Remove Codenotary integrity check #6236

agners · 2025-10-07T14:04:22Z

Proposed change

Formally deprecate CodeNotary build config.

Remove CodeNotary specific integrity checking. The current code is specific to how Codenotary's integrity checking. The cosign signing mechanism only signs the container image digest (sha256). The container image digest in turn references the image manifest (which references the layers). This setup does not allow integrity checks on disk, but only during installation/download.

To ensure container integrity on disk other mechanism like EROFS with dm-verity can be used. Integrity is validated on the fly with such mechanism. Hence no Supervisor level implementation would be needed, but correct error handling at runtime if errors are detected.

In any case, a future container image integrity likely will look different then how Codenotary looked. Remove the current code to make way for a future implementations.

This can be seen as a follow up of #4217.

Type of change

Dependency upgrade
Bugfix (non-breaking change which fixes an issue)
New feature (which adds functionality to the supervisor)
Breaking change (fix/feature causing existing functionality to break)
Code quality improvements to existing code or addition of tests

Additional information

This PR fixes or closes issue: fixes #
This PR is related to issue:
Link to documentation pull request:
Link to cli pull request: Remove content-trust security option cli#604
Link to client library pull request: Remove Codenotary related constants home-assistant-libs/python-supervisor-client#206

Checklist

The code change is tested and works locally.
Local tests pass. Your PR cannot be merged unless tests pass
There is no commented out code in this PR.
I have followed the development checklist
The code has been formatted using Ruff (ruff format supervisor tests)
Tests have been added to verify that the new code works.

If API endpoints or add-on configuration are added/changed:

Documentation added/updated for developers.home-assistant.io
CLI updated (if necessary)
Client library updated (if necessary)

mdegat01

Looks like we missed a few key things in the API here that should go if we want to fully remove this. This will also require a follow up PR in basically all the other repos Supervisor changes normally impact (cli, client library, dev doc, doc and core).

Also we have code notary worked into our CI don't we? And in the image for supervisor and supervisor devcontainer. So we'll need to get it removed from there as well as other follow-up PRs.

supervisor/api/security.py

supervisor/security/module.py

supervisor/resolution/checks/supervisor_trust.py

supervisor/security/module.py

mdegat01 · 2025-10-10T18:11:10Z

supervisor/api/security.py

-_LOGGER: logging.Logger = logging.getLogger(__name__)
-
 # pylint: disable=no-value-for-parameter
 SCHEMA_OPTIONS = vol.Schema(


The schema for security/options includes content_trust and force_security:

supervisor/supervisor/api/security.py

Lines 18 to 24 in 3c21a8b

SCHEMA_OPTIONS = vol.Schema(

{

vol.Optional(ATTR_PWNED): vol.Boolean(),

vol.Optional(ATTR_CONTENT_TRUST): vol.Boolean(),

vol.Optional(ATTR_FORCE_SECURITY): vol.Boolean(),

}

)

supervisor/supervisor/api/security.py

Lines 39 to 53 in 3c21a8b

@api_process

async def options(self, request: web.Request) -> None:

"""Set options for Security."""

body = await api_validate(SCHEMA_OPTIONS, request)

if ATTR_PWNED in body:

self.sys_security.pwned = body[ATTR_PWNED]

if ATTR_CONTENT_TRUST in body:

self.sys_security.content_trust = body[ATTR_CONTENT_TRUST]

if ATTR_FORCE_SECURITY in body:

self.sys_security.force = body[ATTR_FORCE_SECURITY]

await self.sys_security.save_data()

await self.sys_resolution.evaluate.evaluate_system()

Neither of these options make sense anymore. They should be removed from here, the python properties removed from security module and removed from the schema for the persistent config file for the security module here:

supervisor/supervisor/validate.py

Lines 230 to 237 in 3c21a8b

SCHEMA_SECURITY_CONFIG = vol.Schema(

{

vol.Optional(ATTR_CONTENT_TRUST, default=True): vol.Boolean(),

vol.Optional(ATTR_PWNED, default=True): vol.Boolean(),

vol.Optional(ATTR_FORCE_SECURITY, default=False): vol.Boolean(),

},

extra=vol.REMOVE_EXTRA,

)

That will also require a change in the client library, cli and documentation to remove those options.

The security/info API should not return their values either:

supervisor/supervisor/api/security.py

Lines 31 to 37 in 3c21a8b

async def info(self, request: web.Request) -> dict[str, Any]:

"""Return Security information."""

return {

ATTR_CONTENT_TRUST: self.sys_security.content_trust,

ATTR_PWNED: self.sys_security.pwned,

ATTR_FORCE_SECURITY: self.sys_security.force,

}

That will require a change in the client library and documentation.

Should be able to toss those constants after as well.

Initially, my intention was to leave the outside API intact, so we can reuse it for the cosign implementation if it feels right. But after a bit more consideration, I think it is better to remove the API as well. With cosign I'd like to use cosign specific wording, e.g. image signature verification for the verification process etc. Content verification will work quite a bit different with EROFS/fsverity, so the API does not really match.

The force_security flag is also used by HIBP, so I did not remove that part.

home-assistant · 2025-10-10T18:18:31Z

Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍

Learn more about our pull request process.

pvizeli · 2025-10-22T18:54:16Z

The reason why I did not removed it was, that wanted to just make a swap to cosign. It should be simple to replace it with using the cosign tool but I never found the time

agners · 2025-10-23T14:16:32Z

The reason why I did not removed it was, that wanted to just make a swap to cosign. It should be simple to replace it with using the cosign tool but I never found the time

We could come up with a way to use cosign as a drop-in replacement where we would check the file system content at runtime (similar to how it worked on cosign). But the next step then would be how can we act on it if there are issues... And unfortunately Docker is a bit annoying in that domain: If a layer is used by another image, and the corruption happened in a file which is part of a shared part, then removing and pulling the image does not fix the integrity issue (since the shared layer will not get fetched/written again) 😞 . In a way, the current approach would allow to detect integrity issues, but we have no way to fix it 😢 .

I'd like to leverage containerd integrated integrity checks, namely EROFS and fsverity (got introduced with containerd/containerd#11352). But integration of this will be different, so I think it is simpler to remove the current code and then implement support for EROFS/fsverity from ground up.

The current code is specific to how CodeNotary was doing integrity checking. A future integrity checking mechanism likely will work differently (e.g. through EROFS based containers). Remove the current code to make way for a future implementation.

Remove CodeNotary related exceptions and handling from the Docker interface.

Introduce a new exception class APIGone to indicate that certain API features have been removed and are no longer available. Update the security integrity check endpoint to raise this new exception instead of a generic APIError, providing clearer communication to clients that the feature has been intentionally removed.

A cosign based signature verification will likely be named differently to avoid confusion with existing implementations. For now, remove the content trust option entirely.

Since we have "remove extra" in voluptuous, we can remove the codenotary field from the addon schema.

Remove the Codenotary based content-trust security option. The replacement usign cosign will likely require different options. Related to: home-assistant/supervisor#6236

Remove constants used for Codenotary related security features. A future security feature will be cosign based and likely use different termology. Related to: home-assistant/supervisor#6236

mdegat01

Looks ready to me now. We'll need a PR in ~~cli, client library~~ and doc for the removal of that API option though.

EDIT: Ok I see the first two are done, whoops. Last thing is remove it from the doc here: https://developers.home-assistant.io/docs/api/supervisor/endpoints#security

supervisor/docker/interface.py

tests/resolution/check/test_docker_config_volume_fix.py

Remove the Codenotary based content-trust security option. The replacement usign cosign will likely require different options. Related to: home-assistant/supervisor#6236

agners added the breaking-change label Oct 7, 2025

home-assistant bot added cla-signed Hacktoberfest labels Oct 7, 2025

agners requested a review from mdegat01 October 9, 2025 15:06

mdegat01 requested changes Oct 10, 2025

View reviewed changes

home-assistant bot marked this pull request as draft October 10, 2025 18:18

agners marked this pull request as ready for review October 23, 2025 14:16

home-assistant bot requested a review from mdegat01 October 23, 2025 14:16

agners force-pushed the remove-codenotary-integrity-check branch from b1d24e2 to 671ece2 Compare October 28, 2025 14:45

agners added 13 commits October 28, 2025 15:48

Formally deprecate CodeNotary build config

116319e

Drop CodeNotary integrity fixups

789053f

Drop unused tests

2e808a7

Fix pytest

0030b03

Fix pytest

bf3ff95

Remove CodeNotary related exceptions and handling

c80a69b

Remove CodeNotary related exceptions and handling from the Docker interface.

Drop unnecessary comment

676cc29

Remove Codenotary specific IssueType/SuggestionType

0e6ca19

Drop Codenotary specific environment and secret reference

e3428b4

Remove unused constants

28d9789

Drop content trust

0bb0b51

A cosign based signature verification will likely be named differently to avoid confusion with existing implementations. For now, remove the content trust option entirely.

agners force-pushed the remove-codenotary-integrity-check branch from 671ece2 to 0bb0b51 Compare October 28, 2025 14:48

agners added 4 commits October 28, 2025 15:57

Drop code sign test

5ef1c68

Remove source_mods/content_trust evaluations

d01ca41

Remove content_trust reference in bootstrap.py

e53f476

Fix security tests

5d80bf5

agners added 2 commits October 28, 2025 16:22

Drop unused tests

d308709

Drop codenotary from schema

a0890ac

Since we have "remove extra" in voluptuous, we can remove the codenotary field from the addon schema.

agners mentioned this pull request Oct 28, 2025

Remove Codenotary signing information home-assistant/addons#4208

Merged

agners mentioned this pull request Oct 28, 2025

Remove content-trust security option home-assistant/cli#604

Merged

agners added 2 commits October 28, 2025 18:18

Remove content_trust from tests

3412efa

Remove content_trust unsupported reason

9dfb02f

agners mentioned this pull request Oct 28, 2025

Remove Codenotary related constants home-assistant-libs/python-supervisor-client#206

Merged

agners added the needs-core Pull request needs Home Assistant Core changes but none are linked label Oct 28, 2025

mdegat01 approved these changes Oct 28, 2025

View reviewed changes

supervisor/docker/interface.py Outdated Show resolved Hide resolved

tests/resolution/check/test_docker_config_volume_fix.py Outdated Show resolved Hide resolved

mdegat01 added the missing-documentation Added to pull requests that needs a docs, but none is linked label Oct 28, 2025

agners added 2 commits October 29, 2025 14:08

Remove unnecessary comment

1fa2f33

Remove unrelated pytest

e201546

lmagyar mentioned this pull request Nov 1, 2025

Support cosign hassio-addons/addon-base#350

Open

Remove unrelated fixtures

89c2ff4

agners merged commit 1448a33 into main Nov 3, 2025
23 checks passed

agners deleted the remove-codenotary-integrity-check branch November 3, 2025 19:13

github-actions bot locked and limited conversation to collaborators Nov 5, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Remove Codenotary integrity check #6236

Remove Codenotary integrity check #6236

Uh oh!

agners commented Oct 7, 2025 •

edited

Loading

Uh oh!

mdegat01 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mdegat01 Oct 10, 2025 •

edited

Loading

Uh oh!

agners Oct 28, 2025

Uh oh!

home-assistant bot commented Oct 10, 2025

Uh oh!

pvizeli commented Oct 22, 2025

Uh oh!

agners commented Oct 23, 2025

Uh oh!

mdegat01 left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	SCHEMA_OPTIONS = vol.Schema(
	{
	vol.Optional(ATTR_PWNED): vol.Boolean(),
	vol.Optional(ATTR_CONTENT_TRUST): vol.Boolean(),
	vol.Optional(ATTR_FORCE_SECURITY): vol.Boolean(),
	}
	)

	@api_process
	async def options(self, request: web.Request) -> None:
	"""Set options for Security."""
	body = await api_validate(SCHEMA_OPTIONS, request)

	if ATTR_PWNED in body:
	self.sys_security.pwned = body[ATTR_PWNED]
	if ATTR_CONTENT_TRUST in body:
	self.sys_security.content_trust = body[ATTR_CONTENT_TRUST]
	if ATTR_FORCE_SECURITY in body:
	self.sys_security.force = body[ATTR_FORCE_SECURITY]

	await self.sys_security.save_data()

	await self.sys_resolution.evaluate.evaluate_system()

	SCHEMA_SECURITY_CONFIG = vol.Schema(
	{
	vol.Optional(ATTR_CONTENT_TRUST, default=True): vol.Boolean(),
	vol.Optional(ATTR_PWNED, default=True): vol.Boolean(),
	vol.Optional(ATTR_FORCE_SECURITY, default=False): vol.Boolean(),
	},
	extra=vol.REMOVE_EXTRA,
	)

	async def info(self, request: web.Request) -> dict[str, Any]:
	"""Return Security information."""
	return {
	ATTR_CONTENT_TRUST: self.sys_security.content_trust,
	ATTR_PWNED: self.sys_security.pwned,
	ATTR_FORCE_SECURITY: self.sys_security.force,
	}

Remove Codenotary integrity check #6236

Remove Codenotary integrity check #6236

Uh oh!

Conversation

agners commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed change

Type of change

Additional information

Checklist

Uh oh!

mdegat01 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mdegat01 Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

agners Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

home-assistant bot commented Oct 10, 2025

Uh oh!

pvizeli commented Oct 22, 2025

Uh oh!

agners commented Oct 23, 2025

Uh oh!

mdegat01 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

agners commented Oct 7, 2025 •

edited

Loading

mdegat01 Oct 10, 2025 •

edited

Loading

mdegat01 left a comment •

edited

Loading