Merge branch 'main' into fixing-ca-path

Signed-off-by: Tom Meadows <[email protected]>

.github/workflows/codeql.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
@@ -50,7 +50,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # v3.23.2
+        uses: github/codeql-action/init@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # v3.23.2
+        uses: github/codeql-action/autobuild@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # v3.23.2
+        uses: github/codeql-action/analyze@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: 'Checkout Repository'
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@4901385134134e04cec5fbe5ddfe3b2c5bd5d976 # v4.0.0
+        uses: actions/dependency-review-action@fd07d42ce87ab09f10c61a2d1a5e59e6c655620a # v4.1.1

.github/workflows/fossa.yml

@@ -23,6 +23,6 @@ jobs:
           uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         - if: ${{ env.FOSSA_API_KEY != '' }}
           name: "Run FOSSA Scan"
-          uses: fossas/fossa-action@f61a4c0c263690f2ddb54b9822a719c25a7b608f # v1.3.1
+          uses: fossas/fossa-action@47ef11b1e1e3812e88dae436ccbd2d0cbd1adab0 # v1.3.3
           with:
             api-key: ${{ env.FOSSA_API_KEY }}

.github/workflows/golangci-lint.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
+        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
         with:
           version: latest
           args: --timeout=3m

.github/workflows/release.yml

@@ -93,13 +93,13 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
+        uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
 
       - name: Download GoReleaser
         run: go install github.com/goreleaser/[email protected]
 
       - name: Run GoReleaser
-        uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
+        uses: testifysec/witness-run-action@2ae7f93c013ccf24b8ff52b4f042b32ca95ec7b8
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}

.github/workflows/scorecard.yml

@@ -67,14 +67,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # tag=v4.3.0
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # tag=v4.3.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # tag=v3.23.2
+        uses: github/codeql-action/upload-sarif@379614612a29c9e28f31f39a59013eb8012a51f0 # tag=v3.24.3
         with:
           sarif_file: results.sarif

.github/workflows/verify-docgen.yml

@@ -16,5 +16,5 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: '1.19.x'
+          go-version: "1.21.x"
       - run: ./docgen/verify.sh

.github/workflows/verify-licence.yml

@@ -2,23 +2,23 @@ name: Verify License
 on:
   workflow_dispatch:
   push:
-    branches: ['main', 'release-*']
+    branches: ["main", "release-*"]
   pull_request:
 permissions:
   contents: read
 
 jobs:
-    license-check:
-      name: license boilerplate check
-      runs-on: ubuntu-latest
-      steps:
-        - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-        - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
-          with:
-            go-version: '1.18.x'
-        - name: Install addlicense
-          run: go install github.com/google/[email protected]
-        - name: Check license headers
-          run: |
-            set -e
-            addlicense --check -l apache -c 'The Witness Contributors' -v *
+  license-check:
+    name: license boilerplate check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version: "1.21.x"
+      - name: Install addlicense
+        run: go install github.com/google/[email protected]
+      - name: Check license headers
+        run: |
+          set -e
+          addlicense --check -l apache -c 'The Witness Contributors' -v *

.github/workflows/witness.yml

@@ -56,13 +56,13 @@ jobs:
               go-version: 1.21.x
 
           - if: ${{ inputs.artifact-download != '' }}
-            uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
+            uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4.1.2
             with:
               name: ${{ inputs.artifact-download }}
               path: /tmp
 
           - if: ${{ inputs.pre-command != '' && inputs.pull_request == false }}
-            uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
+            uses: testifysec/witness-run-action@2ae7f93c013ccf24b8ff52b4f042b32ca95ec7b8
             with:
               step: pre-${{ inputs.step }}
               attestations: ${{ inputs.attestations }}
@@ -71,7 +71,7 @@ jobs:
             run: ${{ inputs.pre-command }}
 
           - if: ${{ inputs.pull_request == false }}
-            uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
+            uses: testifysec/witness-run-action@2ae7f93c013ccf24b8ff52b4f042b32ca95ec7b8
             with:
               step: ${{ inputs.step }}
               attestations: ${{ inputs.attestations }}
@@ -80,7 +80,7 @@ jobs:
             run: ${{ inputs.command }}
 
           - if: ${{ inputs.artifact-upload-path != '' && inputs.artifact-upload-name != ''}}
-            uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+            uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
             with:
               name: ${{ inputs.artifact-upload-name }}
               path: ${{ inputs.artifact-upload-path }}

MAINTAINERS.md

@@ -2,7 +2,8 @@
 
 | Name                       | GitHub          |
 |----------------------------|-----------------|
-| Cole Kennedy (TestifySec)      | [@colek42](https://github.com/colek42) |
-| John Kjell (TestifySec)     | [@jkjell](https://github.com/jkjell) |
+| Cole Kennedy (TestifySec)  | [@colek42](https://github.com/colek42) |
+| John Kjell (TestifySec)    | [@jkjell](https://github.com/jkjell) |
+| Tom Meadows (TestifySec)   | [@ChaosInTheCRD](https://github.com/ChaosInTheCRD) |
+| Aditya Sirish (NYU)        | [@adityasaky](https://github.com/adityasaky) |
 | Mikhail Swift (TestifySec) | [@mikhailswift](https://github.com/mikhailswift) |
-| Aditya Sirish (NYU)       | [@adityasaky](https://github.com/adityasaky) |

README.md

@@ -1,11 +1,11 @@
-# Witness 
-[![Go Reference](https://pkg.go.dev/badge/github.com/in-toto/witness.svg)](https://pkg.go.dev/github.com/in-toto/witness) [![Go Report Card](https://goreportcard.com/badge/github.com/in-toto/witness)](https://goreportcard.com/report/github.com/in-toto/witness) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8164/badge)](https://www.bestpractices.dev/projects/8164) [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/in-toto/witness/badge)](https://securityscorecards.dev/viewer/?uri=github.com/in-toto/witness)
+# Witness
+[![Go Reference](https://pkg.go.dev/badge/github.com/in-toto/witness.svg)](https://pkg.go.dev/github.com/in-toto/witness) [![Go Report Card](https://goreportcard.com/badge/github.com/in-toto/witness)](https://goreportcard.com/report/github.com/in-toto/witness) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8164/badge)](https://www.bestpractices.dev/projects/8164) [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/in-toto/witness/badge)](https://securityscorecards.dev/viewer/?uri=github.com/in-toto/witness) [![FOSSA Status](https://app.fossa.com/api/projects/custom%2B41709%2Fgithub.com%2Fin-toto%2Fwitness.svg?type=shield&issueType=license)](https://app.fossa.com/projects/custom%2B41709%2Fgithub.com%2Fin-toto%2Fwitness?ref=badge_shield&issueType=license)
 
 <center>
-   
-**[DOCS](https://witness.dev) • 
-[CONTRIBUTING](../CONTRIBUTING.md) • 
-[LICENSE](../LICENSE)**  
+
+**[DOCS](https://witness.dev) •
+[CONTRIBUTING](../CONTRIBUTING.md) •
+[LICENSE](../LICENSE)**
 
 `bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh)`
 </center>

cmd/keyloader.go

@@ -22,15 +22,16 @@ import (
 	"github.com/in-toto/go-witness/cryptoutil"
 	"github.com/in-toto/go-witness/log"
 	"github.com/in-toto/go-witness/signer"
+	"github.com/in-toto/go-witness/signer/kms"
 	"github.com/in-toto/witness/options"
 	"github.com/spf13/pflag"
 )
 
-// signerProvidersFromFlags looks at all flags that were set by the user to determine which signer providers we should use
-func signerProvidersFromFlags(flags *pflag.FlagSet) map[string]struct{} {
-	signerProviders := make(map[string]struct{})
+// providersFromFlags looks at all flags that were set by the user to determine which providers we should use
+func providersFromFlags(prefix string, flags *pflag.FlagSet) map[string]struct{} {
+	providers := make(map[string]struct{})
 	flags.Visit(func(flag *pflag.Flag) {
-		if !strings.HasPrefix(flag.Name, "signer-") {
+		if !strings.HasPrefix(flag.Name, fmt.Sprintf("%s-", prefix)) {
 			return
 		}
 
@@ -39,14 +40,14 @@ func signerProvidersFromFlags(flags *pflag.FlagSet) map[string]struct{} {
 			return
 		}
 
-		signerProviders[parts[1]] = struct{}{}
+		providers[parts[1]] = struct{}{}
 	})
 
-	return signerProviders
+	return providers
 }
 
 // loadSigners loads all signers that appear in the signerProviders set and creates their respective signers, using any options provided in so
-func loadSigners(ctx context.Context, so options.SignerOptions, signerProviders map[string]struct{}) ([]cryptoutil.Signer, error) {
+func loadSigners(ctx context.Context, so options.SignerOptions, ko options.KMSSignerProviderOptions, signerProviders map[string]struct{}) ([]cryptoutil.Signer, error) {
 	signers := make([]cryptoutil.Signer, 0)
 	for signerProvider := range signerProviders {
 		setters := so[signerProvider]
@@ -56,6 +57,18 @@ func loadSigners(ctx context.Context, so options.SignerOptions, signerProviders
 			continue
 		}
 
+		// NOTE: We want to initialze the KMS provider specific options if a KMS signer has been invoked
+		if ksp, ok := sp.(*kms.KMSSignerProvider); ok {
+			for _, opt := range ksp.Options {
+				for _, setter := range ko[opt.ProviderName()] {
+					sp, err = setter(ksp)
+					if err != nil {
+						continue
+					}
+				}
+			}
+		}
+
 		s, err := sp.Signer(ctx)
 		if err != nil {
 			log.Errorf("failed to create %v signer: %w", signerProvider, err)
@@ -71,3 +84,55 @@ func loadSigners(ctx context.Context, so options.SignerOptions, signerProviders
 
 	return signers, nil
 }
+
+// NOTE: This is a temporary implementation until we have a SignerVerifier interface
+// loadVerifiers loads all verifiers that appear in the verifierProviders set and creates their respective verifiers, using any options provided in so
+func loadVerifiers(ctx context.Context, so options.VerifierOptions, ko options.KMSVerifierProviderOptions, verifierProviders map[string]struct{}) ([]cryptoutil.Verifier, error) {
+	verifiers := make([]cryptoutil.Verifier, 0)
+	for verifierProvider := range verifierProviders {
+		setters := so[verifierProvider]
+		sp, err := signer.NewVerifierProvider(verifierProvider, setters...)
+		if err != nil {
+			log.Errorf("failed to create %v verifier provider: %w", verifierProvider, err)
+			continue
+		}
+
+		// NOTE: We want to initialze the KMS provider specific options if a KMS signer has been invoked
+		if ksp, ok := sp.(*kms.KMSSignerProvider); ok {
+			for _, opt := range ksp.Options {
+				pn := opt.ProviderName()
+				for _, setter := range ko[pn] {
+					vp, err := setter(ksp)
+					if err != nil {
+						continue
+					}
+
+					// NOTE: KMS SignerProvider can also be a VerifierProvider. This is a nasty hack to cast things back in a way that we can add to the loaded verifiers.
+					// This must be refactored.
+					kspv, ok := vp.(*kms.KMSSignerProvider)
+					if !ok {
+						return nil, fmt.Errorf("provided verifier provider is not a KMS verifier provider")
+					}
+
+					s, err := kspv.Verifier(ctx)
+					if err != nil {
+						log.Errorf("failed to create %v verifier: %w", verifierProvider, err)
+						continue
+					}
+					verifiers = append(verifiers, s)
+					return verifiers, nil
+				}
+			}
+		}
+
+		s, err := sp.Verifier(ctx)
+		if err != nil {
+			log.Errorf("failed to create %v verifier: %w", verifierProvider, err)
+			continue
+		}
+
+		verifiers = append(verifiers, s)
+	}
+
+	return verifiers, nil
+}

cmd/root.go

@@ -19,6 +19,8 @@ import (
 	"os"
 
 	"github.com/in-toto/go-witness/log"
+	_ "github.com/in-toto/go-witness/signer/kms/aws"
+	_ "github.com/in-toto/go-witness/signer/kms/gcp"
 	"github.com/in-toto/witness/options"
 	"github.com/spf13/cobra"
 )

cmd/root_test.go

@@ -63,7 +63,7 @@ func Test_loadSignersKeyPair(t *testing.T) {
 			},
 		}
 
-		signers, err := loadSigners(context.Background(), signerOptions, map[string]struct{}{"file": {}})
+		signers, err := loadSigners(context.Background(), signerOptions, options.KMSSignerProviderOptions{}, map[string]struct{}{"file": {}})
 		require.NoError(t, err)
 		require.Len(t, signers, 1)
 		assert.IsType(t, &cryptoutil.RSASigner{}, signers[0])
@@ -79,7 +79,7 @@ func Test_loadSignersKeyPair(t *testing.T) {
 			},
 		}
 
-		signers, err := loadSigners(context.Background(), signerOptions, map[string]struct{}{"file": {}})
+		signers, err := loadSigners(context.Background(), signerOptions, options.KMSSignerProviderOptions{}, map[string]struct{}{"file": {}})
 		require.Error(t, err)
 		require.Len(t, signers, 0)
 	})
@@ -99,7 +99,7 @@ func Test_loadSignersCertificate(t *testing.T) {
 		},
 	}
 
-	signers, err := loadSigners(context.Background(), signerOptions, map[string]struct{}{"file": {}})
+	signers, err := loadSigners(context.Background(), signerOptions, options.KMSSignerProviderOptions{}, map[string]struct{}{"file": {}})
 	require.NoError(t, err)
 	require.Len(t, signers, 1)
 	require.IsType(t, &cryptoutil.X509Signer{}, signers[0])

cmd/run.go

@@ -35,8 +35,9 @@ import (
 
 func RunCmd() *cobra.Command {
 	o := options.RunOptions{
-		AttestorOptSetters: make(map[string][]func(attestation.Attestor) (attestation.Attestor, error)),
-		SignerOptions:      options.SignerOptions{},
+		AttestorOptSetters:       make(map[string][]func(attestation.Attestor) (attestation.Attestor, error)),
+		SignerOptions:            options.SignerOptions{},
+		KMSSignerProviderOptions: options.KMSSignerProviderOptions{},
 	}
 
 	cmd := &cobra.Command{
@@ -45,9 +46,9 @@ func RunCmd() *cobra.Command {
 		SilenceErrors: true,
 		SilenceUsage:  true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			signers, err := loadSigners(cmd.Context(), o.SignerOptions, signerProvidersFromFlags(cmd.Flags()))
+			signers, err := loadSigners(cmd.Context(), o.SignerOptions, o.KMSSignerProviderOptions, providersFromFlags("signer", cmd.Flags()))
 			if err != nil {
-				return fmt.Errorf("failed to load signers")
+				return fmt.Errorf("failed to load signers: %w", err)
 			}
 
 			return runRun(cmd.Context(), o, args, signers...)
@@ -121,7 +122,7 @@ func runRun(ctx context.Context, ro options.RunOptions, args []string, signers .
 		if err != nil {
 			return fmt.Errorf("failed to parse hash: %w", err)
 		}
-		roHashes = append(roHashes, cryptoutil.DigestValue{Hash: hash})
+		roHashes = append(roHashes, cryptoutil.DigestValue{Hash: hash, GitOID: false})
 	}
 
 	defer out.Close()