutable tag 查询
cosign verify \
  --key cosign.pub \
  ghcr.io/myorg/myimage:latest

# ✅ 推荐：始终验证包含证明
cosign verify \
  --certificate-identity=[email protected] \
  --certificate-oidc-issuer=https://accounts.google.com \
  --check-claims=true \
  --verify-inclusion=true \
  ghcr.io/myorg/myimage:v1.0.0

# ✅ 推荐：验证集成时间
rekor-cli get --log-index=12345678 --format=json | jq '{
  integratedTime: (.integratedTime | todate),
  bodyKind: .body.kind
}'

# ✅ 推荐：缓存 Rekor 查询结果
REKOR_CACHE_DIR="$HOME/.cache/rekor"
mkdir -p "$REKOR_CACHE_DIR"

rekor-cli get --log-index=12345678 --format=json > "$REKOR_CACHE_DIR/entry-12345678.json"

# ✅ 推荐：并行验证多个构件
parallel cosign verify --key cosign.pub {} ::: \
  ghcr.io/myorg/app1:v1.0.0 \
  ghcr.io/myorg/app2:v1.0.0 \
  ghcr.io/myorg/app3:v1.0.0

#!/bin/bash
# 带退避重试的查询脚本
rekor_get_with_retry() {
  local max_retries=5
  local retry=0
  local delay=1
  
  while [ $retry -lt $max_retries ]; do
    if result=$(rekor-cli get --log-index="$1" --format=json 2>/dev/null); then
      echo "$result"
      return 0
    fi
    
    # 检查是否为速率限制错误
    if echo "$result" | grep -q "429"; then
      echo "速率限制，等待 ${delay} 秒后重试..." >&2
      sleep $delay
      delay=$((delay * 2))
      ((retry++))
    else
      return 1
    fi
  done
  
  echo "超过最大重试次数" >&2
  return 1
}

# prometheus/alerts/rekor.yml
groups:
  - name: rekor
    rules:
      - alert: RekorServerDown
        expr: up{job="rekor-server"} == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Rekor Server 不可用"
          description: "Rekor Server 已停止响应超过 1 分钟"

      - alert: RekorHighLatency
        expr: histogram_quantile(0.99, rate(rekor_http_request_duration_seconds_bucket[5m])) > 1
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Rekor API 延迟过高"
          description: "P99 延迟超过 1 秒"

      - alert: RekorTreeNotGrowing
        expr: delta(trillian_sequencer_tree_size[1h]) == 0
        for: 6h
        labels:
          severity: warning
        annotations:
          summary: "日志树大小未增长"
          description: "过去 6 小时日志树大小未增加，可能存在写入问题"

      - alert: MySQLConnectionsHigh
        expr: mysql_global_status_threads_connected > 150
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "MySQL 连接数过高"
          description: "MySQL 当前连接数超过 150"

      - alert: DiskSpaceLow
        expr: (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) < 0.15
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "磁盘空间不足"
          description: "可用磁盘空间低于 15%"

#!/bin/bash
# 定期审计脚本 (每周运行)
AUDIT_DIR="/var/audit/rekor/$(date +%Y%m%d)"
mkdir -p "$AUDIT_DIR"

# 记录日志状态
rekor-cli loginfo > "$AUDIT_DIR/loginfo.txt"

# 验证最近的条目
for i in $(seq 0 99); do
  INDEX=$((TREE_SIZE - i))
  rekor-cli verify --log-index=$INDEX > /dev/null 2>&1
  if [ $? -eq 0 ]; then
    echo "✅ Index $INDEX" >> "$AUDIT_DIR/verification.txt"
  else
    echo "❌ Index $INDEX" >> "$AUDIT_DIR/verification.txt"
    echo "验证失败: Index $INDEX" | mail -s "Rekor 审计告警" [email protected]
  fi
done

# 生成审计报告
cat > "$AUDIT_DIR/report.md" << EOF
# Rekor 周审计报告
- 审计时间: $(date -u '+%Y-%m-%d %H:%M:%S UTC')
- 树大小: $(rekor-cli loginfo | grep 'tree size')
- 根哈希: $(rekor-cli loginfo | grep 'root hash')
- 验证结果: $(grep -c '✅' "$AUDIT_DIR/verification.txt") 通过, $(grep -c '❌' "$AUDIT_DIR/verification.txt") 失败
EOF

#!/bin/bash
# generate-compliance-report.sh
# 生成合规审计报告

REPORT_DIR="./compliance-reports/$(date +%Y%m%d)"
mkdir -p "$REPORT_DIR"

echo "=== 生成供应链安全合规报告 ==="

# 1. 签名覆盖率
echo ">>> 计算签名覆盖率..."
TOTAL_IMAGES=$(curl -s https://ghcr.io/v2/myorg/myapp/tags/list | jq '.tags | length')
SIGNED_IMAGES=0
for tag in $(curl -s https://ghcr.io/v2/myorg/myapp/tags/list | jq -r '.tags[]'); do
  if cosign verify \
    --certificate-identity-regexp=".*" \
    --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
    ghcr.io/myorg/myapp:$tag > /dev/null 2>&1; then
    ((SIGNED_IMAGES++))
  fi
done
SIGNATURE_COVERAGE=$((SIGNED_IMAGES * 100 / TOTAL_IMAGES))

# 2. Rekor 记录完整性
echo ">>> 验证 Rekor 记录..."
REKOR_ENTRIES=$(rekor-cli search --sha256=$(cosign triangulate ghcr.io/myorg/myapp:v1.0.0 | xargs sha256sum | awk '{print $1}') 2>/dev/null | wc -l)

# 3. 生成报告
cat > "$REPORT_DIR/compliance-report.md" << EOF
# 供应链安全合规报告

## 基本信息
- 报告日期: $(date -u '+%Y-%m-%d')
- 覆盖范围: ghcr.io/myorg/myapp

## 关键指标
- 总镜像数: $TOTAL_IMAGES
- 已签名镜像: $SIGNED_IMAGES
- 签名覆盖率: ${SIGNATURE_COVERAGE}%
- Rekor 记录数: $REKOR_ENTRIES

## 合规状态
- SLSA 等级: $([ $SIGNATURE_COVERAGE -eq 100 ] && echo "Level 3+" || echo "Level 2")
- 签名验证: $([ $SIGNATURE_COVERAGE -ge 95 ] && echo "✅ 合规" || echo "⚠️ 需要改进")
- 透明日志: $([ $REKOR_ENTRIES -gt 0 ] && echo "✅ 合规" || echo "⚠️ 未配置")

## 建议
$([ $SIGNATURE_COVERAGE -lt 100 ] && echo "- 提高签名覆盖率到 100%")
$([ $REKOR_ENTRIES -eq 0 ] && echo "- 启用 Rekor 透明日志记录")
EOF

echo "=== 报告生成完成: $REPORT_DIR/compliance-report.md ==="

#!/bin/bash
# emergency-response.sh
# 密钥泄露应急响应脚本

set -euo pipefail

echo "=== 密钥泄露应急响应 ==="

# 1. 立即撤销泄露的密钥
echo ">>> 步骤 1: 撤销泄露的密钥"
# 如果使用 KMS：禁用密钥版本
# 如果使用本地密钥：从所有系统中删除

# 2. 确定影响范围
echo ">>> 步骤 2: 确定影响范围"
echo "搜索使用泄露密钥签名的所有条目..."
COMPROMISED_KEY="cosign-compromised.pub"
AFFECTED_ENTRIES=$(rekor-cli search --public-key="$COMPROMISED_KEY" 2>/dev/null | grep -oE '[0-9]+' || echo "")
echo "受影响的 Rekor 条目数: $(echo "$AFFECTED_ENTRIES" | wc -l)"

# 3. 记录到 Rekor（标记为撤销）
echo ">>> 步骤 3: 记录撤销信息"
# 创建撤销记录...

# 4. 生成新的密钥对
echo ">>> 步骤 4: 生成新密钥"
cosign generate-key-pair

# 5. 重新签名所有受影响的构件
echo ">>> 步骤 5: 重新签名"
# 根据具体情况重新签名...

# 6. 通知相关人员
echo ">>> 步骤 6: 通知"
echo "请通知以下人员："
echo "- 安全团队"
echo "- 运维团队"
echo "- 受影响的下游用户"

echo "=== 应急响应完成 ==="