Skip to content

Commit 5d580dc

Browse files
wolfvwolfv
committed
more cleanup of functions
1 parent caebc6e commit 5d580dc

File tree

20 files changed

+59
-101
lines changed

20 files changed

+59
-101
lines changed

‎Cargo.lock‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎crates/sigstore-conformance/src/main.rs‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ use sigstore_fulcio::FulcioClient;
1111
use sigstore_oidc::parse_identity_token;
1212
use sigstore_rekor::RekorClient;
1313
use sigstore_trust_root::TrustedRoot;
14-
use sigstore_types::{Bundle, MediaType, Sha256Hash, SignatureContent};
14+
use sigstore_types::{Bundle, MediaType, SignatureContent};
1515
use sigstore_verify::{verify, VerificationPolicy};
1616

1717
use std::env;
@@ -243,11 +243,10 @@ async fn sign_bundle(args: &[String]) -> Result<(), Box<dyn std::error::Error>>
243243
let signature_b64 = base64::engine::general_purpose::STANDARD.encode(signature.as_bytes());
244244

245245
// Compute artifact hash using sigstore-crypto
246-
let hash_bytes = sigstore_crypto::sha256(&artifact_data);
247-
let artifact_hash_typed = Sha256Hash::from_bytes(hash_bytes);
246+
let artifact_hash = sigstore_crypto::sha256(&artifact_data);
248247

249248
// For v2, we still need hex for now
250-
let artifact_hash_hex = hex::encode(hash_bytes);
249+
let artifact_hash_hex = artifact_hash.to_hex();
251250

252251
// Upload to Rekor
253252
let rekor = RekorClient::new(&rekor_url);
@@ -261,7 +260,7 @@ async fn sign_bundle(args: &[String]) -> Result<(), Box<dyn std::error::Error>>
261260
rekor.create_entry_v2(hashed_rekord).await?
262261
} else {
263262
let hashed_rekord =
264-
sigstore_rekor::HashedRekord::new(&artifact_hash_typed, &signature, &public_key_pem);
263+
sigstore_rekor::HashedRekord::new(&artifact_hash, &signature, &public_key_pem);
265264
rekor.create_entry(hashed_rekord).await?
266265
};
267266

‎crates/sigstore-crypto/src/checkpoint.rs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ pub use sigstore_types::{Checkpoint, CheckpointSignature};
1313
/// The key hint is the first 4 bytes of SHA-256(public key).
1414
pub fn compute_key_hint(public_key_der: &[u8]) -> [u8; 4] {
1515
let hash = crate::hash::sha256(public_key_der);
16-
[hash[0], hash[1], hash[2], hash[3]]
16+
let bytes = hash.as_bytes();
17+
[bytes[0], bytes[1], bytes[2], bytes[3]]
1718
}
1819

1920
// OID constants for key type identification

‎crates/sigstore-crypto/src/encoding.rs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,8 @@ impl KeyHint {
225225
/// Compute key hint from a public key (first 4 bytes of SHA-256)
226226
pub fn from_public_key(public_key_der: &[u8]) -> Self {
227227
let hash = crate::hash::sha256(public_key_der);
228-
Self([hash[0], hash[1], hash[2], hash[3]])
228+
let bytes = hash.as_bytes();
229+
Self([bytes[0], bytes[1], bytes[2], bytes[3]])
229230
}
230231

231232
/// Get the underlying bytes

‎crates/sigstore-crypto/src/hash.rs‎

Lines changed: 10 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,14 @@
11
//! Hashing utilities using aws-lc-rs
22

3-
use aws_lc_rs::digest::{self, Context, SHA256, SHA384, SHA512};
3+
use aws_lc_rs::digest::{self, Context, SHA256};
4+
use sigstore_types::Sha256Hash;
45

5-
/// Hash data using SHA-256
6-
pub fn sha256(data: &[u8]) -> [u8; 32] {
6+
/// Hash data using SHA-256, returning a typed hash
7+
pub fn sha256(data: &[u8]) -> Sha256Hash {
78
let digest = digest::digest(&SHA256, data);
89
let mut result = [0u8; 32];
910
result.copy_from_slice(digest.as_ref());
10-
result
11-
}
12-
13-
/// Hash data using SHA-384
14-
pub fn sha384(data: &[u8]) -> [u8; 48] {
15-
let digest = digest::digest(&SHA384, data);
16-
let mut result = [0u8; 48];
17-
result.copy_from_slice(digest.as_ref());
18-
result
19-
}
20-
21-
/// Hash data using SHA-512
22-
pub fn sha512(data: &[u8]) -> [u8; 64] {
23-
// TODO: should we use aws-lc-rs DIGEST?
24-
let digest = digest::digest(&SHA512, data);
25-
let mut result = [0u8; 64];
26-
result.copy_from_slice(digest.as_ref());
27-
result
11+
Sha256Hash::from_bytes(result)
2812
}
2913

3014
/// Incremental SHA-256 hasher
@@ -45,12 +29,12 @@ impl Sha256Hasher {
4529
self.context.update(data);
4630
}
4731

48-
/// Finalize and get the digest
49-
pub fn finalize(self) -> [u8; 32] {
32+
/// Finalize and get the digest as a typed hash
33+
pub fn finalize(self) -> Sha256Hash {
5034
let digest = self.context.finish();
5135
let mut result = [0u8; 32];
5236
result.copy_from_slice(digest.as_ref());
53-
result
37+
Sha256Hash::from_bytes(result)
5438
}
5539
}
5640

@@ -67,13 +51,13 @@ mod tests {
6751
#[test]
6852
fn test_sha256() {
6953
let hash = sha256(b"hello");
70-
assert_eq!(hash.len(), 32);
54+
assert_eq!(hash.as_bytes().len(), 32);
7155

7256
// Known SHA-256 hash of "hello"
7357
let expected =
7458
hex::decode("2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824")
7559
.unwrap();
76-
assert_eq!(&hash[..], &expected[..]);
60+
assert_eq!(hash.as_bytes(), expected.as_slice());
7761
}
7862

7963
#[test]

‎crates/sigstore-crypto/src/keyring.rs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ mod tests {
7373
fn test_keyring_add_and_get() {
7474
let mut keyring = Keyring::new();
7575
let kp = KeyPair::generate_ed25519().unwrap();
76-
let key_id = sha256(kp.public_key_bytes()).to_vec();
76+
let key_id = sha256(kp.public_key_bytes()).as_bytes().to_vec();
7777
let vk = VerificationKey::new(kp.public_key_bytes().to_vec(), SigningScheme::Ed25519);
7878

7979
keyring.add_key(key_id.clone(), vk);
@@ -85,7 +85,7 @@ mod tests {
8585
fn test_keyring_verify() {
8686
let mut keyring = Keyring::new();
8787
let kp = KeyPair::generate_ed25519().unwrap();
88-
let key_id = sha256(kp.public_key_bytes()).to_vec();
88+
let key_id = sha256(kp.public_key_bytes()).as_bytes().to_vec();
8989
let vk = VerificationKey::new(kp.public_key_bytes().to_vec(), SigningScheme::Ed25519);
9090

9191
keyring.add_key(key_id.clone(), vk);
@@ -105,14 +105,14 @@ mod tests {
105105
// Add multiple keys
106106
for _ in 0..3 {
107107
let kp = KeyPair::generate_ed25519().unwrap();
108-
let key_id = sha256(kp.public_key_bytes()).to_vec();
108+
let key_id = sha256(kp.public_key_bytes()).as_bytes().to_vec();
109109
let vk = VerificationKey::new(kp.public_key_bytes().to_vec(), SigningScheme::Ed25519);
110110
keyring.add_key(key_id, vk);
111111
}
112112

113113
// Sign with a new key and add it
114114
let kp = KeyPair::generate_ed25519().unwrap();
115-
let key_id = sha256(kp.public_key_bytes()).to_vec();
115+
let key_id = sha256(kp.public_key_bytes()).as_bytes().to_vec();
116116
let vk = VerificationKey::new(kp.public_key_bytes().to_vec(), SigningScheme::Ed25519);
117117
keyring.add_key(key_id.clone(), vk);
118118

‎crates/sigstore-crypto/src/lib.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ pub use checkpoint::{
1818
};
1919
pub use encoding::{CertificateDer, DerBytes, KeyHint, PublicKeySpki, SignatureBytes};
2020
pub use error::{Error, Result};
21-
pub use hash::{sha256, sha384, sha512, Sha256Hasher};
21+
pub use hash::{sha256, Sha256Hasher};
2222
pub use keyring::Keyring;
2323
pub use signing::{KeyPair, PublicKeyPem, Signature, SigningScheme};
2424
pub use verification::{verify_signature, verify_signature_prehashed, VerificationKey};

‎crates/sigstore-merkle/src/tree.rs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ pub fn hash_leaf(data: &[u8]) -> Sha256Hash {
2020
let mut hasher = Sha256Hasher::new();
2121
hasher.update(&[LEAF_HASH_PREFIX]);
2222
hasher.update(data);
23-
Sha256Hash::from_bytes(hasher.finalize())
23+
hasher.finalize()
2424
}
2525

2626
/// Hash two child nodes to create a parent node
@@ -31,7 +31,7 @@ pub fn hash_children(left: &Sha256Hash, right: &Sha256Hash) -> Sha256Hash {
3131
hasher.update(&[NODE_HASH_PREFIX]);
3232
hasher.update(left.as_bytes());
3333
hasher.update(right.as_bytes());
34-
Sha256Hash::from_bytes(hasher.finalize())
34+
hasher.finalize()
3535
}
3636

3737
/// Calculate the number of trailing zeros in a number (LSB)
@@ -64,9 +64,9 @@ mod tests {
6464
// Verify it's 32 bytes
6565
assert_eq!(hash.as_bytes().len(), 32);
6666

67-
// Verify it's different from raw SHA256
67+
// Verify it's different from raw SHA256 (leaf hash has a prefix)
6868
let raw_hash = sigstore_crypto::sha256(data);
69-
assert_ne!(hash.as_bytes(), &raw_hash);
69+
assert_ne!(hash, raw_hash);
7070
}
7171

7272
#[test]

‎crates/sigstore-merkle/tests/rfc6962_tests.rs‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,7 @@ fn try_decode_hash(s: &str) -> Option<Sha256Hash> {
5050
if let Ok(bytes) = base64::prelude::BASE64_STANDARD.decode(s) {
5151
if !bytes.is_empty() && bytes.len() != 32 {
5252
// Hash the short bytes to get a unique 32-byte placeholder
53-
let hash = sigstore_crypto::sha256(&bytes);
54-
return Some(Sha256Hash::from_bytes(hash));
53+
return Some(sigstore_crypto::sha256(&bytes));
5554
}
5655
}
5756
None
@@ -278,11 +277,7 @@ fn test_hash_leaf_format() {
278277
raw_data.extend_from_slice(data);
279278
let expected = sigstore_crypto::sha256(&raw_data);
280279

281-
assert_eq!(
282-
hash.as_bytes(),
283-
&expected,
284-
"hash_leaf should use 0x00 prefix"
285-
);
280+
assert_eq!(hash, expected, "hash_leaf should use 0x00 prefix");
286281
}
287282

288283
#[test]
@@ -296,9 +291,5 @@ fn test_hash_children_format() {
296291
raw_data.extend_from_slice(right.as_bytes());
297292
let expected = sigstore_crypto::sha256(&raw_data);
298293

299-
assert_eq!(
300-
hash.as_bytes(),
301-
&expected,
302-
"hash_children should use 0x01 prefix"
303-
);
294+
assert_eq!(hash, expected, "hash_children should use 0x01 prefix");
304295
}

‎crates/sigstore-sign/src/sign.rs‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ use sigstore_fulcio::FulcioClient;
1010
use sigstore_oidc::{parse_identity_token, IdentityToken};
1111
use sigstore_rekor::{HashedRekord, RekorClient};
1212
use sigstore_tsa::TimestampClient;
13-
use sigstore_types::{Bundle, MediaType, Sha256Hash};
13+
use sigstore_types::{Bundle, MediaType};
1414
use x509_cert::der::Decode;
1515
use x509_cert::ext::pkix::BasicConstraints;
1616
use x509_cert::Certificate;
@@ -267,8 +267,7 @@ impl Signer {
267267
key_pair: &KeyPair,
268268
) -> Result<(TlogEntryBuilder, PublicKeyPem)> {
269269
// Compute artifact hash
270-
let hash_bytes = sigstore_crypto::sha256(artifact);
271-
let artifact_hash = Sha256Hash::from_bytes(hash_bytes);
270+
let artifact_hash = sigstore_crypto::sha256(artifact);
272271

273272
// Export public key for Rekor
274273
let public_key_pem = key_pair

0 commit comments

Comments
 (0)