Merge branch 'main' into linussun/split-identity-search

Signed-off-by: Linus Sun <[email protected]>
Signed-off-by: linus-sun <[email protected]>

.github/workflows/codeql_analysis.yml

@@ -38,16 +38,16 @@ jobs:
         language: [ 'go' ]
     steps:
     - name: Checkout repository
-      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea # v3.26.11
+      uses: github/codeql-action/init@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea # v3.26.11
+      uses: github/codeql-action/autobuild@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea # v3.26.11
+      uses: github/codeql-action/analyze@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12

.github/workflows/dependency_review.yml

@@ -23,6 +23,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

.github/workflows/main.yml

@@ -35,9 +35,9 @@ jobs:
       OS: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
-      - uses: actions/cache@2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 # v4.1.0
+      - uses: actions/cache@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4.1.1
         with:
           # In order:
           # * Module download cache

.github/workflows/reusable_monitoring.yml

@@ -59,7 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [detect-workflow]
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           repository: ${{ needs.detect-workflow.outputs.repository }}
           ref: "${{ needs.detect-workflow.outputs.ref }}"
@@ -78,7 +78,7 @@ jobs:
         continue-on-error: true
       - run: go run ./cmd/verifier --file ${{ env.LOG_FILE }} --once --monitored-values "${{ inputs.identities }}" --user-agent "${{ format('{0}/{1}/{2}', needs.detect-workflow.outputs.repository, needs.detect-workflow.outputs.ref, github.run_id) }}"
       - name: Upload checkpoint
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: ${{ env.UPLOADED_LOG_NAME }}
           path: ${{ env.LOG_FILE }}
@@ -96,7 +96,7 @@ jobs:
       ISSUE_REPOSITORY: ${{ github.repository }}
     if: ${{ needs.monitor.result == 'success' && inputs.file_issue }}
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           repository: ${{ needs.detect-workflow.outputs.repository }}
           ref: "${{ needs.detect-workflow.outputs.ref }}"
@@ -114,7 +114,7 @@ jobs:
       ISSUE_REPOSITORY: ${{ github.repository }}
     if: ${{ always() && needs.monitor.result == 'failure' && inputs.file_issue }}
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           repository: ${{ needs.detect-workflow.outputs.repository }}
           ref: "${{ needs.detect-workflow.outputs.ref }}"

.github/workflows/verify.yml

@@ -25,7 +25,7 @@ jobs:
     name: license boilerplate check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version-file: './go.mod'
@@ -41,7 +41,7 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version-file: './go.mod'

Dockerfile

@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.23.2@sha256:adee809c2d0009a4199a11a1b2618990b244c6515149fe609e2788ddf164bd10 as builder
+FROM golang:1.23.2@sha256:a7f2fc9834049c1f5df787690026a53738e55fc097cd8a4a93faa3e06c67ee32 as builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -29,7 +29,7 @@ RUN go build ./cmd/verifier
 RUN CGO_ENABLED=0 go build -gcflags "all=-N -l"  -o verifier_debug ./cmd/verifier
 
 # Multi-Stage build
-FROM golang:1.23.2@sha256:adee809c2d0009a4199a11a1b2618990b244c6515149fe609e2788ddf164bd10 as deploy
+FROM golang:1.23.2@sha256:a7f2fc9834049c1f5df787690026a53738e55fc097cd8a4a93faa3e06c67ee32 as deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/verifier /usr/local/bin/verifier

pkg/identity/identity.go

@@ -151,3 +151,8 @@ func CreateMonitoredIdentities(inputIdentityEntries []RekorLogEntry, monitoredId
 
 	return parsedMonitoredIdentities
 }
+
+// MonitoredValuesExist checks if there are monitored values in an input and returns accordingly.
+func MonitoredValuesExist(mvs MonitoredValues) bool {
+	return (len(mvs.CertificateIdentities) > 0 || len(mvs.Fingerprints) > 0 || len(mvs.OIDMatchers) > 0 || len(mvs.Subjects) > 0)
+}

pkg/identity/identity_test.go

@@ -15,10 +15,13 @@
 package identity
 
 import (
+	"encoding/asn1"
 	"reflect"
 	"sort"
 	"strings"
 	"testing"
+
+	"github.com/sigstore/rekor-monitor/pkg/fulcio/extensions"
 )
 
 // Test RekorLogEntry.String()
@@ -217,3 +220,56 @@ func TestPrintMonitoredIdentities(t *testing.T) {
 		t.Errorf("expected parsed monitored identity to equal %s, got %s", expectedParsedMonitoredIdentityOutput, parsedMonitoredIdentityFields)
 	}
 }
+
+func TestMonitoredValuesExist(t *testing.T) {
+	testCases := map[string]struct {
+		mvs      MonitoredValues
+		expected bool
+	}{
+		"empty case": {
+			mvs:      MonitoredValues{},
+			expected: false,
+		},
+		"fingerprints": {
+			mvs: MonitoredValues{
+				Fingerprints: []string{"test fingerprint"},
+			},
+			expected: true,
+		},
+		"subjects": {
+			mvs: MonitoredValues{
+				Subjects: []string{"test subject"},
+			},
+			expected: true,
+		},
+		"certificate identities": {
+			mvs: MonitoredValues{
+				CertificateIdentities: []CertificateIdentity{
+					{
+						CertSubject: "test cert subject",
+						Issuers:     []string{"test issuer"},
+					},
+				},
+			},
+			expected: true,
+		},
+		"oid matchers": {
+			mvs: MonitoredValues{
+				OIDMatchers: []extensions.OIDMatcher{
+					{
+						ObjectIdentifier: asn1.ObjectIdentifier{1},
+						ExtensionValues:  []string{"test extension value"},
+					},
+				},
+			},
+			expected: true,
+		},
+	}
+	for testCaseName, testCase := range testCases {
+		result := MonitoredValuesExist(testCase.mvs)
+		expected := testCase.expected
+		if result != expected {
+			t.Errorf("%s failed: expected %t, received %t", testCaseName, result, expected)
+		}
+	}
+}

pkg/rekor/identity.go

@@ -151,7 +151,7 @@ func MatchedIndices(logEntries []models.LogEntry, mvs identity.MonitoredValues)
 
 // verifyMonitoredValues checks that monitored values are valid
 func verifyMonitoredValues(mvs identity.MonitoredValues) error {
-	if len(mvs.CertificateIdentities) == 0 && len(mvs.Fingerprints) == 0 && len(mvs.Subjects) == 0 && len(mvs.OIDMatchers) == 0 {
+	if !identity.MonitoredValuesExist(mvs) {
 		return errors.New("no identities provided to monitor")
 	}
 	for _, certID := range mvs.CertificateIdentities {
@@ -352,7 +352,7 @@ func writeIdentitiesBetweenCheckpoints(logInfo *models.LogInfo, prevCheckpoint *
 	endIndex := int(checkpoint.Size) + totalSize - 1       //nolint: gosec // G115
 
 	// Search for identities in the log range
-	if len(monitoredValues.CertificateIdentities) > 0 || len(monitoredValues.Fingerprints) > 0 || len(monitoredValues.Subjects) > 0 || len(monitoredValues.OIDMatchers) > 0 {
+	if identity.MonitoredValuesExist(monitoredValues) {
 		entries, err := GetEntriesByIndexRange(context.Background(), rekorClient, startIndex, endIndex)
 		if err != nil {
 			return fmt.Errorf("error getting entries by index range: %v", err)