Skip to content

Commit a2cbeda

Browse files
haydentherapperhaydentherapper
authored
Add support for SigningConfig in sign/attest (#4371)
* Add support for SigningConfig in sign/attest This will indirectly add support for signing with Rekor v2, since signing will be handled by sigstore-go rather than Cosign. This also brings sign/attest up to par with sign-blob/attest-blob with respect to signing with a key and providing a trusted root when providing a signing config. This feature is gated behind one of two signing config flags, which in a later version of Cosign will be flipped to on by default. Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com> * Address review comments --signing-config and --use-signing-config are now mutually exclusive. TrustedMaterial and SigningConfig are set in the same line as fetching the trusted root and signing config. Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com> --------- Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
1 parent eed2a11 commit a2cbeda

File tree

13 files changed

+400
-59
lines changed

13 files changed

+400
-59
lines changed

‎cmd/cosign/cli/attest.go‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
"github.com/sigstore/cosign/v2/internal/ui"
2626
"github.com/sigstore/cosign/v2/pkg/cosign"
2727
"github.com/sigstore/cosign/v2/pkg/cosign/env"
28+
"github.com/sigstore/sigstore-go/pkg/root"
2829
"github.com/spf13/cobra"
2930
)
3031

@@ -101,14 +102,39 @@ func Attest() *cobra.Command {
101102
IssueCertificateForExistingKey: o.IssueCertificate,
102103
NewBundleFormat: o.NewBundleFormat,
103104
}
104-
if o.Key == "" && env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "" { // Get the trusted root if using fulcio for signing
105-
trustedMaterial, err := cosign.TrustedRoot()
105+
// Fetch a trusted root when:
106+
// * requesting a certificate and no CT log key is provided to verify an SCT
107+
// * using a signing config and signing using sigstore-go
108+
if (o.Key == "" && env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "") ||
109+
(o.UseSigningConfig || o.SigningConfigPath != "") {
110+
if o.TrustedRootPath != "" {
111+
ko.TrustedMaterial, err = root.NewTrustedRootFromPath(o.TrustedRootPath)
112+
if err != nil {
113+
return fmt.Errorf("loading trusted root: %w", err)
114+
}
115+
} else {
116+
ko.TrustedMaterial, err = cosign.TrustedRoot()
117+
if err != nil {
118+
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
119+
}
120+
}
121+
}
122+
123+
if (o.UseSigningConfig || o.SigningConfigPath != "") && !o.NewBundleFormat {
124+
return fmt.Errorf("must provide --new-bundle-format with --signing-config or --use-signing-config")
125+
}
126+
if o.UseSigningConfig {
127+
ko.SigningConfig, err = cosign.SigningConfig()
106128
if err != nil {
107-
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
129+
return fmt.Errorf("error getting signing config from TUF: %w", err)
130+
}
131+
} else if o.SigningConfigPath != "" {
132+
ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
133+
if err != nil {
134+
return fmt.Errorf("error reading signing config from file: %w", err)
108135
}
109-
ko.TrustedMaterial = trustedMaterial
110136
}
111-
// TODO(#4324): Add support for SigningConfig
137+
112138
attestCommand := attest.AttestCommand{
113139
KeyOpts: ko,
114140
RegistryOptions: o.Registry,

‎cmd/cosign/cli/attest/attest.go‎

Lines changed: 83 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,9 @@ import (
2929

3030
"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
3131
"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
32-
"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
32+
cosign_sign "github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
33+
"github.com/sigstore/cosign/v2/internal/auth"
34+
"github.com/sigstore/cosign/v2/internal/key"
3335
"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa"
3436
tsaclient "github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa/client"
3537
"github.com/sigstore/cosign/v2/internal/ui"
@@ -43,13 +45,14 @@ import (
4345
"github.com/sigstore/cosign/v2/pkg/types"
4446
"github.com/sigstore/rekor/pkg/generated/client"
4547
"github.com/sigstore/rekor/pkg/generated/models"
48+
"github.com/sigstore/sigstore-go/pkg/sign"
4649
"github.com/sigstore/sigstore/pkg/signature/dsse"
4750
signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
4851
)
4952

5053
type tlogUploadFn func(*client.Rekor, []byte) (*models.LogEntryAnon, error)
5154

52-
func uploadToTlog(ctx context.Context, sv *sign.SignerVerifier, rekorURL string, upload tlogUploadFn) (*models.LogEntryAnon, error) {
55+
func uploadToTlog(ctx context.Context, sv *cosign_sign.SignerVerifier, rekorURL string, upload tlogUploadFn) (*models.LogEntryAnon, error) {
5356
rekorBytes, err := sv.Bytes(ctx)
5457
if err != nil {
5558
return nil, err
@@ -132,20 +135,6 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {
132135
// each access.
133136
ref = digest // nolint
134137

135-
sv, genKey, err := sign.SignerFromKeyOpts(ctx, c.CertPath, c.CertChainPath, c.KeyOpts)
136-
if err != nil {
137-
return fmt.Errorf("getting signer: %w", err)
138-
}
139-
if genKey || c.IssueCertificateForExistingKey {
140-
sv, err = sign.KeylessSigner(ctx, c.KeyOpts, sv)
141-
if err != nil {
142-
return fmt.Errorf("getting Fulcio signer: %w", err)
143-
}
144-
}
145-
defer sv.Close()
146-
wrapped := dsse.WrapSigner(sv, types.IntotoPayloadType)
147-
dd := cremote.NewDupeDetector(sv)
148-
149138
predicate, err := predicateReader(c.PredicatePath)
150139
if err != nil {
151140
return fmt.Errorf("getting predicate reader: %w", err)
@@ -166,6 +155,83 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {
166155
if err != nil {
167156
return err
168157
}
158+
159+
if c.SigningConfig != nil {
160+
var keypair sign.Keypair
161+
var ephemeralKeypair bool
162+
var idToken string
163+
var sv *cosign_sign.SignerVerifier
164+
var err error
165+
166+
if c.Sk || c.Slot != "" || c.KeyRef != "" || c.CertPath != "" {
167+
sv, _, err = cosign_sign.SignerFromKeyOpts(ctx, c.CertPath, c.CertChainPath, c.KeyOpts)
168+
if err != nil {
169+
return fmt.Errorf("getting signer: %w", err)
170+
}
171+
keypair, err = key.NewSignerVerifierKeypair(sv, c.DefaultLoadOptions)
172+
if err != nil {
173+
return fmt.Errorf("creating signerverifier keypair: %w", err)
174+
}
175+
} else {
176+
keypair, err = sign.NewEphemeralKeypair(nil)
177+
if err != nil {
178+
return fmt.Errorf("generating keypair: %w", err)
179+
}
180+
ephemeralKeypair = true
181+
}
182+
defer func() {
183+
if sv != nil {
184+
sv.Close()
185+
}
186+
}()
187+
188+
if ephemeralKeypair || c.IssueCertificateForExistingKey {
189+
idToken, err = auth.RetrieveIDToken(ctx, auth.IDTokenConfig{
190+
TokenOrPath: c.IDToken,
191+
DisableProviders: c.OIDCDisableProviders,
192+
Provider: c.OIDCProvider,
193+
AuthFlow: c.FulcioAuthFlow,
194+
SkipConfirm: c.SkipConfirmation,
195+
OIDCServices: c.SigningConfig.OIDCProviderURLs(),
196+
ClientID: c.OIDCClientID,
197+
ClientSecret: c.OIDCClientSecret,
198+
RedirectURL: c.OIDCRedirectURL,
199+
})
200+
if err != nil {
201+
return fmt.Errorf("retrieving ID token: %w", err)
202+
}
203+
}
204+
205+
content := &sign.DSSEData{
206+
Data: payload,
207+
PayloadType: "application/vnd.in-toto+json",
208+
}
209+
bundle, err := cbundle.SignData(content, keypair, idToken, c.SigningConfig, c.TrustedMaterial)
210+
if err != nil {
211+
return fmt.Errorf("signing bundle: %w", err)
212+
}
213+
214+
ociremoteOpts, err := c.RegistryOptions.ClientOpts(ctx)
215+
if err != nil {
216+
return err
217+
}
218+
return ociremote.WriteAttestationNewBundleFormat(digest, bundle, types.CosignSignPredicateType, ociremoteOpts...)
219+
}
220+
221+
sv, genKey, err := cosign_sign.SignerFromKeyOpts(ctx, c.CertPath, c.CertChainPath, c.KeyOpts)
222+
if err != nil {
223+
return fmt.Errorf("getting signer: %w", err)
224+
}
225+
if genKey || c.IssueCertificateForExistingKey {
226+
sv, err = cosign_sign.KeylessSigner(ctx, c.KeyOpts, sv)
227+
if err != nil {
228+
return fmt.Errorf("getting Fulcio signer: %w", err)
229+
}
230+
}
231+
defer sv.Close()
232+
wrapped := dsse.WrapSigner(sv, types.IntotoPayloadType)
233+
dd := cremote.NewDupeDetector(sv)
234+
169235
signedPayload, err := wrapped.SignMessage(bytes.NewReader(payload), signatureoptions.WithContext(ctx))
170236
if err != nil {
171237
return fmt.Errorf("signing: %w", err)
@@ -227,7 +293,7 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {
227293
opts = append(opts, static.WithAnnotations(predicateTypeAnnotation))
228294

229295
// Check whether we should be uploading to the transparency log
230-
shouldUpload, err := sign.ShouldUploadToTlog(ctx, c.KeyOpts, digest, c.TlogUpload)
296+
shouldUpload, err := cosign_sign.ShouldUploadToTlog(ctx, c.KeyOpts, digest, c.TlogUpload)
231297
if err != nil {
232298
return fmt.Errorf("should upload to tlog: %w", err)
233299
}

‎cmd/cosign/cli/attest_blob.go‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -101,28 +101,25 @@ func AttestBlob() *cobra.Command {
101101
return fmt.Errorf("loading trusted root: %w", err)
102102
}
103103
} else {
104-
trustedMaterial, err := cosign.TrustedRoot()
104+
ko.TrustedMaterial, err = cosign.TrustedRoot()
105105
if err != nil {
106106
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
107107
}
108-
ko.TrustedMaterial = trustedMaterial
109108
}
110109
}
111110
if (o.UseSigningConfig || o.SigningConfigPath != "") && o.BundlePath == "" {
112111
return fmt.Errorf("must provide --bundle with --signing-config or --use-signing-config")
113112
}
114113
if o.UseSigningConfig {
115-
signingConfig, err := cosign.SigningConfig()
114+
ko.SigningConfig, err = cosign.SigningConfig()
116115
if err != nil {
117116
return fmt.Errorf("error getting signing config from TUF: %w", err)
118117
}
119-
ko.SigningConfig = signingConfig
120118
} else if o.SigningConfigPath != "" {
121-
signingConfig, err := root.NewSigningConfigFromPath(o.SigningConfigPath)
119+
ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
122120
if err != nil {
123121
return fmt.Errorf("error reading signing config from file: %w", err)
124122
}
125-
ko.SigningConfig = signingConfig
126123
}
127124

128125
v := attest.AttestBlobCommand{

‎cmd/cosign/cli/options/attest.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ type AttestOptions struct {
3939
RekorEntryType string
4040
RecordCreationTimestamp bool
4141
NewBundleFormat bool
42+
UseSigningConfig bool
43+
SigningConfigPath string
44+
TrustedRootPath string
4245

4346
Rekor RekorOptions
4447
Fulcio FulcioOptions
@@ -111,5 +114,18 @@ func (o *AttestOptions) AddFlags(cmd *cobra.Command) {
111114
cmd.Flags().BoolVar(&o.IssueCertificate, "issue-certificate", false,
112115
"issue a code signing certificate from Fulcio, even if a key is provided")
113116

117+
// TODO: have this default to true as a breaking change
114118
cmd.Flags().BoolVar(&o.NewBundleFormat, "new-bundle-format", false, "attach a Sigstore bundle using OCI referrers API")
119+
120+
// TODO: have this default to true as a breaking change
121+
cmd.Flags().BoolVar(&o.UseSigningConfig, "use-signing-config", false,
122+
"whether to use a TUF-provided signing config for the service URLs. Must set --new-bundle-format, which will store verification material in the new format")
123+
124+
cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
125+
"path to a signing config file. Must provide --new-bundle-format, which will store verification material in the new format")
126+
127+
cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
128+
129+
cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
130+
"optional path to a TrustedRoot JSON file to verify a signature after signing")
115131
}

‎cmd/cosign/cli/options/attest_blob.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ func (o *AttestBlobOptions) AddFlags(cmd *cobra.Command) {
109109
cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
110110
"path to a signing config file. Must provide --bundle, which will output verification material in the new format")
111111

112+
cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
113+
112114
cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
113115
"optional path to a TrustedRoot JSON file to verify a signature after signing")
114116

‎cmd/cosign/cli/options/sign.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ type SignOptions struct {
4343
SignContainerIdentity string
4444
RecordCreationTimestamp bool
4545
NewBundleFormat bool
46+
UseSigningConfig bool
47+
SigningConfigPath string
48+
TrustedRootPath string
4649

4750
Rekor RekorOptions
4851
Fulcio FulcioOptions
@@ -139,5 +142,18 @@ func (o *SignOptions) AddFlags(cmd *cobra.Command) {
139142

140143
cmd.Flags().BoolVar(&o.RecordCreationTimestamp, "record-creation-timestamp", false, "set the createdAt timestamp in the signature artifact to the time it was created; by default, cosign sets this to the zero value")
141144

145+
// TODO: have this default to true as a breaking change
142146
cmd.Flags().BoolVar(&o.NewBundleFormat, "new-bundle-format", false, "expect the signature/attestation to be packaged in a Sigstore bundle")
147+
148+
// TODO: have this default to true as a breaking change
149+
cmd.Flags().BoolVar(&o.UseSigningConfig, "use-signing-config", false,
150+
"whether to use a TUF-provided signing config for the service URLs. Must set --new-bundle-format, which will store verification material in the new format")
151+
152+
cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
153+
"path to a signing config file. Must provide --new-bundle-format, which will store verification material in the new format")
154+
155+
cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
156+
157+
cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
158+
"optional path to a TrustedRoot JSON file to verify a signature after signing")
143159
}

‎cmd/cosign/cli/options/signblob.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,8 @@ func (o *SignBlobOptions) AddFlags(cmd *cobra.Command) {
9292
cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
9393
"path to a signing config file. Must provide --bundle, which will output verification material in the new format")
9494

95+
cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
96+
9597
cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
9698
"optional path to a TrustedRoot JSON file to verify a signature after signing")
9799

‎cmd/cosign/cli/sign.go‎

Lines changed: 31 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626
"github.com/sigstore/cosign/v2/internal/ui"
2727
"github.com/sigstore/cosign/v2/pkg/cosign"
2828
"github.com/sigstore/cosign/v2/pkg/cosign/env"
29+
"github.com/sigstore/sigstore-go/pkg/root"
2930
"github.com/spf13/cobra"
3031
)
3132

@@ -131,13 +132,39 @@ race conditions or (worse) malicious tampering.
131132
TSAServerURL: o.TSAServerURL,
132133
IssueCertificateForExistingKey: o.IssueCertificate,
133134
}
134-
if (o.Key == "" || o.IssueCertificate) && env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "" {
135-
trustedMaterial, err := cosign.TrustedRoot()
135+
// Fetch a trusted root when:
136+
// * requesting a certificate and no CT log key is provided to verify an SCT
137+
// * using a signing config and signing using sigstore-go
138+
if ((o.Key == "" || o.IssueCertificate) && env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "") ||
139+
(o.UseSigningConfig || o.SigningConfigPath != "") {
140+
if o.TrustedRootPath != "" {
141+
ko.TrustedMaterial, err = root.NewTrustedRootFromPath(o.TrustedRootPath)
142+
if err != nil {
143+
return fmt.Errorf("loading trusted root: %w", err)
144+
}
145+
} else {
146+
ko.TrustedMaterial, err = cosign.TrustedRoot()
147+
if err != nil {
148+
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
149+
}
150+
}
151+
}
152+
153+
if (o.UseSigningConfig || o.SigningConfigPath != "") && !o.NewBundleFormat {
154+
return fmt.Errorf("must provide --new-bundle-format with --signing-config or --use-signing-config")
155+
}
156+
if o.UseSigningConfig {
157+
ko.SigningConfig, err = cosign.SigningConfig()
136158
if err != nil {
137-
ui.Warnf(context.Background(), "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
159+
return fmt.Errorf("error getting signing config from TUF: %w", err)
160+
}
161+
} else if o.SigningConfigPath != "" {
162+
ko.SigningConfig, err = root.NewSigningConfigFromPath(o.SigningConfigPath)
163+
if err != nil {
164+
return fmt.Errorf("error reading signing config from file: %w", err)
138165
}
139-
ko.TrustedMaterial = trustedMaterial
140166
}
167+
141168
if err := sign.SignCmd(ro, ko, *o, args); err != nil {
142169
if o.Attachment == "" {
143170
return fmt.Errorf("signing %v: %w", args, err)

0 commit comments

Comments
 (0)