Skip to content

Commit 1a175b4

Browse files
loosebazookaloosebazooka
authored
Merge pull request #673 from sigstore/no-more-current
Remove current tlog/ca refs from trusted_root
2 parents 1ba6f8b + cf700f3 commit 1a175b4

22 files changed

+189
-442
lines changed

‎fuzzing/src/main/java/util/Tuf.java

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,14 @@
1717

1818
import com.code_intelligence.jazzer.api.FuzzedDataProvider;
1919
import com.google.common.hash.Hashing;
20-
import dev.sigstore.trustroot.CertificateAuthorities;
2120
import dev.sigstore.trustroot.CertificateAuthority;
22-
import dev.sigstore.trustroot.ImmutableCertificateAuthorities;
2321
import dev.sigstore.trustroot.ImmutableCertificateAuthority;
2422
import dev.sigstore.trustroot.ImmutableLogId;
2523
import dev.sigstore.trustroot.ImmutablePublicKey;
2624
import dev.sigstore.trustroot.ImmutableSubject;
2725
import dev.sigstore.trustroot.ImmutableTransparencyLog;
28-
import dev.sigstore.trustroot.ImmutableTransparencyLogs;
2926
import dev.sigstore.trustroot.ImmutableValidFor;
3027
import dev.sigstore.trustroot.TransparencyLog;
31-
import dev.sigstore.trustroot.TransparencyLogs;
3228
import java.io.ByteArrayInputStream;
3329
import java.net.URI;
3430
import java.security.cert.CertPath;
@@ -47,17 +43,17 @@ public final class Tuf {
4743
// ecdsa key size in bytes
4844
private static final int ECDSA_KEY_BYTES = 91;
4945

50-
public static TransparencyLogs transparencyLogsFrom(FuzzedDataProvider data) {
51-
return ImmutableTransparencyLogs.builder().addTransparencyLog(genTlog(data)).build();
46+
public static List<TransparencyLog> transparencyLogsFrom(FuzzedDataProvider data) {
47+
return List.of(genTlog(data));
5248
}
5349

54-
public static CertificateAuthorities certificateAuthoritiesFrom(FuzzedDataProvider data)
50+
public static List<CertificateAuthority> certificateAuthoritiesFrom(FuzzedDataProvider data)
5551
throws CertificateException {
56-
return ImmutableCertificateAuthorities.builder().addCertificateAuthority(genCA(data)).build();
52+
return List.of(genCA(data));
5753
}
5854

5955
private static CertPath genCertPath(FuzzedDataProvider data) throws CertificateException {
60-
List<Certificate> certList = new ArrayList<Certificate>();
56+
List<Certificate> certList = new ArrayList<>();
6157
CertificateFactory cf = CertificateFactory.getInstance("X.509");
6258
certList.add(
6359
cf.generateCertificate(new ByteArrayInputStream(data.consumeBytes(MAX_CERT_SIZE))));

‎sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java

Lines changed: 43 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import com.google.errorprone.annotations.CanIgnoreReturnValue;
2323
import com.google.errorprone.annotations.CheckReturnValue;
2424
import com.google.errorprone.annotations.concurrent.GuardedBy;
25+
import dev.sigstore.KeylessVerifier.Builder;
2526
import dev.sigstore.encryption.certificates.Certificates;
2627
import dev.sigstore.encryption.signers.Signer;
2728
import dev.sigstore.encryption.signers.Signers;
@@ -41,6 +42,7 @@
4142
import dev.sigstore.rekor.client.RekorVerifier;
4243
import dev.sigstore.tuf.SigstoreTufClient;
4344
import java.io.IOException;
45+
import java.net.URI;
4446
import java.nio.charset.StandardCharsets;
4547
import java.nio.file.Path;
4648
import java.security.InvalidAlgorithmParameterException;
@@ -132,15 +134,29 @@ public static Builder builder() {
132134
}
133135

134136
public static class Builder {
135-
private SigstoreTufClient sigstoreTufClient;
137+
private TrustedRootProvider trustedRootProvider;
136138
private OidcClients oidcClients;
137139
private List<OidcIdentity> oidcIdentities = Collections.emptyList();
138140
private Signer signer;
139141
private Duration minSigningCertificateLifetime = DEFAULT_MIN_SIGNING_CERTIFICATE_LIFETIME;
142+
private URI fulcioUri;
143+
private URI rekorUri;
140144

141145
@CanIgnoreReturnValue
142-
public Builder sigstoreTufClient(SigstoreTufClient sigstoreTufClient) {
143-
this.sigstoreTufClient = sigstoreTufClient;
146+
public Builder fulcioUrl(URI uri) {
147+
this.fulcioUri = uri;
148+
return this;
149+
}
150+
151+
@CanIgnoreReturnValue
152+
public Builder rekorUrl(URI uri) {
153+
this.rekorUri = uri;
154+
return this;
155+
}
156+
157+
@CanIgnoreReturnValue
158+
public Builder trustedRoot(Path trustedRoot) {
159+
trustedRootProvider = TrustedRootProvider.from(trustedRoot);
144160
return this;
145161
}
146162

@@ -152,7 +168,8 @@ public Builder oidcClients(OidcClients oidcClients) {
152168

153169
/**
154170
* An allow list OIDC identities to be used during signing. If the OidcClients are misconfigured
155-
* or pick up unexpected credentials, this should prevent signing from proceeding
171+
* or pick up unexpected credentials, this should prevent signing from proceeding. Cannot be
172+
* null but can be an empty list and will allow all identities.
156173
*/
157174
@CanIgnoreReturnValue
158175
public Builder allowedOidcIdentities(List<OidcIdentity> oidcIdentities) {
@@ -188,14 +205,17 @@ public Builder minSigningCertificateLifetime(Duration minSigningCertificateLifet
188205
public KeylessSigner build()
189206
throws CertificateException, IOException, NoSuchAlgorithmException, InvalidKeySpecException,
190207
InvalidKeyException, InvalidAlgorithmParameterException {
191-
Preconditions.checkNotNull(sigstoreTufClient, "sigstoreTufClient");
192-
sigstoreTufClient.update();
193-
var trustedRoot = sigstoreTufClient.getSigstoreTrustedRoot();
194-
var fulcioClient =
195-
FulcioClient.builder().setUri(trustedRoot.getCAs().current().getUri()).build();
208+
Preconditions.checkNotNull(trustedRootProvider);
209+
var trustedRoot = trustedRootProvider.get();
210+
Preconditions.checkNotNull(fulcioUri);
211+
Preconditions.checkNotNull(rekorUri);
212+
Preconditions.checkNotNull(oidcClients);
213+
Preconditions.checkNotNull(oidcIdentities);
214+
Preconditions.checkNotNull(signer);
215+
Preconditions.checkNotNull(minSigningCertificateLifetime);
216+
var fulcioClient = FulcioClient.builder().setUri(fulcioUri).build();
196217
var fulcioVerifier = FulcioVerifier.newFulcioVerifier(trustedRoot);
197-
var rekorClient =
198-
RekorClient.builder().setUri(trustedRoot.getTLogs().current().getBaseUrl()).build();
218+
var rekorClient = RekorClient.builder().setUri(rekorUri).build();
199219
var rekorVerifier = RekorVerifier.newRekorVerifier(trustedRoot);
200220
return new KeylessSigner(
201221
fulcioClient,
@@ -213,9 +233,12 @@ public KeylessSigner build()
213233
* ecdsa signing.
214234
*/
215235
@CanIgnoreReturnValue
216-
public Builder sigstorePublicDefaults() throws IOException, NoSuchAlgorithmException {
217-
sigstoreTufClient = SigstoreTufClient.builder().usePublicGoodInstance().build();
218-
oidcClients(OidcClients.DEFAULTS);
236+
public Builder sigstorePublicDefaults() {
237+
var sigstoreTufClientBuilder = SigstoreTufClient.builder().usePublicGoodInstance();
238+
trustedRootProvider = TrustedRootProvider.from(sigstoreTufClientBuilder);
239+
fulcioUri = FulcioClient.PUBLIC_GOOD_URI;
240+
rekorUri = RekorClient.PUBLIC_GOOD_URI;
241+
oidcClients(OidcClients.PUBLIC_GOOD);
219242
signer(Signers.newEcdsaSigner());
220243
minSigningCertificateLifetime(DEFAULT_MIN_SIGNING_CERTIFICATE_LIFETIME);
221244
return this;
@@ -226,9 +249,12 @@ public Builder sigstorePublicDefaults() throws IOException, NoSuchAlgorithmExcep
226249
* signing.
227250
*/
228251
@CanIgnoreReturnValue
229-
public Builder sigstoreStagingDefaults() throws IOException, NoSuchAlgorithmException {
230-
sigstoreTufClient = SigstoreTufClient.builder().useStagingInstance().build();
231-
oidcClients(OidcClients.STAGING_DEFAULTS);
252+
public Builder sigstoreStagingDefaults() {
253+
var sigstoreTufClientBuilder = SigstoreTufClient.builder().useStagingInstance();
254+
trustedRootProvider = TrustedRootProvider.from(sigstoreTufClientBuilder);
255+
fulcioUri = FulcioClient.STAGING_URI;
256+
rekorUri = RekorClient.STAGING_URI;
257+
oidcClients(OidcClients.STAGING);
232258
signer(Signers.newEcdsaSigner());
233259
minSigningCertificateLifetime(DEFAULT_MIN_SIGNING_CERTIFICATE_LIFETIME);
234260
return this;

‎sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -79,23 +79,23 @@ public KeylessVerifier build()
7979
var fulcioVerifier = FulcioVerifier.newFulcioVerifier(trustedRoot);
8080
var rekorVerifier = RekorVerifier.newRekorVerifier(trustedRoot);
8181
var rekorClients =
82-
trustedRoot.getTLogs().getTransparencyLogs().stream()
82+
trustedRoot.getTLogs().stream()
8383
.map(TransparencyLog::getBaseUrl)
8484
.distinct()
8585
.map(uri -> RekorClient.builder().setUri(uri).build())
8686
.collect(Collectors.toList());
8787
return new KeylessVerifier(fulcioVerifier, rekorClients, rekorVerifier);
8888
}
8989

90-
public Builder sigstorePublicDefaults() throws IOException {
91-
var sigstoreTufClient = SigstoreTufClient.builder().usePublicGoodInstance().build();
92-
trustedRootProvider = TrustedRootProvider.from(sigstoreTufClient);
90+
public Builder sigstorePublicDefaults() {
91+
var sigstoreTufClientBuilder = SigstoreTufClient.builder().usePublicGoodInstance();
92+
trustedRootProvider = TrustedRootProvider.from(sigstoreTufClientBuilder);
9393
return this;
9494
}
9595

96-
public Builder sigstoreStagingDefaults() throws IOException {
97-
var sigstoreTufClient = SigstoreTufClient.builder().useStagingInstance().build();
98-
trustedRootProvider = TrustedRootProvider.from(sigstoreTufClient);
96+
public Builder sigstoreStagingDefaults() {
97+
var sigstoreTufClientBuilder = SigstoreTufClient.builder().useStagingInstance();
98+
trustedRootProvider = TrustedRootProvider.from(sigstoreTufClientBuilder);
9999
return this;
100100
}
101101

@@ -220,7 +220,7 @@ private RekorEntry getEntryFromRekor(
220220
byte[] artifactDigest, X509Certificate leafCert, byte[] signature)
221221
throws KeylessVerificationException {
222222
// rebuild the hashedRekord so we can query the log for it
223-
HashedRekordRequest hashedRekordRequest = null;
223+
HashedRekordRequest hashedRekordRequest;
224224
try {
225225
hashedRekordRequest =
226226
HashedRekordRequest.newHashedRekordRequest(

‎sigstore-java/src/main/java/dev/sigstore/TrustedRootProvider.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,10 @@ SigstoreTrustedRoot get()
3737
throws InvalidAlgorithmParameterException, CertificateException, InvalidKeySpecException,
3838
NoSuchAlgorithmException, IOException, InvalidKeyException;
3939

40-
static TrustedRootProvider from(SigstoreTufClient tufClient) {
41-
Preconditions.checkNotNull(tufClient);
40+
static TrustedRootProvider from(SigstoreTufClient.Builder tufClientBuilder) {
41+
Preconditions.checkNotNull(tufClientBuilder);
4242
return () -> {
43+
var tufClient = tufClientBuilder.build();
4344
tufClient.update();
4445
return tufClient.getSigstoreTrustedRoot();
4546
};

‎sigstore-java/src/main/java/dev/sigstore/encryption/signers/Signers.java

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,24 @@
2222
public class Signers {
2323

2424
/** Create a new ECDSA signer with 256 bit keysize. */
25-
public static EcdsaSigner newEcdsaSigner() throws NoSuchAlgorithmException {
26-
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
27-
keyGen.initialize(256);
28-
return new EcdsaSigner(keyGen.generateKeyPair());
25+
public static EcdsaSigner newEcdsaSigner() {
26+
try {
27+
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
28+
keyGen.initialize(256);
29+
return new EcdsaSigner(keyGen.generateKeyPair());
30+
} catch (NoSuchAlgorithmException nse) {
31+
throw new RuntimeException("No EC algorithm found in Runtime", nse);
32+
}
2933
}
3034

3135
/** Create a new RSA signer with 2048 bit keysize. */
32-
public static RsaSigner newRsaSigner() throws NoSuchAlgorithmException {
33-
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
34-
keyGen.initialize(2048);
35-
return new RsaSigner(keyGen.generateKeyPair());
36+
public static RsaSigner newRsaSigner() {
37+
try {
38+
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
39+
keyGen.initialize(2048);
40+
return new RsaSigner(keyGen.generateKeyPair());
41+
} catch (NoSuchAlgorithmException nse) {
42+
throw new RuntimeException("No RSA algorithm found in Runtime", nse);
43+
}
3644
}
3745
}

‎sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClient.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@
4242
/** A client to communicate with a fulcio service instance over gRPC. */
4343
public class FulcioClient {
4444

45+
public static final URI PUBLIC_GOOD_URI = URI.create("https://fulcio.sigstore.dev");
46+
public static final URI STAGING_URI = URI.create("https://fulcio.sigstage.dev");
47+
4548
private final HttpParams httpParams;
4649
private final URI uri;
4750

@@ -55,7 +58,7 @@ private FulcioClient(HttpParams httpParams, URI uri) {
5558
}
5659

5760
public static class Builder {
58-
private URI uri = URI.create("https://fulcio.sigstore.dev");
61+
private URI uri = PUBLIC_GOOD_URI;
5962
private HttpParams httpParams = ImmutableHttpParams.builder().build();
6063

6164
private Builder() {}

‎sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioVerifier.java

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@
2020
import dev.sigstore.encryption.certificates.transparency.CTLogInfo;
2121
import dev.sigstore.encryption.certificates.transparency.CTVerificationResult;
2222
import dev.sigstore.encryption.certificates.transparency.CTVerifier;
23-
import dev.sigstore.trustroot.CertificateAuthorities;
23+
import dev.sigstore.trustroot.CertificateAuthority;
2424
import dev.sigstore.trustroot.SigstoreTrustedRoot;
25-
import dev.sigstore.trustroot.TransparencyLogs;
25+
import dev.sigstore.trustroot.TransparencyLog;
2626
import java.io.IOException;
2727
import java.security.InvalidAlgorithmParameterException;
2828
import java.security.NoSuchAlgorithmException;
@@ -46,8 +46,8 @@
4646

4747
/** Verifier for fulcio generated signing cerificates */
4848
public class FulcioVerifier {
49-
private final CertificateAuthorities cas;
50-
private final TransparencyLogs ctLogs;
49+
private final List<CertificateAuthority> cas;
50+
private final List<TransparencyLog> ctLogs;
5151
private final CTVerifier ctVerifier;
5252

5353
public static FulcioVerifier newFulcioVerifier(SigstoreTrustedRoot trustRoot)
@@ -57,11 +57,11 @@ public static FulcioVerifier newFulcioVerifier(SigstoreTrustedRoot trustRoot)
5757
}
5858

5959
public static FulcioVerifier newFulcioVerifier(
60-
CertificateAuthorities cas, TransparencyLogs ctLogs)
60+
List<CertificateAuthority> cas, List<TransparencyLog> ctLogs)
6161
throws InvalidKeySpecException, NoSuchAlgorithmException, InvalidAlgorithmParameterException,
6262
CertificateException {
6363
List<CTLogInfo> logs = new ArrayList<>();
64-
for (var ctLog : ctLogs.all()) {
64+
for (var ctLog : ctLogs) {
6565
logs.add(
6666
new CTLogInfo(
6767
ctLog.getPublicKey().toJavaPublicKey(), "CT Log", ctLog.getBaseUrl().toString()));
@@ -75,15 +75,15 @@ public static FulcioVerifier newFulcioVerifier(
7575
.orElse(null));
7676

7777
// check to see if we can use all fulcio roots (this is a bit eager)
78-
for (var ca : cas.all()) {
78+
for (var ca : cas) {
7979
ca.asTrustAnchor();
8080
}
8181

8282
return new FulcioVerifier(cas, ctLogs, verifier);
8383
}
8484

8585
private FulcioVerifier(
86-
CertificateAuthorities cas, TransparencyLogs ctLogs, CTVerifier ctVerifier) {
86+
List<CertificateAuthority> cas, List<TransparencyLog> ctLogs, CTVerifier ctVerifier) {
8787
this.cas = cas;
8888
this.ctLogs = ctLogs;
8989
this.ctVerifier = ctVerifier;
@@ -122,7 +122,7 @@ private void verifyEmbeddedScts(CertPath certPath) throws FulcioVerificationExce
122122
var logId = sct.getLogID();
123123
var entryTime = Instant.ofEpochMilli(sct.getTimestamp());
124124

125-
var ctLog = ctLogs.find(logId, entryTime);
125+
var ctLog = TransparencyLog.find(ctLogs, logId, entryTime);
126126
if (ctLog.isPresent()) {
127127
// TODO: currently we only require one valid SCT, but maybe this should be configurable?
128128
// found at least one valid sct with a matching valid log
@@ -178,7 +178,7 @@ CertPath validateCertPath(CertPath signingCertificate) throws FulcioVerification
178178
}
179179

180180
var leaf = Certificates.getLeaf(signingCertificate);
181-
var validCAs = cas.find(leaf.getNotBefore().toInstant());
181+
var validCAs = CertificateAuthority.find(cas, leaf.getNotBefore().toInstant());
182182

183183
if (validCAs.size() == 0) {
184184
throw new FulcioVerificationException(

‎sigstore-java/src/main/java/dev/sigstore/oidc/client/OidcClients.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,10 @@
2020
/** An ordered list of oidc clients to use when looking for credentials. */
2121
public class OidcClients {
2222

23-
public static final OidcClients DEFAULTS =
23+
public static final OidcClients PUBLIC_GOOD =
2424
of(GithubActionsOidcClient.builder().build(), WebOidcClient.builder().build());
2525

26-
public static final OidcClients STAGING_DEFAULTS =
26+
public static final OidcClients STAGING =
2727
of(
2828
GithubActionsOidcClient.builder().build(),
2929
WebOidcClient.builder().setIssuer(WebOidcClient.STAGING_DEX_ISSUER).build());

‎sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorClient.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535

3636
/** A client to communicate with a rekor service instance. */
3737
public class RekorClient {
38+
public static final URI PUBLIC_GOOD_URI = URI.create("https://rekor.sigstore.dev");
39+
public static final URI STAGING_URI = URI.create("https://rekor.sigstage.dev");
40+
3841
public static final String REKOR_ENTRIES_PATH = "/api/v1/log/entries";
3942
public static final String REKOR_INDEX_SEARCH_PATH = "/api/v1/index/retrieve";
4043

@@ -52,7 +55,7 @@ private RekorClient(HttpParams httpParams, URI uri) {
5255

5356
public static class Builder {
5457
private HttpParams httpParams = ImmutableHttpParams.builder().build();
55-
private URI uri = URI.create("https://rekor.sigstore.dev");
58+
private URI uri = PUBLIC_GOOD_URI;
5659

5760
private Builder() {}
5861

0 commit comments

Comments
 (0)