|
| 1 | +// Copyright The Conforma Contributors |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | +// |
| 15 | +// SPDX-License-Identifier: Apache-2.0 |
| 16 | + |
| 17 | +// attest.go |
| 18 | +package vsa |
| 19 | + |
| 20 | +import ( |
| 21 | + "bytes" |
| 22 | + "context" |
| 23 | + "encoding/json" |
| 24 | + "fmt" |
| 25 | + "os" |
| 26 | + "path/filepath" |
| 27 | + "strings" |
| 28 | + "time" |
| 29 | + |
| 30 | + "github.com/sigstore/cosign/v2/pkg/cosign" |
| 31 | + att "github.com/sigstore/cosign/v2/pkg/cosign/attestation" |
| 32 | + "github.com/sigstore/cosign/v2/pkg/types" |
| 33 | + "github.com/sigstore/sigstore/pkg/signature" |
| 34 | + "github.com/sigstore/sigstore/pkg/signature/dsse" |
| 35 | + sigopts "github.com/sigstore/sigstore/pkg/signature/options" |
| 36 | + "github.com/spf13/afero" |
| 37 | +) |
| 38 | + |
| 39 | +var loadPrivateKey = cosign.LoadPrivateKey |
| 40 | + |
| 41 | +type AttestOptions struct { |
| 42 | + PredicatePath string // path to the raw VSA (predicate) JSON |
| 43 | + PredicateType string // e.g. "https://enterprisecontract.dev/attestations/vsa/v1" // TODO: make this configurable |
| 44 | + ImageDigest string // sha256:abcd… (as returned by `skopeo inspect --format {{.Digest}}`) |
| 45 | + Repo string // "quay.io/acme/widget" (hostname/namespace/repo) |
| 46 | + Signer *Signer |
| 47 | +} |
| 48 | + |
| 49 | +type Signer struct { |
| 50 | + KeyPath string |
| 51 | + FS afero.Fs |
| 52 | + WrapSigner signature.Signer |
| 53 | +} |
| 54 | + |
| 55 | +func NewSigner(keyPath string, fs afero.Fs) (*Signer, error) { |
| 56 | + keyBytes, err := afero.ReadFile(fs, keyPath) |
| 57 | + if err != nil { |
| 58 | + return nil, fmt.Errorf("read key %q: %w", keyPath, err) |
| 59 | + } |
| 60 | + |
| 61 | + sv, err := loadPrivateKey(keyBytes, []byte(os.Getenv("COSIGN_PASSWORD"))) |
| 62 | + if err != nil { |
| 63 | + return nil, fmt.Errorf("load private key: %w", err) |
| 64 | + } |
| 65 | + |
| 66 | + return &Signer{ |
| 67 | + KeyPath: keyPath, |
| 68 | + FS: fs, |
| 69 | + WrapSigner: dsse.WrapSigner(sv, types.IntotoPayloadType), |
| 70 | + }, nil |
| 71 | +} |
| 72 | + |
| 73 | +// Add a constructor with sensible defaults |
| 74 | +func NewAttestOptions(predicatePath, repo, imageDigest string, signer *Signer) (*AttestOptions, error) { |
| 75 | + return &AttestOptions{ |
| 76 | + PredicatePath: predicatePath, |
| 77 | + PredicateType: "https://enterprisecontract.dev/attestations/vsa/v1", |
| 78 | + ImageDigest: imageDigest, |
| 79 | + Repo: repo, |
| 80 | + Signer: signer, |
| 81 | + }, nil |
| 82 | +} |
| 83 | + |
| 84 | +// AttestPredicate builds an in‑toto Statement around the predicate and |
| 85 | +// returns the fully‑signed **DSSE envelope** (identical to cosign's |
| 86 | +// --no-upload output). Nothing is pushed to a registry or the TLog. |
| 87 | +func (a AttestOptions) AttestPredicate(ctx context.Context) ([]byte, error) { |
| 88 | + //-------------------------------------------------------------------- 2. read predicate |
| 89 | + predFile, err := a.Signer.FS.Open(a.PredicatePath) |
| 90 | + if err != nil { |
| 91 | + return nil, fmt.Errorf("open predicate: %w", err) |
| 92 | + } |
| 93 | + defer predFile.Close() |
| 94 | + |
| 95 | + //-------------------------------------------------------------------- 3. make the in‑toto statement |
| 96 | + stmt, err := att.GenerateStatement(att.GenerateOpts{ |
| 97 | + Predicate: predFile, |
| 98 | + Type: a.PredicateType, |
| 99 | + Digest: strings.TrimPrefix(a.ImageDigest, "sha256:"), |
| 100 | + Repo: a.Repo, |
| 101 | + Time: time.Now, // keeps tests deterministic |
| 102 | + }) |
| 103 | + if err != nil { |
| 104 | + return nil, fmt.Errorf("wrap predicate: %w", err) |
| 105 | + } |
| 106 | + payload, _ := json.Marshal(stmt) // canonicalised by dsse later |
| 107 | + |
| 108 | + //-------------------------------------------------------------------- 4. sign -> DSSE envelope |
| 109 | + env, err := a.Signer.WrapSigner.SignMessage(bytes.NewReader(payload), sigopts.WithContext(ctx)) |
| 110 | + if err != nil { |
| 111 | + return nil, fmt.Errorf("sign statement: %w", err) |
| 112 | + } |
| 113 | + return env, nil // byte‑slice containing the JSON DSSE envelope |
| 114 | +} |
| 115 | + |
| 116 | +// WriteEnvelope is an optional convenience that mirrors cosign's |
| 117 | +// --output‑signature flag; it emits <predicate>.intoto.jsonl next to the file. |
| 118 | +func (a AttestOptions) WriteEnvelope(data []byte) (string, error) { |
| 119 | + out := a.PredicatePath + ".intoto.jsonl" |
| 120 | + if err := afero.WriteFile(a.Signer.FS, out, data, 0o644); err != nil { |
| 121 | + return "", err |
| 122 | + } |
| 123 | + abs, err := filepath.Abs(out) |
| 124 | + if err != nil { |
| 125 | + return "", err |
| 126 | + } |
| 127 | + return abs, nil |
| 128 | +} |
0 commit comments