Cloud customer?
Start for Free >
Upgrade in MyJFrog >
What's New in Cloud >

Search





Working with an older version? JFrog Artifactory 6.x | JFrog Xray 2.x | JFrog Mission Control 3.x | JFrog Distribution 1.x |


Skip to end of metadata
Go to start of metadata

Overview

The signed pipelines feature is a verification system that determines which pipelines/steps generated a specific artifact. It provides users with a way to ensure that their artifacts have not been tampered with before these artifacts are promoted through the CI/CD workflow. The signing process creates trust, and provides a way to validate the immutability of the artifacts and the authenticity of packages. This means, if the authenticity of artifacts cannot be verified, they can be blocked.

In addition, the signed pipelines feature builds comprehensive metadata, called pipeinfo. This provides complete visibility and audit for each step and run, which can be viewed in the UI. 

  • The signed pipelines feature is available with Enterprise+ license only.
  • As of this release, the signed pipelines feature is available for buildinfo and Go binaries only.
  • The signed pipelines feature is enabled by default. To disable this feature, in the Core Services Configurations section in the Pipelines System YAML, set the signedPipelinesEnabled tag as false.

Page Contents

Signing Process

During the signing process of a pipeline:

  • A run key is generated for every run of the pipeline.
  • During the run, all artifacts (pipeInfo.json) are signed with the private key.
  • The private key is discarded at the end of the run.
  • Metadata for the run that generated the artifact is stored as a tag for the artifact.

  • During the verification stage, a public key is used to verify the signature.

For each run, files containing comprehensive metadata (*.json) and corresponding signature files (*.json.sig) are uploaded to Artifactory. This provides a way to trace the entire path of a pipeline. Now any process that needs to verify can verify this in addition to cross-referencing the pipeInfo.

Pipe-Info Repository

The Pipe-Info repository, like the Build-Info Repository, is a local repository that is created per Project and stores all the metadata for each pipeline.

Whenever Pipelines uploads a new build to Artifactory, its pipeinfo json files are automatically deployed to either the default artifactory-pipe-info repository or the <project_key>-pipe-info repository. Pipeline artifacts that do not belong to any Project are stored in the artifactory-pipe-info repository and pipeline artifacts that belong to specific Projects are stored in the <project_key>-pipe-info repository.

Viewing pipe-info Repository

To view the pipe-info repository, from the Application module, click Artifactory | Artifacts and then click the artifactory-pipe-info/<project_key>-pipe-info repository.

Artifactory automatically places the json files in the pipe-info repository using the following structure: [pipeline-name] → [branch] → [run-rumber] → [pipe-info files].

The JSON schema defines a pipeinfo object. The object is composed of three components, which summarizes a run:

  • head.json: Contains metadata about the pipeline, and the contents of the pipeline yaml file.
  • info.json: Contains metadata about the status of the run.
  • step.json: Contains metadata about the step.

Each .json file is stored with a corresponding .json.sig signature file. To view the contents a json file, right-click the file and click View, as shown in the image above.

Using the artifactory-pipe-info repository

  • The artifactory-pipe-info repository is automatically created and used by default. Removing it will cause all the pipe-info in the repository to be deleted and a new default pipe-info repository will be recreated.
  • Only admins and Project admins can view and navigate this repository.

Cleanup Policies

If you have existing cleanup policies, defined in Artifactory User Plugins, that deletes artifacts from your local repositories according to a policy, they will also affect the artifactory-pipe-info repository and should be updated accordingly. Exclude this repository from your cleanup policies to ensure that your pipe info files are not deleted.

Viewing Metadata

When you have a successful build for a pipeline, the metadata for the artifacts and builds for that pipeline is displayed in the corresponding repository in Artifactory:

Go to Artifactory | Artifacts | <repo_name> | projects | <version>, navigate and click one of the files. This displays the Pipelines tab, which shows the metadata for the run that created the artifact.

The Pipelines tab appears only when you click a file.

Similarly, go to Artifactory | Builds | <build_name> | <build_id> and click the Pipelines tab. which shows metadata for the build.

Viewing pipeinfo.json

A pipeInfo.json file is generated for each run under the Project/Pipeline namespace. This file captures the metadata for a specific step of a pipeline, as well as a detailed Bill of Materials (BOM) for each run. The pipe-info includes information, such as name, version, type, status, timestamps, inputs, outputs, nodepools and more. This information is maintained in run state during execution. When the run completes, the json file is uploaded to the appropriate repository. 

To view the pipeinfo.json file, hover the mouse pointer over a pipeline and click the Show pipe info icon that appears. The contents of the pipeinfo.json file is displayed in a json viewer.

Navigating to the Step

Hover the mouse pointer over a pipeline and click the Go to step icon that appears. This takes you to the step view of a specific run for that specific pipeline in My Pipelines.

  • No labels
Copyright © 2021 JFrog Ltd.