-
Notifications
You must be signed in to change notification settings - Fork 6
/
code_sign.go
75 lines (66 loc) · 1.86 KB
/
code_sign.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
package examples
import (
"crypto/x509"
"log"
baseca "github.com/coinbase/baseca/pkg/client"
"github.com/coinbase/baseca/pkg/types"
)
func CodeSign() {
client, err := baseca.NewClient("localhost:9090", baseca.Attestation.Local,
baseca.WithClientId("CLIENT_ID"), baseca.WithClientToken("CLIENT_TOKEN"),
baseca.WithInsecure())
if err != nil {
log.Fatal(err)
}
metadata := types.Signature{
CertificateRequest: types.CertificateRequest{
CommonName: "example.coinbase.com",
SubjectAlternateNames: []string{"example.coinbase.com"},
SigningAlgorithm: x509.ECDSAWithSHA512,
PublicKeyAlgorithm: x509.ECDSA,
KeySize: 256,
Output: types.Output{
PrivateKey: "/tmp/private.key",
Certificate: "/tmp/certificate.crt",
IntermediateCertificateChain: "/tmp/intermediate_chain.crt",
RootCertificateChain: "/tmp/root_chain.crt",
CertificateSigningRequest: "/tmp/certificate_request.csr",
},
DistinguishedName: types.DistinguishedName{
Organization: []string{"Coinbase"},
},
},
SigningAlgorithm: x509.ECDSAWithSHA512,
Data: types.Data{
Path: types.Path{
File: "/path/to/artifact",
Buffer: 4096,
},
},
}
signature, chain, err := client.GenerateSignature(metadata)
if err != nil {
log.Fatal(err)
}
// Validation Happens on Different Server
manifest := types.Manifest{
CertificateChain: chain,
Signature: signature,
SigningAlgorithm: x509.ECDSAWithSHA512,
Data: types.Data{
Path: types.Path{
File: "/path/to/artifact",
Buffer: 4096,
},
},
}
tc := types.TrustChain{
CommonName: "example.coinbase.com",
CertificateAuthorityFiles: []string{"/path/to/intermetidate.crt"},
}
err = baseca.ValidateSignature(tc, manifest)
if err != nil {
log.Fatal(err)
}
log.Print("Signature Verified")
}