-
Notifications
You must be signed in to change notification settings - Fork 32
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Teach EC CLI to initialize a TUF root
- Loading branch information
Showing
13 changed files
with
283 additions
and
55 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| // Copyright The Enterprise Contract Contributors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| package sigstore | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| hd "github.com/MakeNowJust/heredoc" | ||
| "github.com/sigstore/cosign/v2/cmd/cosign/cli/options" | ||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| type sigstoreInitializeFunc func(ctx context.Context, root, mirror string) error | ||
|
|
||
| func sigstoreInitializeCmd(f sigstoreInitializeFunc) *cobra.Command { | ||
|
|
||
| opts := &options.InitializeOptions{} | ||
|
|
||
| cmd := &cobra.Command{ | ||
| Use: "initialize", | ||
| Short: "Initializes Sigstore root to retrieve trusted certificate and key targets for verification", | ||
|
|
||
| Long: hd.Doc(` | ||
| Initializes Sigstore root to retrieve trusted certificate and key targets for verification. | ||
| The following options are used by default: | ||
| - The current trusted Sigstore TUF root is embedded inside ec at the time of release. | ||
| - Sigstore remote TUF repository is pulled from the CDN mirror at tuf-repo-cdn.sigstore.dev. | ||
| To provide an out-of-band trusted initial root.json, use the --root flag with a file or | ||
| URL reference. This will enable you to point ec to a separate TUF root. | ||
| Any updated TUF repository will be written to $HOME/.sigstore/root/. | ||
| Trusted keys and certificate used in ec verification (e.g. verifying Fulcio issued certificates | ||
| with Fulcio root CA) are pulled form the trusted metadata. | ||
| This command is mostly a wrapper around "cosign initialize". | ||
| `), | ||
|
|
||
| Example: hd.Doc(` | ||
| ec initialize -mirror <url> -out <file> | ||
| Initialize root with distributed root keys, default mirror, and default out path. | ||
| ec initialize | ||
| Initialize with an out-of-band root key file, using the default mirror. | ||
| ec initialize -root <url> | ||
| Initialize with an out-of-band root key file and custom repository mirror. | ||
| ec initialize -mirror <url> -root <url> | ||
| `), | ||
|
|
||
| Args: cobra.NoArgs, | ||
| RunE: func(cmd *cobra.Command, _ []string) error { | ||
| return f(cmd.Context(), opts.Root, opts.Mirror) | ||
| }, | ||
| } | ||
|
|
||
| opts.AddFlags(cmd) | ||
|
|
||
| return cmd | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| // Copyright The Enterprise Contract Contributors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| //go:build unit | ||
|
|
||
| package sigstore | ||
|
|
||
| import ( | ||
| "context" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "github.com/enterprise-contract/ec-cli/cmd/root" | ||
| ) | ||
|
|
||
| func TestInitializeCmd(t *testing.T) { | ||
| cases := []struct { | ||
| name string | ||
| args []string | ||
| expectedRoot string | ||
| expectedMirror string | ||
| }{ | ||
| { | ||
| name: "no args", | ||
| expectedMirror: "https://tuf-repo-cdn.sigstore.dev", | ||
| }, | ||
| { | ||
| name: "with root", | ||
| args: []string{"--root", "/some/path/root.json"}, | ||
| expectedRoot: "/some/path/root.json", | ||
| expectedMirror: "https://tuf-repo-cdn.sigstore.dev", | ||
| }, | ||
| { | ||
| name: "with mirror", | ||
| args: []string{"--mirror", "https://tuf.local"}, | ||
| expectedMirror: "https://tuf.local", | ||
| }, | ||
| { | ||
| name: "with root and mirror", | ||
| args: []string{"--root", "/some/path/root.json", "--mirror", "https://tuf.local"}, | ||
| expectedRoot: "/some/path/root.json", | ||
| expectedMirror: "https://tuf.local", | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range cases { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| initF := func(ctx context.Context, root, mirror string) error { | ||
| require.Equal(t, tt.expectedRoot, root) | ||
| require.Equal(t, tt.expectedMirror, mirror) | ||
| return nil | ||
| } | ||
|
|
||
| sigInitCmd := sigstoreInitializeCmd(initF) | ||
|
|
||
| sigCmd := NewSigstoreCmd() | ||
| sigCmd.AddCommand(sigInitCmd) | ||
|
|
||
| rootCmd := root.NewRootCmd() | ||
| rootCmd.AddCommand(sigCmd) | ||
|
|
||
| rootCmd.SetContext(context.Background()) | ||
| rootCmd.SetArgs(append([]string{"sigstore", "initialize"}, tt.args...)) | ||
|
|
||
| err := rootCmd.Execute() | ||
| require.NoError(t, err) | ||
| }) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| // Copyright The Enterprise Contract Contributors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| package sigstore | ||
|
|
||
| import ( | ||
| "github.com/sigstore/cosign/v2/cmd/cosign/cli/initialize" | ||
| "github.com/spf13/cobra" | ||
|
|
||
| _ "github.com/enterprise-contract/ec-cli/internal/rego" | ||
| ) | ||
|
|
||
| var SigstoreCmd *cobra.Command | ||
|
|
||
| func init() { | ||
| SigstoreCmd = NewSigstoreCmd() | ||
| SigstoreCmd.AddCommand(sigstoreInitializeCmd(initialize.DoInitialize)) | ||
| } | ||
|
|
||
| func NewSigstoreCmd() *cobra.Command { | ||
| sigstoreCmd := &cobra.Command{ | ||
| Use: "sigstore", | ||
| Short: "Perform certain sigstore operations", | ||
| } | ||
| return sigstoreCmd | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| = ec sigstore | ||
|
|
||
| Perform certain sigstore operations | ||
| == Options | ||
|
|
||
| -h, --help:: help for sigstore (Default: false) | ||
|
|
||
| == Options inherited from parent commands | ||
|
|
||
| --debug:: same as verbose but also show function names and line numbers (Default: false) | ||
| --kubeconfig:: path to the Kubernetes config file to use | ||
| --quiet:: less verbose output (Default: false) | ||
| --timeout:: max overall execution duration (Default: 5m0s) | ||
| --trace:: enable trace logging (Default: false) | ||
| --verbose:: more verbose output (Default: false) | ||
|
|
||
| == See also | ||
|
|
||
| * xref:ec.adoc[ec - Enterprise Contract CLI] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| = ec sigstore initialize | ||
|
|
||
| Initializes Sigstore root to retrieve trusted certificate and key targets for verification== Synopsis | ||
|
|
||
| Initializes Sigstore root to retrieve trusted certificate and key targets for verification. | ||
|
|
||
| The following options are used by default: | ||
| - The current trusted Sigstore TUF root is embedded inside ec at the time of release. | ||
| - Sigstore remote TUF repository is pulled from the CDN mirror at tuf-repo-cdn.sigstore.dev. | ||
|
|
||
| To provide an out-of-band trusted initial root.json, use the --root flag with a file or | ||
| URL reference. This will enable you to point ec to a separate TUF root. | ||
|
|
||
| Any updated TUF repository will be written to $HOME/.sigstore/root/. | ||
|
|
||
| Trusted keys and certificate used in ec verification (e.g. verifying Fulcio issued certificates | ||
| with Fulcio root CA) are pulled form the trusted metadata. | ||
|
|
||
| This command is mostly a wrapper around "cosign initialize". | ||
|
|
||
| [source,shell] | ||
| ---- | ||
| ec sigstore initialize [flags] | ||
| ---- | ||
|
|
||
| == Examples | ||
| ec initialize -mirror <url> -out <file> | ||
|
|
||
| Initialize root with distributed root keys, default mirror, and default out path. | ||
| ec initialize | ||
|
|
||
| Initialize with an out-of-band root key file, using the default mirror. | ||
| ec initialize -root <url> | ||
|
|
||
| Initialize with an out-of-band root key file and custom repository mirror. | ||
| ec initialize -mirror <url> -root <url> | ||
|
|
||
| == Options | ||
|
|
||
| -h, --help:: help for initialize (Default: false) | ||
| --mirror:: GCS bucket to a SigStore TUF repository, or HTTP(S) base URL, or file:/// for local filestore remote (air-gap) (Default: https://tuf-repo-cdn.sigstore.dev) | ||
| --root:: path to trusted initial root. defaults to embedded root | ||
|
|
||
| == Options inherited from parent commands | ||
|
|
||
| --debug:: same as verbose but also show function names and line numbers (Default: false) | ||
| --kubeconfig:: path to the Kubernetes config file to use | ||
| --quiet:: less verbose output (Default: false) | ||
| --timeout:: max overall execution duration (Default: 5m0s) | ||
| --trace:: enable trace logging (Default: false) | ||
| --verbose:: more verbose output (Default: false) | ||
|
|
||
| == See also | ||
|
|
||
| * xref:ec_sigstore.adoc[ec sigstore - Perform certain sigstore operations] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.