Skip to content

Commit 96da052

Browse files
williamlin-susewilliamlin-suse
authored
Merge pull request #25 from alopez-suse/main
NVSHAS-9078: fix online tlog verification failure
2 parents eb13467 + 578cac2 commit 96da052

File tree

10 files changed

+309
-13
lines changed

10 files changed

+309
-13
lines changed

‎Makefile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,6 @@ binary:
1010
@echo "Making $@ ..."
1111
@docker pull neuvector/build_fleet:${BUILD_IMAGE_TAG}
1212
@docker run --rm -ia STDOUT --name build --net=none -v $(CURDIR):/go/src/github.com/neuvector/sigstore-interface -w /go/src/github.com/neuvector/sigstore-interface --entrypoint ./make_bin.sh neuvector/build_fleet:${BUILD_IMAGE_TAG}
13+
14+
test:
15+
go build -ldflags='-s -w' -buildvcs=false . && bash ./integration-test.sh

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ toolchain go1.22.5
77
require (
88
github.com/google/go-containerregistry v0.19.1
99
github.com/sigstore/cosign/v2 v2.2.4
10+
github.com/sigstore/rekor v1.3.6
1011
github.com/sigstore/sigstore v1.8.3
1112
github.com/theupdateframework/go-tuf v0.7.0
1213
)
@@ -82,7 +83,6 @@ require (
8283
github.com/sassoftware/relic v7.2.1+incompatible // indirect
8384
github.com/secure-systems-lab/go-securesystemslib v0.8.0 // indirect
8485
github.com/shibumi/go-pathspec v1.3.0 // indirect
85-
github.com/sigstore/rekor v1.3.6 // indirect
8686
github.com/sigstore/timestamp-authority v1.2.2 // indirect
8787
github.com/sirupsen/logrus v1.9.3 // indirect
8888
github.com/sourcegraph/conc v0.3.0 // indirect

‎integration-test.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
echo "#############################"
2+
echo "testing rootless keypair only"
3+
echo "#############################"
4+
./sigstore-interface --config-file testing/cases/rootless-keypair-only.json
5+
echo ""
6+
7+
echo "#############################"
8+
echo "testing public keypair"
9+
echo "#############################"
10+
./sigstore-interface --config-file testing/cases/public-keypair.json
11+
echo ""
12+
13+
echo "#############################"
14+
echo "testing suse app collection"
15+
echo "#############################"
16+
./sigstore-interface --config-file testing/cases/suse-app-collection.json

‎main.go‎

Lines changed: 38 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,13 @@ import (
1919
"github.com/sigstore/cosign/v2/pkg/oci"
2020
"github.com/sigstore/cosign/v2/pkg/oci/signature"
2121
sig "github.com/sigstore/cosign/v2/pkg/signature"
22+
rekor "github.com/sigstore/rekor/pkg/client"
2223
"github.com/sigstore/sigstore/pkg/cryptoutils"
2324
sigtuf "github.com/sigstore/sigstore/pkg/tuf"
2425
)
2526

27+
const DEFAULT_REKOR_URL string = "https://rekor.sigstore.dev"
28+
2629
type Configuration struct {
2730
ImageDigest string `json:"ImageDigest"`
2831
RootsOfTrust []RootOfTrust `json:"RootsOfTrust"`
@@ -159,6 +162,10 @@ func generateCosignSignatureObjects(sigData SignatureData) ([]oci.Signature, err
159162
return signatures, nil
160163
}
161164

165+
func printWarningLine(message string) {
166+
fmt.Printf("\033[33m%s\033[0m\n", message)
167+
}
168+
162169
func verify(imgDigest v1.Hash, rootOfTrust RootOfTrust, sigs []oci.Signature, proxy Proxy) (satisfiedVerifiers []string, err error) {
163170
ctx := context.Background()
164171
cosignOptions := cosign.CheckOpts{ClaimVerifier: cosign.SimpleClaimVerifier}
@@ -169,22 +176,35 @@ func verify(imgDigest v1.Hash, rootOfTrust RootOfTrust, sigs []oci.Signature, pr
169176
for _, verifier := range rootOfTrust.Verifiers {
170177
cosignOptions.SigVerifier = nil
171178
cosignOptions.Identities = nil
179+
172180
fmt.Printf(">> checking verifier %s\n", verifier.Name)
173181
err = setVerifierCosignOptions(&cosignOptions, verifier, rootOfTrust, ctx)
174182
if err != nil {
175183
fmt.Printf("ERROR: %s\n", err.Error())
176-
} else {
177-
for i, signature := range sigs {
178-
fmt.Printf("verifying signature %d\n", i)
179-
_, err := cosign.VerifyImageSignature(ctx, signature, imgDigest, &cosignOptions)
180-
if err != nil {
181-
// the image is not signed by this verifier
182-
fmt.Printf("signature not verified: %s\n", err.Error())
183-
} else {
184-
fmt.Printf("signature %d satisfies verifier %s\n", i, verifier.Name)
185-
satisfiedVerifiers = append(satisfiedVerifiers, fmt.Sprintf("%s/%s", rootOfTrust.Name, verifier.Name))
186-
break
187-
}
184+
fmt.Println("could not create valid cosign options for verifier, skipping verifier")
185+
continue
186+
}
187+
188+
for i, signature := range sigs {
189+
bundle, err := signature.Bundle()
190+
if err != nil {
191+
fmt.Printf("error when retrieving bundle for signature, skipping signature: %s\n", err.Error())
192+
continue
193+
}
194+
if bundle == nil {
195+
printWarningLine("no bundle found, any tlog verification must happen through network")
196+
} else {
197+
fmt.Printf("signature bundle: %s\n", bundle.Payload.LogID)
198+
}
199+
fmt.Printf("verifying signature %d\n", i)
200+
_, err = cosign.VerifyImageSignature(ctx, signature, imgDigest, &cosignOptions)
201+
if err != nil {
202+
// the image is not signed by this verifier
203+
fmt.Printf("signature not verified: %s\n", err.Error())
204+
} else {
205+
fmt.Printf("signature %d satisfies verifier %s\n", i, verifier.Name)
206+
satisfiedVerifiers = append(satisfiedVerifiers, fmt.Sprintf("%s/%s", rootOfTrust.Name, verifier.Name))
207+
break
188208
}
189209
}
190210
}
@@ -319,6 +339,12 @@ func setVerifierCosignOptions(cosignOptions *cosign.CheckOpts, verifier Verifier
319339
if rootOfTrust.SCTPublicKey == "" {
320340
cosignOptions.IgnoreSCT = true
321341
}
342+
} else {
343+
rekorClient, err := rekor.GetRekorClient(DEFAULT_REKOR_URL)
344+
if err != nil {
345+
return fmt.Errorf("could not get rekor client for online tlog validation: %s", err.Error())
346+
}
347+
cosignOptions.RekorClient = rekorClient
322348
}
323349
if rootOfTrust.RootlessKeypairsOnly {
324350
cosignOptions.IgnoreSCT = true

‎testing/cases/public-keypair.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"ImageDigest": "sha256:c2ced31c5dda37cb805f481e3fa34b742cc8980f439b20af3111b08e66cff8e1",
3+
"RootsOfTrust": [
4+
{
5+
"Name": "public-root-of-trust",
6+
"RootlessKeypairsOnly": false,
7+
"Verifiers": [
8+
{
9+
"Name": "esther-keypair",
10+
"Type": "keypair",
11+
"KeyPairOptions": {
12+
"PublicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbAOAuM6OwpU/buX7td4VvyKUGyI6\nwXPSUQjeQwc2wzr4wNveeQ4LbZbtH8bAohoOwfgeHUiVFwpgGIB6d+J3hw==\n-----END PUBLIC KEY-----"
13+
},
14+
"KeylessOptions": {
15+
"CertIssuer": "",
16+
"CertSubject": ""
17+
}
18+
}
19+
]
20+
}
21+
],
22+
"SignatureData": {
23+
"Manifest": "{\"schemaVersion\":2,\"mediaType\":\"application/vnd.oci.image.manifest.v1+json\",\"config\":{\"mediaType\":\"application/vnd.oci.image.config.v1+json\",\"size\":243,\"digest\":\"sha256:ff9575f3be16905499996bc3f8045d86ce9d9f8aabdd192c47eb3824f7df30da\"},\"layers\":[{\"mediaType\":\"application/vnd.dev.cosign.simplesigning.v1+json\",\"size\":243,\"digest\":\"sha256:19cf962d284f30ff6d6b5744e61f8f200311c35aac53e5f50019aea690582e4b\",\"annotations\":{\"dev.cosignproject.cosign/signature\":\"MEYCIQCz8Hg3Ad/d5Pe5/I+jWlgIpKsRyY8YKvwiuqYPrQK2DgIhAMe/lJN08Ylieb22rJ9D7LEP5QJHruAX6GGgQ+RZyi5N\",\"dev.sigstore.cosign/bundle\":\"{\\\"SignedEntryTimestamp\\\":\\\"MEUCIHol8ZGEFFDNSIDL36wuBwOwRmqzLMcUxHVDbFB0jkW7AiEAsI1nquIgcg6/jvDOt2Tj6dMJdvIR4/dgyrUgG3VgNd0=\\\",\\\"Payload\\\":{\\\"body\\\":\\\"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIxOWNmOTYyZDI4NGYzMGZmNmQ2YjU3NDRlNjFmOGYyMDAzMTFjMzVhYWM1M2U1ZjUwMDE5YWVhNjkwNTgyZTRiIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUN6OEhnM0FkL2Q1UGU1L0kraldsZ0lwS3NSeVk4WUt2d2l1cVlQclFLMkRnSWhBTWUvbEpOMDhZbGllYjIycko5RDdMRVA1UUpIcnVBWDZHR2dRK1JaeWk1TiIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCUVZVSk1TVU1nUzBWWkxTMHRMUzBLVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEplbW93UkVGUlkwUlJaMEZGWWtGUFFYVk5OazkzY0ZVdlluVllOM1JrTkZaMmVVdFZSM2xKTmdwM1dGQlRWVkZxWlZGM1l6SjNlbkkwZDA1MlpXVlJORXhpV21KMFNEaGlRVzlvYjA5M1ptZGxTRlZwVmtaM2NHZEhTVUkyWkN0S00yaDNQVDBLTFMwdExTMUZUa1FnVUZWQ1RFbERJRXRGV1MwdExTMHRDZz09In19fX0=\\\",\\\"integratedTime\\\":1685639122,\\\"logIndex\\\":22394206,\\\"logID\\\":\\\"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d\\\"}}\"}}]}",
24+
"Payloads": {
25+
"sha256:19cf962d284f30ff6d6b5744e61f8f200311c35aac53e5f50019aea690582e4b": "{\"critical\":{\"identity\":{\"docker-reference\":\"quay.io/nvlab/cosign-esther\"},\"image\":{\"docker-manifest-digest\":\"sha256:c2ced31c5dda37cb805f481e3fa34b742cc8980f439b20af3111b08e66cff8e1\"},\"type\":\"cosign container image signature\"},\"optional\":null}"
26+
}
27+
}
28+
}

‎testing/cases/rootless-keypair-only.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"ImageDigest": "sha256:c2ced31c5dda37cb805f481e3fa34b742cc8980f439b20af3111b08e66cff8e1",
3+
"RootsOfTrust": [
4+
{
5+
"Name": "public-root-of-trust",
6+
"RootlessKeypairsOnly": true,
7+
"Verifiers": [
8+
{
9+
"Name": "esther-keypair",
10+
"Type": "keypair",
11+
"KeyPairOptions": {
12+
"PublicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbAOAuM6OwpU/buX7td4VvyKUGyI6\nwXPSUQjeQwc2wzr4wNveeQ4LbZbtH8bAohoOwfgeHUiVFwpgGIB6d+J3hw==\n-----END PUBLIC KEY-----"
13+
},
14+
"KeylessOptions": {
15+
"CertIssuer": "",
16+
"CertSubject": ""
17+
}
18+
}
19+
]
20+
}
21+
],
22+
"SignatureData": {
23+
"Manifest": "{\"schemaVersion\":2,\"mediaType\":\"application/vnd.oci.image.manifest.v1+json\",\"config\":{\"mediaType\":\"application/vnd.oci.image.config.v1+json\",\"size\":243,\"digest\":\"sha256:ff9575f3be16905499996bc3f8045d86ce9d9f8aabdd192c47eb3824f7df30da\"},\"layers\":[{\"mediaType\":\"application/vnd.dev.cosign.simplesigning.v1+json\",\"size\":243,\"digest\":\"sha256:19cf962d284f30ff6d6b5744e61f8f200311c35aac53e5f50019aea690582e4b\",\"annotations\":{\"dev.cosignproject.cosign/signature\":\"MEYCIQCz8Hg3Ad/d5Pe5/I+jWlgIpKsRyY8YKvwiuqYPrQK2DgIhAMe/lJN08Ylieb22rJ9D7LEP5QJHruAX6GGgQ+RZyi5N\",\"dev.sigstore.cosign/bundle\":\"{\\\"SignedEntryTimestamp\\\":\\\"MEUCIHol8ZGEFFDNSIDL36wuBwOwRmqzLMcUxHVDbFB0jkW7AiEAsI1nquIgcg6/jvDOt2Tj6dMJdvIR4/dgyrUgG3VgNd0=\\\",\\\"Payload\\\":{\\\"body\\\":\\\"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIxOWNmOTYyZDI4NGYzMGZmNmQ2YjU3NDRlNjFmOGYyMDAzMTFjMzVhYWM1M2U1ZjUwMDE5YWVhNjkwNTgyZTRiIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUN6OEhnM0FkL2Q1UGU1L0kraldsZ0lwS3NSeVk4WUt2d2l1cVlQclFLMkRnSWhBTWUvbEpOMDhZbGllYjIycko5RDdMRVA1UUpIcnVBWDZHR2dRK1JaeWk1TiIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCUVZVSk1TVU1nUzBWWkxTMHRMUzBLVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEplbW93UkVGUlkwUlJaMEZGWWtGUFFYVk5OazkzY0ZVdlluVllOM1JrTkZaMmVVdFZSM2xKTmdwM1dGQlRWVkZxWlZGM1l6SjNlbkkwZDA1MlpXVlJORXhpV21KMFNEaGlRVzlvYjA5M1ptZGxTRlZwVmtaM2NHZEhTVUkyWkN0S00yaDNQVDBLTFMwdExTMUZUa1FnVUZWQ1RFbERJRXRGV1MwdExTMHRDZz09In19fX0=\\\",\\\"integratedTime\\\":1685639122,\\\"logIndex\\\":22394206,\\\"logID\\\":\\\"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d\\\"}}\"}}]}",
24+
"Payloads": {
25+
"sha256:19cf962d284f30ff6d6b5744e61f8f200311c35aac53e5f50019aea690582e4b": "{\"critical\":{\"identity\":{\"docker-reference\":\"quay.io/nvlab/cosign-esther\"},\"image\":{\"docker-manifest-digest\":\"sha256:c2ced31c5dda37cb805f481e3fa34b742cc8980f439b20af3111b08e66cff8e1\"},\"type\":\"cosign container image signature\"},\"optional\":null}"
26+
}
27+
}
28+
}

‎testing/cases/suse-app-collection.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"ImageDigest": "sha256:30e637c70f75c9f22ee0f2b4d0c3471ad3ed2f153f994ec5fe1031ab27d4282c",
3+
"RootsOfTrust": [
4+
{
5+
"Name": "public-root",
6+
"Verifiers": [
7+
{
8+
"Name": "suse-app-collection-key",
9+
"Type": "keypair",
10+
"KeypairOptions": {
11+
"PublicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA02FtEt5gBywiyxbmkVsb\nCujcBg5lur0kpEbfDk10gCcs9shVEqEO3ZsOXHursgoaDAWqdPtsYhsgczGeJz9w\nAw+r6BuRV8YOkE37A8s/7IOQUW0tlqtnt11OKhIiZ9+e5l3ed2H1ymKQO3dgreSy\nrShqYdA3hrItswyp41ApF6zhjSPlR6lAmq3X4wMYLAPptmzfxigTnR4hxB5UNPhs\ni2qA4vLrUM/i+NohECuLr1EAymvupH26HLEdM+eZnlQn+WbhIP5Grc4ba7XrBv7K\nkywgTC7CxkiJZR0mUcUD2wTX/Je8Ewj6oPSalx09e2jtzvmU5Kr9XUyMF7Zsj5CA\nIwIDAQAB\n-----END PUBLIC KEY-----"
12+
},
13+
"KeylessOptions": {}
14+
}
15+
]
16+
}
17+
],
18+
"SignatureData": {
19+
"Manifest": "{\"schemaVersion\":2,\"mediaType\":\"application/vnd.oci.image.manifest.v1+json\",\"config\":{\"mediaType\":\"application/vnd.oci.image.config.v1+json\",\"size\":233,\"digest\":\"sha256:d68903a35c7e4df921427de185d2fb6238c26fbe98e87151b3245900732ba626\"},\"layers\":[{\"mediaType\":\"application/vnd.dev.cosign.simplesigning.v1+json\",\"size\":266,\"digest\":\"sha256:f29eb2be43ee8b54274fcf03e548e3029e96c3babaad27dcdd39a7e13ff82ddb\",\"annotations\":{\"dev.cosignproject.cosign/signature\":\"gj5seEtnOF6Ct4aBkHT/axoiG5rvcJ1zcUv06pnwWCELpRpg7Tp8PFfSP5wjCfO24B1joWpljU16vFKgebYO/yumcNYGy4z7b8tls46QG9dEmMDgwg/bhYk6/r9avVqpdTvcsyEWyR6ewcT9Pk6E3c3BKUytlz14utwFK3rULvZRX+3MrNYH0DL7Kmc3x/FYAzzrz4ewjOAHF1lc77nxgn2u22lWo+h+9a68AquLhuyV+MUP4PD5uNP+ty+NZTa4zdwgVohNk5gEzD/ZugKVonRRMH0ACniQdm/x5A2oMF0Nw0kBBsiOwhIElLlQGpfW6joarqEZB2wSAhJbhe+rsQ==\",\"org.open-build-service.cosign.cookie\":\"a5e6be82775da3e0f4ea85e70fd6024a7d03ecee62536e0ecb179a40ae750b31\"}}]}",
20+
"Payloads": {
21+
"sha256:f29eb2be43ee8b54274fcf03e548e3029e96c3babaad27dcdd39a7e13ff82ddb": "{\"critical\":{\"identity\":{\"docker-reference\":\"dp.apps.rancher.io/containers/openjdk\"},\"image\":{\"docker-manifest-digest\":\"sha256:30e637c70f75c9f22ee0f2b4d0c3471ad3ed2f153f994ec5fe1031ab27d4282c\"},\"type\":\"cosign container image signature\"},\"optional\":{\"creator\":\"OBS\"}}"
22+
}
23+
}
24+
}

‎vendor/github.com/sigstore/rekor/pkg/client/options.go‎

Lines changed: 104 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/sigstore/rekor/pkg/client/rekor_client.go‎

Lines changed: 66 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/modules.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -364,6 +364,7 @@ github.com/sigstore/cosign/v2/pkg/signature
364364
github.com/sigstore/cosign/v2/pkg/types
365365
# github.com/sigstore/rekor v1.3.6
366366
## explicit; go 1.21
367+
github.com/sigstore/rekor/pkg/client
367368
github.com/sigstore/rekor/pkg/generated/client
368369
github.com/sigstore/rekor/pkg/generated/client/entries
369370
github.com/sigstore/rekor/pkg/generated/client/index

0 commit comments

Comments
 (0)