Skip to content

Upgrade to TUF v2 client #3844

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Upgrade to TUF v2 client #3844

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion cmd/conformance/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,11 +124,16 @@ func main() {
args = append(args, os.Args[len(os.Args)-1])

dir := filepath.Dir(os.Args[0])
initCmd := exec.Command(filepath.Join(dir, "cosign"), "initialize") // #nosec G204
err := initCmd.Run()
if err != nil {
log.Fatal(err)
}
cmd := exec.Command(filepath.Join(dir, "cosign"), args...) // #nosec G204
var out strings.Builder
cmd.Stdout = &out
cmd.Stderr = &out
err := cmd.Run()
err = cmd.Run()

fmt.Println(out.String())

Expand Down
10 changes: 10 additions & 0 deletions cmd/cosign/cli/attest.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,14 @@
package cli

import (
"context"
"fmt"

"github.com/sigstore/cosign/v2/cmd/cosign/cli/attest"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v2/internal/ui"
"github.com/sigstore/cosign/v2/pkg/cosign"
"github.com/spf13/cobra"
)

Expand Down Expand Up @@ -69,6 +72,12 @@ func Attest() *cobra.Command {
if err != nil {
return err
}

trustedMaterial, err := cosign.TrustedRoot()
if err != nil {
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
}
Comment on lines +76 to +79
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm still working my way through this PR, but I'm curious if this behavior is consistent with the existing code. I noticed that each signing/verification command starts by loading the Trusted Root from TUF, but if the user supplies their own Trusted Root JSON, I would expect that we wouldn't issue a TUF update (both for air-gapped mode and for speed). Do we currently always fetch TUF updates even if the user doesn't need it?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

++, although I think this comment makes more sense on the verify commands where we have --offline as a strong single if we're doing air-gapped verification.

You could be doing attest/sign commands in a restricted network environment (maybe there's a HSM attached to the network) although I'm not sure we have a flag we can key off of (like --offline for verify commands). I don't know enough about cosign usage to know if we need to support signing in restricted network environments.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an interesting point, because the sign commands don't have a --trusted-root flag. The trusted root is needed for signing because it does SCT verification as part of the fulcio workflow, and cosign has always been looking in the cached TUF root for this CT public key. If you try to verify a bundle and pass in a different trusted root with --trusted-root, the SCT check will fail. The sign commands need to have a --trusted-root flag if we want verification to work in general and especially without a new TUF fetch.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left the sign commands as-is because there is no flag to indicate where to get an offline trusted root. There should be, but I think that's outside of the scope of this already very large PR. I did rearrange the verify commands to make sure they don't try to fetch the TUF root online if a trusted root file is already provided.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is fine as-is for signing, and like you say we can add a flag if people need offline signing in another PR.


ko := options.KeyOpts{
KeyRef: o.Key,
PassFunc: generate.GetPass,
Expand All @@ -91,6 +100,7 @@ func Attest() *cobra.Command {
TSAServerName: o.TSAServerName,
TSAServerURL: o.TSAServerURL,
NewBundleFormat: o.NewBundleFormat,
TrustedMaterial: trustedMaterial,
}
attestCommand := attest.AttestCommand{
KeyOpts: ko,
Expand Down
11 changes: 11 additions & 0 deletions cmd/cosign/cli/attest_blob.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,13 @@
package cli

import (
"context"

"github.com/sigstore/cosign/v2/cmd/cosign/cli/attest"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/generate"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v2/internal/ui"
"github.com/sigstore/cosign/v2/pkg/cosign"
"github.com/spf13/cobra"
)

Expand Down Expand Up @@ -54,6 +58,12 @@ func AttestBlob() *cobra.Command {
if err != nil {
return err
}

trustedMaterial, err := cosign.TrustedRoot()
if err != nil {
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
}

ko := options.KeyOpts{
KeyRef: o.Key,
PassFunc: generate.GetPass,
Expand All @@ -78,6 +88,7 @@ func AttestBlob() *cobra.Command {
RFC3161TimestampPath: o.RFC3161TimestampPath,
BundlePath: o.BundlePath,
NewBundleFormat: o.NewBundleFormat,
TrustedMaterial: trustedMaterial,
}
v := attest.AttestBlobCommand{
KeyOpts: ko,
Expand Down
26 changes: 24 additions & 2 deletions cmd/cosign/cli/fulcio/fulcioverifier/fulcioverifier.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,15 @@ package fulcioverifier

import (
"context"
"crypto/x509"
"fmt"

"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v2/internal/ui"
"github.com/sigstore/cosign/v2/pkg/cosign"
"github.com/sigstore/sigstore-go/pkg/verify"
"github.com/sigstore/sigstore/pkg/cryptoutils"
"github.com/sigstore/sigstore/pkg/signature"
)

Expand All @@ -32,12 +35,31 @@ func NewSigner(ctx context.Context, ko options.KeyOpts, signer signature.SignerV
return nil, err
}

// Grab the PublicKeys for the CTFE, either from tuf or env.
if ko.TrustedMaterial != nil && len(fs.SCT) == 0 {
// Detached SCTs cannot be verified with this function.
chain, err := cryptoutils.UnmarshalCertificatesFromPEM(fs.Chain)
if err != nil {
return nil, fmt.Errorf("unmarshalling cert chain from PEM for SCT verification: %w", err)
}
certs, err := cryptoutils.UnmarshalCertificatesFromPEM(fs.Cert)
if err != nil || len(certs) < 1 {
return nil, fmt.Errorf("unmarshalling cert from PEM for SCT verification: %w", err)
}
chain = append(certs, chain...)
chains := make([][]*x509.Certificate, 1)
chains[0] = chain
if err := verify.VerifySignedCertificateTimestamp(chains, 1, ko.TrustedMaterial); err != nil {
return nil, fmt.Errorf("verifying SCT using trusted root: %w", err)
}
ui.Infof(ctx, "Successfully verified SCT...")
return fs, nil
}

// There was no trusted_root.json or we need to verify a detached SCT, so grab the PublicKeys for the CTFE, either from tuf or env.
pubKeys, err := cosign.GetCTLogPubs(ctx)
if err != nil {
return nil, fmt.Errorf("getting CTFE public keys: %w", err)
}

// verify the sct
if err := cosign.VerifySCT(ctx, fs.Cert, fs.Chain, fs.SCT, pubKeys); err != nil {
return nil, fmt.Errorf("verifying SCT: %w", err)
Expand Down
Loading
Loading