Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rework pkg/tlog/entry.go to not depend on sigstore/rekor/pkg/types #28

Closed
wants to merge 1 commit into from
Closed

Rework pkg/tlog/entry.go to not depend on sigstore/rekor/pkg/types #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions pkg/testing/ca/ca.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@ import (
"github.com/sigstore/rekor/pkg/pki"
"github.com/sigstore/rekor/pkg/types"
"github.com/sigstore/rekor/pkg/types/hashedrekord"
hashedrekord_v001 "github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1"
"github.com/sigstore/rekor/pkg/types/intoto"
intoto_v002 "github.com/sigstore/rekor/pkg/types/intoto/v0.0.2"
"github.com/sigstore/rekor/pkg/types/rekord"
"github.com/sigstore/sigstore-go/pkg/bundle"
"github.com/sigstore/sigstore-go/pkg/root"
Expand Down Expand Up @@ -256,7 +258,7 @@ func (ca *VirtualSigstore) generateTlogEntry(leafCert *x509.Certificate, envelop
return nil, err
}

rekorBody, err := generateRekorEntry(intoto.KIND, intoto.New().DefaultVersion(), envelopeBytes, leafCertPem, sig)
rekorBody, err := generateRekorEntry(intoto.KIND, intoto_v002.APIVERSION, envelopeBytes, leafCertPem, sig)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -293,7 +295,7 @@ func (ca *VirtualSigstore) generateTlogEntryHashedRekord(leafCert *x509.Certific
return nil, err
}

rekorBody, err := generateRekorEntry(hashedrekord.KIND, hashedrekord.New().DefaultVersion(), artifact, leafCertPem, sig)
rekorBody, err := generateRekorEntry(hashedrekord.KIND, hashedrekord_v001.APIVERSION, artifact, leafCertPem, sig)
if err != nil {
return nil, err
}
Expand Down
172 changes: 128 additions & 44 deletions pkg/tlog/entry.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,22 +34,23 @@ import (
"github.com/go-openapi/swag"
v1 "github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1"
"github.com/sigstore/rekor/pkg/generated/models"
"github.com/sigstore/rekor/pkg/types"
dsse_v001 "github.com/sigstore/rekor/pkg/types/dsse/v0.0.1"
hashedrekord_v001 "github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1"
intoto_v002 "github.com/sigstore/rekor/pkg/types/intoto/v0.0.2"
rekorVerify "github.com/sigstore/rekor/pkg/verify"
"github.com/sigstore/sigstore/pkg/signature"

"github.com/sigstore/sigstore-go/pkg/root"
)

const dsse string = "dsse"
const hashedrekord string = "hashedrekord"
const intoto string = "intoto"
const v001 string = "0.0.1"
const v002 string = "0.0.2"

type Entry struct {
kind string
version string
rekorEntry types.EntryImpl
rekorEntry models.ProposedEntry
logEntryAnon models.LogEntryAnon
signedEntryTimestamp []byte
version string
}

type RekorPayload struct {
Expand All @@ -66,21 +67,24 @@ func NewEntry(body []byte, integratedTime int64, logIndex int64, logID []byte, s
if err != nil {
return nil, err
}
rekorEntry, err := types.UnmarshalEntry(pe)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One downside to removing this is there's certain correctness checks that occur during unmarshalling that will now be skipped.

if err != nil {
return nil, err
}

entry := &Entry{
rekorEntry: rekorEntry,
rekorEntry: pe,
logEntryAnon: models.LogEntryAnon{
Body: base64.StdEncoding.EncodeToString(body),
IntegratedTime: swag.Int64(integratedTime),
LogIndex: swag.Int64(logIndex),
LogID: swag.String(string(logID)),
},
kind: pe.Kind(),
version: rekorEntry.APIVersion(),
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is kind needed?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We retain the pe object on rekorEntry, so we just call rekorEntry.Kind() when we need it (see below).


switch entry.rekorEntry.Kind() {
case dsse:
entry.version = *(pe.(*models.DSSE).APIVersion)
case hashedrekord:
entry.version = *(pe.(*models.Hashedrekord).APIVersion)
case intoto:
entry.version = *(pe.(*models.Intoto).APIVersion)
}

if len(signedEntryTimestamp) > 0 {
Expand Down Expand Up @@ -138,32 +142,32 @@ func ParseEntry(protoEntry *v1.TransparencyLogEntry) (entry *Entry, err error) {
return nil, err
}

if entry.kind != protoEntry.KindVersion.Kind || entry.version != protoEntry.KindVersion.Version {
return nil, fmt.Errorf("kind and version mismatch: %s/%s != %s/%s", entry.kind, entry.version, protoEntry.KindVersion.Kind, protoEntry.KindVersion.Version)
if entry.rekorEntry.Kind() != protoEntry.KindVersion.Kind || entry.version != protoEntry.KindVersion.Version {
return nil, fmt.Errorf("kind and version mismatch: %s/%s != %s/%s", entry.rekorEntry.Kind(), entry.version, protoEntry.KindVersion.Kind, protoEntry.KindVersion.Version)
}

return entry, nil
}

func ValidateEntry(entry *Entry) error {
switch e := entry.rekorEntry.(type) {
case *dsse_v001.V001Entry:
err := e.DSSEObj.Validate(strfmt.Default)
switch entry.rekorEntry.Kind() {
case dsse:
err := entry.rekorEntry.(*models.DSSE).Validate(strfmt.Default)
if err != nil {
return err
}
case *hashedrekord_v001.V001Entry:
err := e.HashedRekordObj.Validate(strfmt.Default)
case hashedrekord:
err := entry.rekorEntry.(*models.Hashedrekord).Validate(strfmt.Default)
if err != nil {
return err
}
case *intoto_v002.V002Entry:
err := e.IntotoObj.Validate(strfmt.Default)
case intoto:
err := entry.rekorEntry.(*models.Intoto).Validate(strfmt.Default)
if err != nil {
return err
}
default:
return fmt.Errorf("unsupported entry type: %T", e)
return fmt.Errorf("unsupported entry type: %s", entry.rekorEntry.Kind())
}

return nil
Expand All @@ -174,21 +178,62 @@ func (entry *Entry) IntegratedTime() time.Time {
}

func (entry *Entry) Signature() []byte {
switch e := entry.rekorEntry.(type) {
case *dsse_v001.V001Entry:
sigBytes, err := base64.StdEncoding.DecodeString(*e.DSSEObj.Signatures[0].Signature)
if err != nil {
return []byte{}
switch entry.rekorEntry.Kind() {
case dsse:
if entry.version == v001 {
specJSON, err := json.Marshal(entry.rekorEntry.(*models.DSSE).Spec)
if err != nil {
return []byte{}
}

dsseObj := &models.DSSEV001Schema{}
err = json.Unmarshal(specJSON, dsseObj)
if err != nil {
return []byte{}
}

signature := *dsseObj.Signatures[0].Signature
sigBytes, err := base64.StdEncoding.DecodeString(string(signature))
if err != nil {
return []byte{}
}
return sigBytes
}
return sigBytes
case *hashedrekord_v001.V001Entry:
return e.HashedRekordObj.Signature.Content
case *intoto_v002.V002Entry:
sigBytes, err := base64.StdEncoding.DecodeString(string(*e.IntotoObj.Content.Envelope.Signatures[0].Sig))
if err != nil {
return []byte{}
case hashedrekord:
if entry.version == v001 {
specJSON, err := json.Marshal(entry.rekorEntry.(*models.Hashedrekord).Spec)
if err != nil {
return []byte{}
}

hashedrekordObj := &models.HashedrekordV001Schema{}
err = json.Unmarshal(specJSON, hashedrekordObj)
if err != nil {
return []byte{}
}

return hashedrekordObj.Signature.Content
}
case intoto:
if entry.version == v002 {
specJSON, err := json.Marshal(entry.rekorEntry.(*models.Intoto).Spec)
if err != nil {
return []byte{}
}

intotoObj := &models.IntotoV002Schema{}
err = json.Unmarshal(specJSON, intotoObj)
if err != nil {
return []byte{}
}

signature := *intotoObj.Content.Envelope.Signatures[0].Sig
sigBytes, err := base64.StdEncoding.DecodeString(string(signature))
if err != nil {
return []byte{}
}
return sigBytes
}
return sigBytes
}

return []byte{}
Expand All @@ -197,13 +242,52 @@ func (entry *Entry) Signature() []byte {
func (entry *Entry) PublicKey() any {
var pemString []byte

switch e := entry.rekorEntry.(type) {
case *dsse_v001.V001Entry:
pemString = []byte(*e.DSSEObj.Signatures[0].Verifier)
case *hashedrekord_v001.V001Entry:
pemString = []byte(e.HashedRekordObj.Signature.PublicKey.Content)
case *intoto_v002.V002Entry:
pemString = []byte(*e.IntotoObj.Content.Envelope.Signatures[0].PublicKey)
switch entry.rekorEntry.Kind() {
case dsse:
if entry.version == v001 {
specJSON, err := json.Marshal(entry.rekorEntry.(*models.DSSE).Spec)
if err != nil {
return []byte{}
}

dsseObj := &models.DSSEV001Schema{}
err = json.Unmarshal(specJSON, dsseObj)
if err != nil {
return nil
}

pemString = []byte(*dsseObj.Signatures[0].Verifier)
}
case hashedrekord:
if entry.version == v001 {
specJSON, err := json.Marshal(entry.rekorEntry.(*models.Hashedrekord).Spec)
if err != nil {
return []byte{}
}

hashedrekordObj := &models.HashedrekordV001Schema{}
err = json.Unmarshal(specJSON, hashedrekordObj)
if err != nil {
return nil
}

pemString = []byte(hashedrekordObj.Signature.PublicKey.Content)
}
case intoto:
if entry.version == v002 {
specJSON, err := json.Marshal(entry.rekorEntry.(*models.Intoto).Spec)
if err != nil {
return []byte{}
}

intotoObj := &models.IntotoV002Schema{}
err = json.Unmarshal(specJSON, intotoObj)
if err != nil {
return []byte{}
}

pemString = []byte(*intotoObj.Content.Envelope.Signatures[0].PublicKey)
}
}

certBlock, _ := pem.Decode(pemString)
Expand Down
Loading