<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-container-base-image-provenance
description: >-
  Analyze container base image provenance to verify origin, integrity, and
  supply chain trust. Detect tampered images, verify signatures, assess
  base image vulnerability posture, and track image lineage.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - container-security
  - base-image
  - provenance
  - image-signing
  - docker-security
  - oci-images
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Analyzing Container Base Image Provenance

## Overview

Container base images are a critical supply chain trust anchor — a compromised
base image affects every container built on top of it. This skill covers
provenance verification of base images, signature validation with cosign/Notary,
vulnerability assessment of base layers, image lineage tracking, and detection
of tampered or unofficial images masquerading as trusted publishers.

Mode: `[MODE: BLUE]` — Verify container base image provenance and supply chain integrity.

## Prerequisites

| Requirement | Details |
|---|---|
| cosign for image signature verification | Required |
| crane for registry inspection (`go install github.com/google/go-containerregistry/cmd/crane@latest`) | Required |
| trivy for image vulnerability scanning (`brew install trivy`) | Required |
| skopeo for image operations (`brew install skopeo`) | Required |
| Python 3.10+ with `requests` | Required |

## Key Concepts

### Base Image Signature Verification

```bash
# Verify official image signatures
cosign verify docker.io/library/nginx:latest \
  --certificate-identity-regexp '.*' \
  --certificate-oidc-issuer-regexp '.*'

# Verify Chainguard image signatures
cosign verify cgr.dev/chainguard/nginx:latest \
  --certificate-identity-regexp '.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# Check image attestations
cosign verify-attestation --type slsaprovenance ghcr.io/owner/image:tag
```

### Image Lineage Tracking

```bash
# Inspect image history (layers)
docker history --no-trunc nginx:latest

# Get image manifest
crane manifest docker.io/library/nginx:latest | jq '.'

# Compare image digests
crane digest docker.io/library/nginx:latest
crane digest docker.io/library/nginx:1.25

# List image tags
crane ls docker.io/library/nginx | head -20
```

### Base Image Vulnerability Assessment

```bash
# Scan base image for vulnerabilities
trivy image --severity CRITICAL,HIGH nginx:latest -f json

# Scan only OS packages in base image
trivy image --vuln-type os nginx:latest -f json

# Compare vulnerability counts between base images
trivy image --severity CRITICAL nginx:latest -f json | jq '.Results | map(.Vulnerabilities | length) | add'
trivy image --severity CRITICAL cgr.dev/chainguard/nginx:latest -f json | jq '.Results | map(.Vulnerabilities | length) | add'
```

## Workflow

### Step 1: Verify base image signatures and provenance

```bash
node scripts/agent.js --action verify --image /tmp/target --output /tmp/verify-result.json
```

### Step 2: Scan base image for vulnerabilities

```bash
node scripts/agent.js --action scan --image /tmp/target --output /tmp/scan-result.json
```

### Step 3: Generate base image provenance report

```bash
node scripts/agent.js --action report --image /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Container Base Image Provenance Detection
id: bfec4e28-58df-4158-96d0-a8cc49fecb39
status: experimental
description: Detects suspicious activity related to analyzing container base image provenance techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*analyzing*container*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Container Base Image Provenance Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] Base image signatures verified against trusted identity
- [ ] Image digest matches expected value from verified source
- [ ] No critical vulnerabilities in base image OS packages
- [ ] Image provenance attestation validated
- [ ] Base image sourced from official or trusted publisher

## References

- [Cosign Documentation](https://docs.sigstore.dev/cosign/overview/)
- [Docker Official Images](https://docs.docker.com/trusted-content/official-images/)
- [Chainguard Images](https://www.chainguard.dev/chainguard-images)
- [OCI Image Spec](https://github.com/opencontainers/image-spec)
