-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
WIP: Rough support for Sigstore Bundles using sigstore-go verifier
Signed-off-by: Cody Soyland <[email protected]>
- Loading branch information
1 parent
b0fd308
commit dd295ec
Showing
5 changed files
with
266 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| { | ||
| "mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1", | ||
| "certificateAuthorities": [ | ||
| { | ||
| "subject": { | ||
| "organization": "GitHub, Inc.", | ||
| "commonName": "Internal Services Root" | ||
| }, | ||
| "uri": "fulcio.githubapp.com", | ||
| "certChain": { | ||
| "certificates": [ | ||
| { | ||
| "rawBytes": "MIICKjCCAbCgAwIBAgIUW3TJVeOvr+NSvJXdOw8nEEn7HhQwCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZGdWxjaW8gSW50ZXJtZWRpYXRlIGwxMB4XDTIzMDkxMjE0MDY1NFoXDTI0MDkxMTE0MDY1NFowODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZGdWxjaW8gSW50ZXJtZWRpYXRlIGwyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEsosodObhuHG6Pr5vp5y+pmnKawS1h2hwv3r3hBwqh3ZHJAw64mhDnDs9fw4jKkZEBYRSVyOHyZppz4day8hgpTIDwdj44Oan4RDb+wmj04jfhVLjLsQ4Q/X4K/ynRgNXo3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUm0vkDkQZ29hutYdayJobIRmf/iMwHwYDVR0jBBgwFoAUwOG4UqRLTz7eejgRBs9JjqFFmzMwCgYIKoZIzj0EAwMDaAAwZQIwIBl93E7vkWTvdeIm1WSIM4qNsj0ApE8LCj3k1vrY5x6/7yhAZs7QlO3/FBCoEeaZAjEAlJcNr37uZq9BYHODHBeO/gP+6EfbzsNaLV22ASBlhF/a9y83ESLuqCNN7IxGxmWT" | ||
| }, | ||
| { | ||
| "rawBytes": "MIICFTCCAZugAwIBAgIUD3Jlqt4qhrcZI4UnGfPGrEq/pjQwCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MB4XDTIzMDkxMTEyMDAwMFoXDTI4MDkwOTEyMDAwMFowODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZGdWxjaW8gSW50ZXJtZWRpYXRlIGwxMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE7X7nK0wC7uEmDjW+on0sXIX3FacL3hhcrhneA+M/kl1OtvQiPmFrH9lbUQqOj/AfspJ8uGY3jaq8WuSg6ghatzYfuuzLAJIK4nGpCBafncF8EynOssPq64/Dz+JUWXqlo2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUwOG4UqRLTz7eejgRBs9JjqFFmzMwHwYDVR0jBBgwFoAUfFJ5/6rhfHEZPnXAhrQLhGkJJMwwCgYIKoZIzj0EAwMDaAAwZQIxAI8HWLrke7uzhOpwlD1cNixPmoX9XFKe7bEPozo0D+vKi0Gt6VlC7xPedFIw4/AypAIwQP+FGRWvfx0IAH5/n0aRiN7/LVpyFA5RkJASZOVOib2Y8pNuhXa9V3ZbWO6v6kW/" | ||
| }, | ||
| { | ||
| "rawBytes": "MIIB9TCCAXqgAwIBAgIUNFryA06EHDIcd5EIbe8swbl9OY4wCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MB4XDTIzMDgwNzEyMDAwMFoXDTMzMDgwNDEyMDAwMFowODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEXYaXx4H0oNuVP/2cfydA3oaafvvkkkgb5hbL8/j/BO25S7uTmDOCA5e4QLLWCKFuc+xp2j14tCH4WmHzMUDvf2tXtInVliY5wZgQMM9L6klo/IwA9x4omdcjnT+kKJAjo0UwQzAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQUfFJ5/6rhfHEZPnXAhrQLhGkJJMwwCgYIKoZIzj0EAwMDaQAwZgIxAPzXsV+eokrqOHSQZH/XhhHE1slOscKy3DQpYpYJ1AWmJ2lJu/XOmubBX5s7apllUwIxALw2Ts8CDACiK42UymC8fk6sbNfoXUAWqdyKTVt2Lst+wNdkRniGvx7jT65BKTkcsQ==" | ||
| } | ||
| ] | ||
| }, | ||
| "validFor": { | ||
| "start": "2023-10-27T16:30:00Z" | ||
| } | ||
| } | ||
| ], | ||
| "timestampAuthorities": [ | ||
| { | ||
| "subject": { | ||
| "organization": "GitHub, Inc.", | ||
| "commonName": "Internal Services Root" | ||
| }, | ||
| "uri": "timestamp.githubapp.com", | ||
| "certChain": { | ||
| "certificates": [ | ||
| { | ||
| "rawBytes": "MIICHDCCAaGgAwIBAgIUNDVlmtZuvoujn4KwiC/oxIr8hxAwCgYIKoZIzj0EAwMwMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgaW50ZXJtZWRpYXRlMB4XDTIzMDgzMTEyMDAwMFoXDTI0MDgzMDEyMDAwMFowMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgVGltZXN0YW1waW5nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEV/zJhNTdu0Fa9hGCUih/JvqEoE81tEWrAVwUXXhdRgIY9hIFErLhNo6sSOpV9d7Zuy0KWMHhcimCUr41a1732ByVRy3f+Z4QhqpsgFMh5b5J90HJLK7HOyUZjehAnvSno3gwdjAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUGwE6T5ZIh6lY9wP6vt42UHyVMewwHwYDVR0jBBgwFoAUdh+GTP65aetHLVLs9hdhGgDIKIwwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwCgYIKoZIzj0EAwMDaQAwZgIxAJo48LtrSsn0UmLtqGiUKg2EUvso+aDN5EyjpvMmobZ/Oq9zjnR7Of369hoABW4/1gIxANg5ZW4FqijhsXnA3md6jM9yLrLCI9QL+KnuZnXq6WgAcNQaAN7PNNjVDKV3iJEklw==" | ||
| }, | ||
| { | ||
| "rawBytes": "MIICJDCCAaqgAwIBAgIUckXVHpiw7iJY1V/jY8LYLj5TgqAwCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MB4XDTIzMDgwNzEyMDAwMFoXDTI4MDgwNTEyMDAwMFowMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEISv96hTQ58QroEzzu4K+o9p8YkwDCBia2U7Y+VBNbOG/w1mLRibve9hSeUE1FSyLBMkiFSSm6MexcsbjyqOoNtRxuMinyYt6DSEox+/It2s/bTPyNAN0QP0DCQQOpnTZo3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwgwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUdh+GTP65aetHLVLs9hdhGgDIKIwwHwYDVR0jBBgwFoAUfFJ5/6rhfHEZPnXAhrQLhGkJJMwwCgYIKoZIzj0EAwMDaAAwZQIxAIhf+2E5W2yOb/fCDAjhL/G/jerf74M0tG/zyo32U2keawxkzZosDdwnPaHaGLynAQIwa8nr3en4fZz1AdOZm6nK5hr1qK2F94nifgnAJ/WeT0fZnK/oHan0R28x363qYuYH" | ||
| }, | ||
| { | ||
| "rawBytes": "MIIB9TCCAXqgAwIBAgIUNFryA06EHDIcd5EIbe8swbl9OY4wCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MB4XDTIzMDgwNzEyMDAwMFoXDTMzMDgwNDEyMDAwMFowODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEXYaXx4H0oNuVP/2cfydA3oaafvvkkkgb5hbL8/j/BO25S7uTmDOCA5e4QLLWCKFuc+xp2j14tCH4WmHzMUDvf2tXtInVliY5wZgQMM9L6klo/IwA9x4omdcjnT+kKJAjo0UwQzAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQUfFJ5/6rhfHEZPnXAhrQLhGkJJMwwCgYIKoZIzj0EAwMDaQAwZgIxAPzXsV+eokrqOHSQZH/XhhHE1slOscKy3DQpYpYJ1AWmJ2lJu/XOmubBX5s7apllUwIxALw2Ts8CDACiK42UymC8fk6sbNfoXUAWqdyKTVt2Lst+wNdkRniGvx7jT65BKTkcsQ==" | ||
| } | ||
| ] | ||
| }, | ||
| "validFor": { | ||
| "start": "2023-10-27T16:30:00Z" | ||
| } | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| package verify | ||
|
|
||
| import ( | ||
| "encoding/hex" | ||
| "fmt" | ||
| "io" | ||
| "strings" | ||
|
|
||
| "github.com/google/go-containerregistry/pkg/authn" | ||
| "github.com/google/go-containerregistry/pkg/name" | ||
| v1 "github.com/google/go-containerregistry/pkg/v1" | ||
| "github.com/google/go-containerregistry/pkg/v1/remote" | ||
|
|
||
| _ "embed" | ||
|
|
||
| "github.com/sigstore/sigstore-go/pkg/bundle" | ||
| "github.com/sigstore/sigstore-go/pkg/root" | ||
| "github.com/sigstore/sigstore-go/pkg/verify" | ||
| ) | ||
|
|
||
| //go:embed trusted-root-github-staging.json | ||
| var trustedRootGithubStaging []byte | ||
|
|
||
| // TODO: Replace with TUF from TrustRoot CRD when TUF client is updated to support TrustedRoot files. | ||
| func TrustedRootGithubStaging() (root.TrustedMaterial, error) { | ||
| return root.NewTrustedRootFromJSON(trustedRootGithubStaging) | ||
| } | ||
|
|
||
| func AttestationBundle(ref name.Reference, trustedMaterial root.TrustedMaterial, kc authn.Keychain, policyOption verify.PolicyOption) (*bundle.ProtobufBundle, *verify.VerificationResult, error) { | ||
| b, imageDigest, err := getBundle(ref, kc) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
| _ = imageDigest | ||
|
|
||
| verifierConfig := []verify.VerifierOption{} | ||
| var artifactPolicy verify.ArtifactPolicyOption | ||
|
|
||
| verifierConfig = append(verifierConfig, verify.WithObserverTimestamps(1)) | ||
|
|
||
| sev, err := verify.NewSignedEntityVerifier(trustedMaterial, verifierConfig...) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
|
|
||
| digestBytes, err := hex.DecodeString(imageDigest.Hex) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
| artifactPolicy = verify.WithArtifactDigest(imageDigest.Algorithm, digestBytes) | ||
|
|
||
| result, err := sev.Verify(b, verify.NewPolicy(artifactPolicy, policyOption)) | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
| return b, result, nil | ||
| } | ||
|
|
||
| func getBundle(ref name.Reference, kc authn.Keychain) (*bundle.ProtobufBundle, *v1.Hash, error) { | ||
| desc, err := remote.Get(ref, remote.WithAuthFromKeychain(kc)) | ||
| if err != nil { | ||
| return nil, nil, fmt.Errorf("error getting image descriptor: %w", err) | ||
| } | ||
|
|
||
| digest := ref.Context().Digest(desc.Digest.String()) | ||
|
|
||
| referrers, err := remote.Referrers(digest, remote.WithAuthFromKeychain(kc)) | ||
| if err != nil { | ||
| return nil, nil, fmt.Errorf("error getting referrers: %w", err) | ||
| } | ||
| refManifest, err := referrers.IndexManifest() | ||
| if err != nil { | ||
| return nil, nil, fmt.Errorf("error getting referrers manifest: %w", err) | ||
| } | ||
|
|
||
| var bundleBytes []byte | ||
| for _, refDesc := range refManifest.Manifests { | ||
| if !strings.HasPrefix(refDesc.ArtifactType, "application/vnd.dev.sigstore.bundle+json") { | ||
| continue | ||
| } | ||
|
|
||
| refImg, err := remote.Image(ref.Context().Digest(refDesc.Digest.String()), remote.WithAuthFromKeychain(kc)) | ||
| if err != nil { | ||
| return nil, nil, fmt.Errorf("error getting referrer image: %w", err) | ||
| } | ||
| layers, err := refImg.Layers() | ||
| if err != nil { | ||
| return nil, nil, fmt.Errorf("error getting referrer image: %w", err) | ||
| } | ||
| layer0, err := layers[0].Uncompressed() | ||
| if err != nil { | ||
| return nil, nil, fmt.Errorf("error getting referrer image: %w", err) | ||
| } | ||
| bundleBytes, err = io.ReadAll(layer0) | ||
| if err != nil { | ||
| return nil, nil, fmt.Errorf("error getting referrer image: %w", err) | ||
| } | ||
| } | ||
| if len(refManifest.Manifests) == 0 || len(bundleBytes) == 0 { | ||
| return nil, nil, fmt.Errorf("no bundle found in referrers") | ||
| } | ||
| b := &bundle.ProtobufBundle{} | ||
| err = b.UnmarshalJSON(bundleBytes) | ||
| if err != nil { | ||
| return nil, nil, fmt.Errorf("error unmarshalling bundle: %w", err) | ||
| } | ||
| return b, &desc.Digest, nil | ||
| } |