fix(content): harden kubernetes and signing examples

18_security/18.6_image_security.md

@@ -313,7 +313,8 @@ RUN apt-get update && apt-get install -y curl
 
 # ✓ 推荐：固定基础镜像版本和摘要
 FROM ubuntu:22.04@sha256:a6d2b38300ce017add71440577d5b0a90460d0e6e0e14...（完整 64 位哈希）
-RUN apt-get update && apt-get install -y curl=7.68.0-1ubuntu1
+RUN apt-get update && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
 ```
 
 #### 2. 构建时扫描
@@ -414,6 +415,7 @@ jobs:
       contents: read
       packages: write
       security-events: write
+      id-token: write
 
     steps:
     - name: Checkout code
@@ -422,7 +424,11 @@ jobs:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v4
 
-    - name: Build Docker image
+    - name: Install Cosign
+      if: github.event_name == 'push'
+      uses: sigstore/cosign-installer@v3
+
+    - name: Build Docker image for scan
       uses: docker/build-push-action@v7
       with:
         context: .
@@ -459,11 +465,6 @@ jobs:
         name: sbom
         path: sbom-cyclonedx.json
 
-    - name: Sign image with Cosign
-      if: github.event_name == 'push'
-      run: |
-        cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
     - name: Login to Registry and Push
       if: github.event_name == 'push'
       uses: docker/login-action@v3
@@ -473,11 +474,18 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Push image
+      if: github.event_name == 'push'
+      id: build-push
       uses: docker/build-push-action@v7
       with:
         context: .
         push: true
         tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+
+    - name: Sign image with Cosign
+      if: github.event_name == 'push'
+      run: |
+        cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-push.outputs.digest }}
 ```
 
 #### GitLab CI 工作流示例
@@ -486,8 +494,8 @@ jobs:
 stages:
   - build
   - scan
-  - sign
   - push
+  - sign
 
 variables:
   REGISTRY: registry.gitlab.com
@@ -524,14 +532,6 @@ generate:sbom:
     reports:
       sbom: sbom.xml
 
-sign:
-  stage: sign
-  image: gcr.io/projectsigstore/cosign:latest
-  script:
-    - cosign sign --key $COSIGN_KEY $IMAGE_NAME:$CI_COMMIT_SHA
-  only:
-    - main
-
 push:
   stage: push
   image: docker:latest
@@ -541,6 +541,21 @@ push:
     - docker load < image.tar
     - echo "$REGISTRY_PASSWORD" | docker login --username "$REGISTRY_USER" --password-stdin "$REGISTRY"
     - docker push $IMAGE_NAME:$CI_COMMIT_SHA
+    - DIGEST=$(docker buildx imagetools inspect "$IMAGE_NAME:$CI_COMMIT_SHA" --format '{{.Manifest.Digest}}')
+    - echo "$IMAGE_NAME@$DIGEST" > image-digest.txt
+  artifacts:
+    paths:
+      - image-digest.txt
+  only:
+    - main
+
+sign:
+  stage: sign
+  image: gcr.io/projectsigstore/cosign:latest
+  script:
+    - cosign sign --key $COSIGN_KEY "$(cat image-digest.txt)"
+  only:
+    - main
   only:
     - main
 ```