implement a new flag for sign-blob subcommand to save certificate to disk or stdout #1016

shibumi · 2021-11-09T00:55:02Z

Summary

With cosign 1.3.0 it is not possible to store the public certificate generated by the OIDC-issuer in a convenient way.
To store the public key locally on disk, the user has to intercept the cosign stdout, parse it and store it.
This is inconvenient and error-prone. We want to make signing and public key distribution as easy as possible, hence this PR introduces a new pubkey-output flag for the sign-blob sub-command.

The pubkey-output flag respects the b64 flag and prints the certificate/key as file in a given file path.

Ticket Link

Fixes None

Release Note

The cosign cli is now able to store the public certificate/key during sign-blob operations via the `pubkey-output` flag.

asraa · 2021-11-09T15:12:51Z

cmd/cosign/cli/sign/sign_blob.go

@@ -76,9 +76,9 @@ func SignBlobCmd(ctx context.Context, ko KeyOpts, regOpts options.RegistryOption
 		return nil, errors.Wrap(err, "signing blob")
 	}

+	var rekorBytes []byte


It seems like this will only pick up the public key when COSIGN_EXPERIMENTAL=1 is enabled. That mostly makes sense to me since otherwise you probably already have the key, but I would caveat in the doc string or somewhere else.

May also be worth adding for the sign subcommand too?

developer-guy · 2021-11-10T13:33:11Z

we did the same in #1021

Dentrax · 2021-11-10T13:34:23Z

cmd/cosign/cli/options/signblob.go

@@ -49,4 +50,7 @@ func (o *SignBlobOptions) AddFlags(cmd *cobra.Command) {

 	cmd.Flags().StringVar(&o.Output, "output", "",
 		"write the signature to FILE")
+
+	cmd.Flags().StringVar(&o.PubKeyOutput, "pubkey-output", "",


What about changing this to --output-cert?

@Dentrax I was a little bit confused about cert and public key... because this does not need to be a certificate it can also be a pubkey, IIRC.

@asraa are you fine with changing this to --output-cert instead of -pubkey-output?

Thoughts? @dlorenc

I think it should always be a cert for the keyless modes right?

Yeah, i think that's more clear.

shibumi · 2021-11-10T13:36:05Z

we did the same in #1021

Yes :D just realized this. I like your PR more, but I am not sure if changing output to output-signature would break cosign's API stability.

developer-guy · 2021-11-10T13:53:28Z

we did the same in #1021

Yes :D just realized this. I like your PR more, but I am not sure if changing output to output-signature would break cosign's API stability.

Thanks, @shibumi, yes we know, but it makes more sense to us instead of using just output, WDYT to make it consistent?

dlorenc · 2021-11-10T14:31:24Z

Thanks, @shibumi, yes we know, but it makes more sense to us instead of using just output, WDYT to make it consistent?

I think I'm fine with this breaking change. It's pretty minor and important for usability. If we need to we could always alias it for a release in cobra.

shibumi · 2021-11-10T18:13:55Z

cmd/cosign/cli/options/signblob.go

@@ -22,16 +22,18 @@ import (
 )

 // SignBlobOptions is the top level wrapper for the sign-blob command.
+// The new output-certificate flag is only in use when COSIGN_EXPERIMENTAL is enabled


@asraa is this docstring on the right position? I thought about adding it to the SignBlob function, but the SignBlob function has a // nolint on top.. I am not sure if I can have docstrings and nolint at the same time.

shibumi · 2021-11-10T18:16:21Z

@developer-guy @dlorenc done. Or do you prefer the short form for commands? Right now I chose output-certificate and output-signature. I see that @developer-guy used output-cert and output-sig. Opinions?

Dentrax · 2021-11-10T18:56:32Z

@developer-guy @dlorenc done. Or do you prefer the short form for commands? Right now I chose output-certificate and output-signature. I see that @developer-guy used output-cert and output-sig. Opinions?

To make it more consistent with the --signature flag, I think it would better DX to use --output-signature, and eventually we should go with the --output-certificate if we decide to use long-form of signature instead of sig.

shibumi · 2021-11-10T22:04:03Z

Good argument @Dentrax

developer-guy · 2021-11-11T11:37:03Z

@shibumi would you mind adding I and friend @Dentrax as a collab to the project? Maybe we can add some code to this. 🤝🙋🏻‍♂️

shibumi · 2021-11-11T17:09:49Z

@developer-guy do you mean editor permissions to this PR? I have no idea if this is possible in Github. I think you can fork my fork and then create a PR against my fork and I could merge it in my fork :D

OR

You just drop me a patch file via mail.

What do you would like to change in this PR?

EDIT: or do you mean collab in the cosign repository? I am not involved with cosign, too :D :D

caarlos0

nice!

Dentrax · 2021-11-15T12:56:18Z

With the new release of goreleaser v1.0.0, I think we can merge this PR and plan to release on the upcoming cosign version. 🙏 Should we create Release v1.4 issue additionally to keep track of the next milestone? @cpanato @dlorenc

developer-guy · 2021-11-15T13:00:53Z

in addition to the comment above, with this, we will be able to do the following:

signs:
  - cmd: cosign
    certificate: "${artifact}.cert"
    signature: "${artifact}.sig"
    args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output-signature=${signature}", "--output-certificate=${certificate}",  "${artifact}"]

For more detail: ko-build/ko#498

dlorenc · 2021-11-15T13:23:50Z

This is amazing!

caarlos0 · 2021-11-15T13:48:17Z

Once this is out, I'll write a post on how to use it with goreleaser on github actions as well

dlorenc · 2021-11-15T14:23:35Z

Looks like this just needs docs to be regenerated!

shibumi · 2021-11-15T14:25:45Z

@dlorenc how do I regenerate the docs?

caarlos0 · 2021-11-15T14:26:00Z

BTW, this is a breaking change isnt it? As --output will not exist anymore...

Maybe worth deprecating it first?

dlorenc · 2021-11-15T14:31:21Z

@dlorenc how do I regenerate the docs?

Looks like: go run -tags pivkey,pkcs11key,cgo ./cmd/help/

BTW, this is a breaking change isnt it? As --output will not exist anymore...

Yeah, we probably should deprecate/alias first. I misunderstood and thought this flag only applied for experimental/keyless stuff, but it's used for normal blob signatures too. Great catch @caarlos0!

shibumi · 2021-11-15T14:37:57Z

Yeah, we probably should deprecate/alias first. I misunderstood and thought this flag only applied for experimental/keyless stuff, but it's used for normal blob signatures too. Great catch @caarlos0!

Sounds, good. Let me apply a new patch in the afternoon (that's in 2 hours in my time :D )

shibumi · 2021-11-15T23:04:51Z

regenerated docs
deprecated output flag

New behavior:

❯ COSIGN_EXPERIMENTAL=1 ./cosign sign-blob --output=main.go.sig --output-certificate=cert.pub --oidc-issuer https://oauth2.sigstore.dev/auth main.go
WARNING: the '--output' flag is deprecated and will be removed in the future. Use '--output-signature'
Using payload from: main.go
Generating ephemeral keys...
Retrieving signed certificate...
Your browser will now be opened to: ....

❯ COSIGN_EXPERIMENTAL=1 ./cosign sign-blob --output-signature=main.go.sig --output-certificate=cert.pub --oidc-issuer https://oauth2.sigstore.dev/auth main.go
Using payload from: main.go
Generating ephemeral keys...
Retrieving signed certificate...
Your browser will now be opened to: ...

developer-guy

LGTM, thanks @shibumi amazing work 👌🙋🏻‍♂️

shibumi · 2021-11-16T13:17:59Z

@dlorenc The generate doc command does not seem to be sufficient.. I have generated the docs with it, but the pipeline still fails.

developer-guy · 2021-11-16T13:28:57Z

@shibumi I think you should run goimports -w ./....

This commit breaks with past behavior in favor of two new flags. The `output` flags gets replaced with the new `output-signature` and `output-certificate` flags. Signed-off-by: Christian Rebischke <chris@shibumi.dev>

developer-guy · 2021-11-16T13:36:24Z

@dlorenc IMHO, this PR is ready for merge.

shibumi · 2021-11-16T15:21:10Z

@developer-guy thanks for your hint to goimports. I didn't know that exists :D

developer-guy · 2021-11-16T15:22:26Z

@developer-guy thanks for your hint to goimports. I didn't know that exists :D

I added two new targets to the makefile: fmt and checkfmt. You can use them now 🙋🏻‍♂️

caarlos0 · 2021-11-19T17:13:02Z

👀

shibumi force-pushed the shibumi/implement-pubkey-output branch from 425f781 to 74a15c9 Compare November 9, 2021 00:55

shibumi mentioned this pull request Nov 9, 2021

add signed releases in-toto/in-toto-golang#128

Draft

2 tasks

asraa reviewed Nov 9, 2021

View reviewed changes

This was referenced Nov 10, 2021

feat: add output cert for keyless #1021

Closed

Support Cosign keyless signing & verification goreleaser/goreleaser#2659

Closed

dlorenc mentioned this pull request Nov 10, 2021

Using sign-blob with a transparency log should output cert to disk #936

Closed

Dentrax reviewed Nov 10, 2021

View reviewed changes

Dentrax mentioned this pull request Nov 10, 2021

feat: sign checksum using cosign ko-build/ko#498

Closed

shibumi force-pushed the shibumi/implement-pubkey-output branch 2 times, most recently from 54280e4 to 77706ed Compare November 10, 2021 18:13

shibumi commented Nov 10, 2021

View reviewed changes

shibumi force-pushed the shibumi/implement-pubkey-output branch from 77706ed to 3eaf1e6 Compare November 10, 2021 18:15

developer-guy changed the title ~~implement pubkey-output flag for sign-blob subcommand~~ implement new flag for sign-blob subcommand to save certificate to disk or stdout Nov 11, 2021

developer-guy changed the title ~~implement new flag for sign-blob subcommand to save certificate to disk or stdout~~ implement a new flag for sign-blob subcommand to save certificate to disk or stdout Nov 11, 2021

caarlos0 approved these changes Nov 12, 2021

View reviewed changes

shibumi force-pushed the shibumi/implement-pubkey-output branch 3 times, most recently from a1bd513 to a073b45 Compare November 15, 2021 23:03

shibumi force-pushed the shibumi/implement-pubkey-output branch from a073b45 to 17ad01c Compare November 15, 2021 23:05

developer-guy approved these changes Nov 16, 2021

View reviewed changes

implement output-signature and output-certificate flags

e0acb0d

This commit breaks with past behavior in favor of two new flags. The `output` flags gets replaced with the new `output-signature` and `output-certificate` flags. Signed-off-by: Christian Rebischke <chris@shibumi.dev>

shibumi force-pushed the shibumi/implement-pubkey-output branch from 17ad01c to e0acb0d Compare November 16, 2021 13:32

dlorenc merged commit 18318ba into sigstore:main Nov 19, 2021

github-actions bot added this to the v1.4.0 milestone Nov 19, 2021

shibumi deleted the shibumi/implement-pubkey-output branch November 19, 2021 12:15

This was referenced Nov 21, 2021

feat: verify-blob --cert base64 #1088

Merged

fix: alias output to output-signature on sign-blob #1093

Merged

dekkagaijin mentioned this pull request Dec 6, 2021

sign-blob --output -> --output-signature #1148

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

implement a new flag for sign-blob subcommand to save certificate to disk or stdout #1016

implement a new flag for sign-blob subcommand to save certificate to disk or stdout #1016

shibumi commented Nov 9, 2021

asraa Nov 9, 2021

developer-guy commented Nov 10, 2021

Dentrax Nov 10, 2021

shibumi Nov 10, 2021

dlorenc Nov 10, 2021

asraa Nov 10, 2021

shibumi commented Nov 10, 2021

developer-guy commented Nov 10, 2021

dlorenc commented Nov 10, 2021

shibumi Nov 10, 2021

shibumi commented Nov 10, 2021

Dentrax commented Nov 10, 2021

shibumi commented Nov 10, 2021

developer-guy commented Nov 11, 2021

shibumi commented Nov 11, 2021 •

edited

Loading

caarlos0 left a comment

Dentrax commented Nov 15, 2021

developer-guy commented Nov 15, 2021

dlorenc commented Nov 15, 2021

caarlos0 commented Nov 15, 2021 •

edited

Loading

dlorenc commented Nov 15, 2021

shibumi commented Nov 15, 2021

caarlos0 commented Nov 15, 2021

dlorenc commented Nov 15, 2021

shibumi commented Nov 15, 2021

shibumi commented Nov 15, 2021 •

edited

Loading

developer-guy left a comment

shibumi commented Nov 16, 2021

developer-guy commented Nov 16, 2021

developer-guy commented Nov 16, 2021

shibumi commented Nov 16, 2021

developer-guy commented Nov 16, 2021

caarlos0 commented Nov 19, 2021

implement a new flag for sign-blob subcommand to save certificate to disk or stdout #1016

implement a new flag for sign-blob subcommand to save certificate to disk or stdout #1016

Conversation

shibumi commented Nov 9, 2021

Summary

Ticket Link

Release Note

asraa Nov 9, 2021

Choose a reason for hiding this comment

developer-guy commented Nov 10, 2021

Dentrax Nov 10, 2021

Choose a reason for hiding this comment

shibumi Nov 10, 2021

Choose a reason for hiding this comment

dlorenc Nov 10, 2021

Choose a reason for hiding this comment

asraa Nov 10, 2021

Choose a reason for hiding this comment

shibumi commented Nov 10, 2021

developer-guy commented Nov 10, 2021

dlorenc commented Nov 10, 2021

shibumi Nov 10, 2021

Choose a reason for hiding this comment

shibumi commented Nov 10, 2021

Dentrax commented Nov 10, 2021

shibumi commented Nov 10, 2021

developer-guy commented Nov 11, 2021

shibumi commented Nov 11, 2021 • edited Loading

caarlos0 left a comment

Choose a reason for hiding this comment

Dentrax commented Nov 15, 2021

developer-guy commented Nov 15, 2021

dlorenc commented Nov 15, 2021

caarlos0 commented Nov 15, 2021 • edited Loading

dlorenc commented Nov 15, 2021

shibumi commented Nov 15, 2021

caarlos0 commented Nov 15, 2021

dlorenc commented Nov 15, 2021

shibumi commented Nov 15, 2021

shibumi commented Nov 15, 2021 • edited Loading

developer-guy left a comment

Choose a reason for hiding this comment

shibumi commented Nov 16, 2021

developer-guy commented Nov 16, 2021

developer-guy commented Nov 16, 2021

shibumi commented Nov 16, 2021

developer-guy commented Nov 16, 2021

caarlos0 commented Nov 19, 2021

shibumi commented Nov 11, 2021 •

edited

Loading

caarlos0 commented Nov 15, 2021 •

edited

Loading

shibumi commented Nov 15, 2021 •

edited

Loading