Skip to content

Commit e59faee

Browse files
cmurphycmurphy
committed
Upgrade to TUF v2 client
Swap the use of the go-tuf v0.7.0 client from sigstore/sigstore to the v2.0.0 client from sigstore/sigstore-go. Sigstore-go provides a way to check for a trusted root and automatically use it if available, but can also fetch individual targets as needed if the provided TUF mirror does not supply a trusted_root.json. This change is intended to be backwards compatible and transparent. TODO: - e2e tests - deprecate `cosign initialize` Signed-off-by: Colleen Murphy <[email protected]>
1 parent 182f64b commit e59faee

File tree

19 files changed

+401
-207
lines changed

19 files changed

+401
-207
lines changed

‎cmd/cosign/cli/fulcio/fulcioverifier/fulcioverifier.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ func NewSigner(ctx context.Context, ko options.KeyOpts, signer signature.SignerV
3333
}
3434

3535
// Grab the PublicKeys for the CTFE, either from tuf or env.
36-
pubKeys, err := cosign.GetCTLogPubs(ctx)
36+
pubKeys, err := cosign.GetCTLogPubs()
3737
if err != nil {
3838
return nil, fmt.Errorf("getting CTFE public keys: %w", err)
3939
}

‎cmd/cosign/cli/sign/sign.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -505,7 +505,7 @@ func signerFromKeyRef(ctx context.Context, certPath, certChainPath, keyRef strin
505505
return nil, err
506506
}
507507
if contains {
508-
pubKeys, err := cosign.GetCTLogPubs(ctx)
508+
pubKeys, err := cosign.GetCTLogPubs()
509509
if err != nil {
510510
return nil, fmt.Errorf("getting CTLog public keys: %w", err)
511511
}

‎cmd/cosign/cli/verify/verify.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ func (c *VerifyCommand) loadTSACertificates(ctx context.Context) (*cosign.TSACer
8888
if c.TSACertChainPath == "" && !c.UseSignedTimestamps {
8989
return nil, fmt.Errorf("TSA certificate chain path not provided and use-signed-timestamps not set")
9090
}
91-
tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets)
91+
tsaCertificates, err := cosign.GetTSACerts(c.TSACertChainPath)
9292
if err != nil {
9393
return nil, fmt.Errorf("unable to load TSA certificates: %w", err)
9494
}
@@ -169,7 +169,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) {
169169
}
170170
// This performs an online fetch of the Rekor public keys, but this is needed
171171
// for verifying tlog entries (both online and offline).
172-
co.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
172+
co.RekorPubKeys, err = cosign.GetRekorPubs()
173173
if err != nil {
174174
return fmt.Errorf("getting Rekor public keys: %w", err)
175175
}
@@ -185,7 +185,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) {
185185

186186
// Ignore Signed Certificate Timestamp if the flag is set or a key is provided
187187
if shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) {
188-
co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx)
188+
co.CTLogPubKeys, err = cosign.GetCTLogPubs()
189189
if err != nil {
190190
return fmt.Errorf("getting ctlog public keys: %w", err)
191191
}

‎cmd/cosign/cli/verify/verify_attestation.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ func (c *VerifyAttestationCommand) loadTSACertificates(ctx context.Context) (*co
7676
if c.TSACertChainPath == "" && !c.UseSignedTimestamps {
7777
return nil, fmt.Errorf("TSA certificate chain path not provided and use-signed-timestamps not set")
7878
}
79-
tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets)
79+
tsaCertificates, err := cosign.GetTSACerts(c.TSACertChainPath)
8080
if err != nil {
8181
return nil, fmt.Errorf("unable to load TSA certificates: %w", err)
8282
}
@@ -125,7 +125,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e
125125
}
126126
// Ignore Signed Certificate Timestamp if the flag is set or a key is provided
127127
if shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) {
128-
co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx)
128+
co.CTLogPubKeys, err = cosign.GetCTLogPubs()
129129
if err != nil {
130130
return fmt.Errorf("getting ctlog public keys: %w", err)
131131
}
@@ -151,7 +151,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e
151151
}
152152
// This performs an online fetch of the Rekor public keys, but this is needed
153153
// for verifying tlog entries (both online and offline).
154-
co.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
154+
co.RekorPubKeys, err = cosign.GetRekorPubs()
155155
if err != nil {
156156
return fmt.Errorf("getting Rekor public keys: %w", err)
157157
}

‎cmd/cosign/cli/verify/verify_blob.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ func (c *VerifyBlobCmd) loadTSACertificates(ctx context.Context) (*cosign.TSACer
7373
if c.TSACertChainPath == "" && !c.UseSignedTimestamps {
7474
return nil, fmt.Errorf("either TSA certificate chain path must be provided or use-signed-timestamps must be set")
7575
}
76-
tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets)
76+
tsaCertificates, err := cosign.GetTSACerts(c.TSACertChainPath)
7777
if err != nil {
7878
return nil, fmt.Errorf("unable to load TSA certificates: %w", err)
7979
}
@@ -161,7 +161,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
161161
}
162162
// This performs an online fetch of the Rekor public keys, but this is needed
163163
// for verifying tlog entries (both online and offline).
164-
co.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
164+
co.RekorPubKeys, err = cosign.GetRekorPubs()
165165
if err != nil {
166166
return fmt.Errorf("getting Rekor public keys: %w", err)
167167
}
@@ -294,7 +294,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
294294

295295
// Ignore Signed Certificate Timestamp if the flag is set or a key is provided
296296
if shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) {
297-
co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx)
297+
co.CTLogPubKeys, err = cosign.GetCTLogPubs()
298298
if err != nil {
299299
return fmt.Errorf("getting ctlog public keys: %w", err)
300300
}

‎cmd/cosign/cli/verify/verify_blob_attestation.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
160160
}
161161

162162
if c.TSACertChainPath != "" || c.UseSignedTimestamps {
163-
tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets)
163+
tsaCertificates, err := cosign.GetTSACerts(c.TSACertChainPath)
164164
if err != nil {
165165
return fmt.Errorf("unable to load or get TSA certificates: %w", err)
166166
}
@@ -179,7 +179,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
179179
}
180180
// This performs an online fetch of the Rekor public keys, but this is needed
181181
// for verifying tlog entries (both online and offline).
182-
co.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
182+
co.RekorPubKeys, err = cosign.GetRekorPubs()
183183
if err != nil {
184184
return fmt.Errorf("getting Rekor public keys: %w", err)
185185
}
@@ -192,7 +192,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
192192

193193
// Ignore Signed Certificate Timestamp if the flag is set or a key is provided
194194
if shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) {
195-
co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx)
195+
co.CTLogPubKeys, err = cosign.GetCTLogPubs()
196196
if err != nil {
197197
return fmt.Errorf("getting ctlog public keys: %w", err)
198198
}

‎internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go

Lines changed: 2 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,10 @@
1616
package fulcioroots
1717

1818
import (
19-
"bytes"
2019
"crypto/x509"
21-
"fmt"
22-
"os"
2320
"sync"
2421

25-
"github.com/sigstore/cosign/v2/pkg/cosign/env"
26-
"github.com/sigstore/sigstore/pkg/cryptoutils"
27-
"github.com/sigstore/sigstore/pkg/fulcioroots"
22+
"github.com/sigstore/cosign/v2/pkg/cosign"
2823
)
2924

3025
var (
@@ -64,41 +59,5 @@ func ReInit() error {
6459
}
6560

6661
func initRoots() (*x509.CertPool, *x509.CertPool, error) {
67-
rootPool := x509.NewCertPool()
68-
// intermediatePool should be nil if no intermediates are found
69-
var intermediatePool *x509.CertPool
70-
71-
rootEnv := env.Getenv(env.VariableSigstoreRootFile)
72-
if rootEnv != "" {
73-
raw, err := os.ReadFile(rootEnv)
74-
if err != nil {
75-
return nil, nil, fmt.Errorf("error reading root PEM file: %w", err)
76-
}
77-
certs, err := cryptoutils.UnmarshalCertificatesFromPEM(raw)
78-
if err != nil {
79-
return nil, nil, fmt.Errorf("error unmarshalling certificates: %w", err)
80-
}
81-
for _, cert := range certs {
82-
// root certificates are self-signed
83-
if bytes.Equal(cert.RawSubject, cert.RawIssuer) {
84-
rootPool.AddCert(cert)
85-
} else {
86-
if intermediatePool == nil {
87-
intermediatePool = x509.NewCertPool()
88-
}
89-
intermediatePool.AddCert(cert)
90-
}
91-
}
92-
} else {
93-
var err error
94-
rootPool, err = fulcioroots.Get()
95-
if err != nil {
96-
return nil, nil, err
97-
}
98-
intermediatePool, err = fulcioroots.GetIntermediates()
99-
if err != nil {
100-
return nil, nil, err
101-
}
102-
}
103-
return rootPool, intermediatePool, nil
62+
return cosign.GetFulcioCerts()
10463
}

‎pkg/cosign/ctlog.go

Lines changed: 22 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,11 @@
1515
package cosign
1616

1717
import (
18-
"context"
1918
"errors"
2019
"fmt"
21-
"os"
2220

2321
"github.com/sigstore/cosign/v2/pkg/cosign/env"
24-
"github.com/sigstore/sigstore/pkg/tuf"
22+
"github.com/sigstore/sigstore-go/pkg/root"
2523
)
2624

2725
// This is the CT log public key target name
@@ -32,37 +30,36 @@ var ctPublicKeyStr = `ctfe.pub`
3230
// By default the public keys comes from TUF, but you can override this for test
3331
// purposes by using an env variable `SIGSTORE_CT_LOG_PUBLIC_KEY_FILE`. If using
3432
// an alternate, the file can be PEM, or DER format.
35-
func GetCTLogPubs(ctx context.Context) (*TrustedTransparencyLogPubKeys, error) {
33+
func GetCTLogPubs() (*TrustedTransparencyLogPubKeys, error) {
3634
publicKeys := NewTrustedTransparencyLogPubKeys()
3735
altCTLogPub := env.Getenv(env.VariableSigstoreCTLogPublicKeyFile)
3836

3937
if altCTLogPub != "" {
40-
raw, err := os.ReadFile(altCTLogPub)
41-
if err != nil {
42-
return nil, fmt.Errorf("error reading alternate CTLog public key file: %w", err)
43-
}
44-
if err := publicKeys.AddTransparencyLogPubKey(raw, tuf.Active); err != nil {
45-
return nil, fmt.Errorf("AddCTLogPubKey: %w", err)
46-
}
47-
} else {
48-
tufClient, err := tuf.NewFromEnv(ctx)
49-
if err != nil {
50-
return nil, err
51-
}
52-
targets, err := tufClient.GetTargetsByMeta(tuf.CTFE, []string{ctPublicKeyStr})
53-
if err != nil {
54-
return nil, err
55-
}
56-
for _, t := range targets {
57-
if err := publicKeys.AddTransparencyLogPubKey(t.Target, t.Status); err != nil {
58-
return nil, fmt.Errorf("AddCTLogPubKey: %w", err)
59-
}
38+
return addKeyFromFile(&publicKeys, altCTLogPub, "CT log public key")
39+
}
40+
41+
opts, err := setTUFOpts()
42+
if err != nil {
43+
return nil, err
44+
}
45+
46+
// Try getting keys from trusted_root.json
47+
trustedRoot, _ := root.NewLiveTrustedRoot(opts)
48+
if trustedRoot == nil {
49+
// The TUF repository didn't have a trusted_root.json, try getting the individual target
50+
return addKeyFromTUF(&publicKeys, opts, ctPublicKeyStr, "CT log public key")
51+
}
52+
53+
ctlogs := trustedRoot.CTLogs()
54+
for _, ct := range ctlogs {
55+
validity := checkValidityPeriod(ct.ValidityPeriodStart, ct.ValidityPeriodEnd)
56+
if err := publicKeys.AddTransparencyLogPubKey(ct.PublicKey, validity); err != nil {
57+
return nil, fmt.Errorf("error adding CT log public key: %w", err)
6058
}
6159
}
6260

6361
if len(publicKeys.Keys) == 0 {
6462
return nil, errors.New("none of the CTLog public keys have been found")
6563
}
66-
6764
return &publicKeys, nil
6865
}

‎pkg/cosign/ctlog_test.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
package cosign
1616

1717
import (
18-
"context"
1918
"os"
2019
"testing"
2120
)
@@ -31,7 +30,7 @@ Nmo7M3bN7+dQddw9Ibc2R3SV8tzBZw0rST8FKcn4apJepcKM4qUpYUeNfw==
3130
)
3231

3332
func TestGetCTLogPubKeys(t *testing.T) {
34-
keys, err := GetCTLogPubs(context.Background())
33+
keys, err := GetCTLogPubs()
3534
if err != nil {
3635
t.Fatalf("Unexpected error calling GetCTLogPubs, expected nil: %v", err)
3736
}
@@ -61,7 +60,7 @@ func TestGetCTLogPubKeysAlt(t *testing.T) {
6160
}
6261
t.Setenv("SIGSTORE_CT_LOG_PUBLIC_KEY_FILE", pkFile.Name())
6362

64-
keys, err := GetCTLogPubs(context.Background())
63+
keys, err := GetCTLogPubs()
6564
if err != nil {
6665
t.Errorf("Unexpected error calling GetCTLogPubs, expected nil: %v", err)
6766
}

0 commit comments

Comments
 (0)