Signatures in DSSE envelopes for intoto/v0.0.2 are double encoded

[kommendorkapten]

Description

When uploading an intoto object with version 0.0.2, the retrieved entry has the signature double base64 encoded.

An example entry with this:

Created entry at index 5547337, available at: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77a5f9c879a81d619af36c272b25889758a7855a31c7e4b27d51d1b0b943d2aabc2

When retrieving the entry:

...
    "content": {
      "envelope": {
        "payloadType": "application/vnd.in-toto+json",
        "signatures": [
          {
            "publicKey": "LS0...",
            "sig": "TUVVQ0lDZWNWcS9lckI3MU4xRm5PYVpnV0l1OHBnb1h4QXM2N212NUpXd0JIR05KQWlFQWxwRjY4N0lHNnF5L0NOTmYwZmE4OFdhWVR2RVJsOEhjeXhoVFgzQWZYTVk9"
          }
...

After base64 decode the signature, we get the real signature:

$ printf TUVVQ0lDZWNWcS9lckI3MU4xRm5PYVpnV0l1OHBnb1h4QXM2N212NUpXd0JIR05KQWlFQWxwRjY4N0lHNnF5L0NOTmYwZmE4OFdhWVR2RVJsOEhjeXhoVFgzQWZYTVk9 | base64 -D
MEUCICecVq/erB71N1FnOaZgWIu8pgoXxAs67mv5JWwBHGNJAiEAlpF687IG6qy/CNNf0fa88WaYTvERl8HcyxhTX3AfXMY=

which was uploaded:

$ grep 'sig"' envelope
                "sig": "MEUCICecVq/erB71N1FnOaZgWIu8pgoXxAs67mv5JWwBHGNJAiEAlpF687IG6qy/CNNf0fa88WaYTvERl8HcyxhTX3AfXMY="

Version

Rekor as deployed of 2022-10-21.

[kommendorkapten]

I understand this is a known issue: https://sigstore.slack.com/archives/C01CX4E2K70/p1664483571881309, should I close this?

[bobcallaway]

which client is being used to upload?

[kommendorkapten]

I was using a local built rekor-cli, at the current main branch a few days ago.
This was also asked in #rekor slack channel September 29th, and @haydentherapper answered it was due to historical decisions.

I was testing this locally too, and I think I tcpdumped the bytes on the wire to verify that the envelope being sent wasn't double encoded, but I don't that data available now. I can re-run the test next week.

[bobcallaway]

no need, that's enough of a direction for me to look at. thanks!

[bdehamer]

I was looking at this a few weeks back to understand how to implement this properly in sigstore-js. When I spied on the request that was being made by the rekor-cli I saw that both the envelope payload and the signature were double base64-encoded on upload.

$ go run cmd/rekor-cli/main.go upload --artifact /tmp/dsse --type intoto:0.0.2 --public-key /tmp/cert.pem                     
Created entry at index 4238416, available at: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77ac02225838452ac7595971bf1fac127332bb6b4ea3c1fd7528ea70a042776d302

{
  "apiVersion":"0.0.2",
  "kind":"intoto",
  "spec":{
    "content":{
      "envelope":{
        "payload":"ZXdvZ0lDSmZkSGx3WlNJNklDSm9kSFJ3Y3pvdkwybHVMWFJ2ZEc4dWFXOHZVM1JoZEdWdFpXNTBMM1l3TGpFaUxBb2dJQ0p6ZFdKcVpXTjBJam9nV3dvZ0lDQWdld29nSUNBZ0lDQWlibUZ0WlNJNklDSnpiSE5oTFhCeWIzWmxibUZ1WTJVdE1DNHdMakV1ZEdkNklpd0tJQ0FnSUNBZ0ltUnBaMlZ6ZENJNklIc0tJQ0FnSUNBZ0lDQWljMmhoTlRFeUlqb2dJbUppWm1Rek56Sm1ZemxpWldWaU56YzNabVV6TldRd05XSmlNVEJqTUdNM01HRTVOek16WkRNMk5tRTNOV1psWkRka1pERTRPRFkyWXpjek9URmtaVE5sWlRkbE9EaGlZVGMwWkdRME4yRmlaak5sTVRWak9EUTFaVFUwTjJaalpqQmxOV016WkdFNE1EZzFOR00zTlRFMU5UUXlNalJrTTJFMlpEUmxOVFZtSWdvZ0lDQWdJQ0I5Q2lBZ0lDQjlDaUFnWFN3S0lDQWljSEpsWkdsallYUmxWSGx3WlNJNklDSm9kSFJ3Y3pvdkwzTnNjMkV1WkdWMkwzQnliM1psYm1GdVkyVXZkakF1TWlJc0NpQWdJbkJ5WldScFkyRjBaU0k2SUhzS0lDQWdJQ0ppZFdsc1pGUjVjR1VpT2lBaWFIUjBjSE02THk5bmFYUm9kV0l1WTI5dEwyNXdiUzl6YkhOaExYQnliM1psYm1GdVkyVXZaMmhoUUhZd0lpd0tJQ0FnSUNKaWRXbHNaR1Z5SWpvZ2V3b2dJQ0FnSUNBaWFXUWlPaUFpYUhSMGNITTZMeTluYVhSb2RXSXVZMjl0TDI1d2JTOXpiSE5oTFhCeWIzWmxibUZ1WTJWQU1DNHdMakVpQ2lBZ0lDQjlMQW9nSUNBZ0ltbHVkbTlqWVhScGIyNGlPaUI3Q2lBZ0lDQWdJQ0pqYjI1bWFXZFRiM1Z5WTJVaU9pQjdDaUFnSUNBZ0lDQWdJblZ5YVNJNklDSm5hWFFyYUhSMGNITTZMeTluYVhSb2RXSXVZMjl0TDJkcGRHaDFZaTl6YkhOaExYQnliM1psYm1GdVkyVkFjbVZtY3k5b1pXRmtjeTlrWlcxdklpd0tJQ0FnSUNBZ0lDQWlaR2xuWlhOMElqb2dld29nSUNBZ0lDQWdJQ0FnSW5Ob1lURWlPaUFpTWpsalptWXpaR1EyTldZM09EQmpNell3TVdKa05EVTNZV05pTm1abE5HVTFPVE14WXpneU5TSUtJQ0FnSUNBZ0lDQjlMQW9nSUNBZ0lDQWdJQ0psYm5SeWVWQnZhVzUwSWpvZ0ltUmxiVzhpQ2lBZ0lDQWdJSDBzQ2lBZ0lDQWdJQ0p3WVhKaGJXVjBaWEp6SWpvZ2UzMHNDaUFnSUNBZ0lDSmxiblpwY205dWJXVnVkQ0k2SUhzS0lDQWdJQ0FnSUNBaVIwbFVTRlZDWDBWV1JVNVVYMDVCVFVVaU9pQWljSFZ6YUNJc0NpQWdJQ0FnSUNBZ0lrZEpWRWhWUWw5S1QwSWlPaUFpY25WdUxYQnliM1psYm1GdVkyVXRaR1Z0YnlJc0NpQWdJQ0FnSUNBZ0lrZEpWRWhWUWw5U1JVWWlPaUFpY21WbWN5OW9aV0ZrY3k5a1pXMXZJaXdLSUNBZ0lDQWdJQ0FpUjBsVVNGVkNYMUpGUmw5VVdWQkZJam9nSW1KeVlXNWphQ0lzQ2lBZ0lDQWdJQ0FnSWtkSlZFaFZRbDlTUlZCUFUwbFVUMUpaSWpvZ0ltZHBkR2gxWWk5emJITmhMWEJ5YjNabGJtRnVZMlVpTEFvZ0lDQWdJQ0FnSUNKSFNWUklWVUpmVWtWUVQxTkpWRTlTV1Y5UFYwNUZVaUk2SUNKbmFYUm9kV0lpTEFvZ0lDQWdJQ0FnSUNKSFNWUklWVUpmVWxWT1gwRlVWRVZOVUZRaU9pQWlOQ0lzQ2lBZ0lDQWdJQ0FnSWtkSlZFaFZRbDlTVlU1ZlNVUWlPaUFpTXpBeU5EQTVNVFUwTmlJc0NpQWdJQ0FnSUNBZ0lrZEpWRWhWUWw5U1ZVNWZUbFZOUWtWU0lqb2dJakUzSWl3S0lDQWdJQ0FnSUNBaVIwbFVTRlZDWDFOSVFTSTZJQ0l5T1dObVpqTmtaRFkxWmpjNE1HTXpOakF4WW1RME5UZGhZMkkyWm1VMFpUVTVNekZqT0RJMUlpd0tJQ0FnSUNBZ0lDQWlSMGxVU0ZWQ1gxZFBVa3RHVEU5WElqb2dJbVJsYlc4aUxBb2dJQ0FnSUNBZ0lDSkpUVUZIUlY5UFV5STZJQ0oxWW5WdWRIVXlNQ0lzQ2lBZ0lDQWdJQ0FnSWtsTlFVZEZYMVpGVWxOSlQwNGlPaUFpTWpBeU1qQTVNRFV1TVNJc0NpQWdJQ0FnSUNBZ0lsSlZUazVGVWw5QlVrTklJam9nSWxnMk5DSXNDaUFnSUNBZ0lDQWdJbEpWVGs1RlVsOU9RVTFGSWpvZ0lrZHBkRWgxWWlCQlkzUnBiMjV6SURVd0lpd0tJQ0FnSUNBZ0lDQWlVbFZPVGtWU1gwOVRJam9nSWt4cGJuVjRJZ29nSUNBZ0lDQjlDaUFnSUNCOUxBb2dJQ0FnSW0xbGRHRmtZWFJoSWpvZ2V3b2dJQ0FnSUNBaVluVnBiR1JKYm5adlkyRjBhVzl1U1dRaU9pQWlNekF5TkRBNU1UVTBOaTAwSWl3S0lDQWdJQ0FnSW1OdmJYQnNaWFJsYm1WemN5STZJSHNLSUNBZ0lDQWdJQ0FpY0dGeVlXMWxkR1Z5Y3lJNklHWmhiSE5sTEFvZ0lDQWdJQ0FnSUNKbGJuWnBjbTl1YldWdWRDSTZJR1poYkhObExBb2dJQ0FnSUNBZ0lDSnRZWFJsY21saGJITWlPaUJtWVd4elpRb2dJQ0FnSUNCOUxBb2dJQ0FnSUNBaWNtVndjbTlrZFdOcFlteGxJam9nWm1Gc2MyVUtJQ0FnSUgwc0NpQWdJQ0FpYldGMFpYSnBZV3h6SWpvZ1d3b2dJQ0FnSUNCN0NpQWdJQ0FnSUNBZ0luVnlhU0k2SUNKbmFYUXJhSFIwY0hNNkx5OW5hWFJvZFdJdVkyOXRMMmRwZEdoMVlpOXpiSE5oTFhCeWIzWmxibUZ1WTJVaUxBb2dJQ0FnSUNBZ0lDSmthV2RsYzNRaU9pQjdDaUFnSUNBZ0lDQWdJQ0FpYzJoaE1TSTZJQ0l5T1dObVpqTmtaRFkxWmpjNE1HTXpOakF4WW1RME5UZGhZMkkyWm1VMFpUVTVNekZqT0RJMUlnb2dJQ0FnSUNBZ0lIMEtJQ0FnSUNBZ2ZRb2dJQ0FnWFFvZ0lIMEtmUT09",
        "payloadType":"application/vnd.in-toto+json",
        "signatures":[
          {
            "publicKey":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQWlhZ0F3SUJBZ0lVSWJqS3JxY0llRHdMRnhMNzVDQTJ6VDZEZ3lVd0NnWUlLb1pJemowRUF3TXcKTnpFVk1CTUdBMVVFQ2hNTWMybG5jM1J2Y21VdVpHVjJNUjR3SEFZRFZRUURFeFZ6YVdkemRHOXlaUzFwYm5SbApjbTFsWkdsaGRHVXdIaGNOTWpJd09USTVNVGt3TlRVeFdoY05Nakl3T1RJNU1Ua3hOVFV4V2pBQU1Ga3dFd1lICktvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVxM0VQTnI1S3lMZ000bkxCOXlHYmxnaVBZM3dTQStlN29LbHcKaUFkTzZTYWMwdGU0ZjlidmhmdSthQm41TWo2WHp4UlhkaEdUanBqV3RtYzgra1JidktPQ0FVVXdnZ0ZCTUE0RwpBMVVkRHdFQi93UUVBd0lIZ0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREF6QWRCZ05WSFE0RUZnUVVjUHZNClYwajVLaStNVVVWQUk5S0ZpN3ZUODBzd0h3WURWUjBqQkJnd0ZvQVUzOVBwejFZa0VaYjVxTmpwS0ZXaXhpNFkKWkQ4d0h3WURWUjBSQVFIL0JCVXdFNEVSWW5KcFlXNUFaR1ZvWVcxbGNpNWpiMjB3TEFZS0t3WUJCQUdEdnpBQgpBUVFlYUhSMGNITTZMeTluYVhSb2RXSXVZMjl0TDJ4dloybHVMMjloZFhSb01JR0tCZ29yQmdFRUFkWjVBZ1FDCkJId0VlZ0I0QUhZQUNHQ1M4Q2hTLzJoRjBkRnJKNFNjUldjWXJCWTl3empTYmVhOElnWTJiM0lBQUFHRGlxUVAKa1FBQUJBTUFSekJGQWlBRjJYb3Q5bW51RjVSNnpqRHo2aG4weCticW11NTRrTTh5ZEluakx1K1hVUUloQU9mdwpRMEhCYTlnNEVOZW9WbHdpd0xta0VKQUJXelF2TUFKZ0NPaWJ6ZkxmTUFvR0NDcUdTTTQ5QkFNREEyZ0FNR1VDCk1RQ1laUUpxWEorS0dQbVg1NWtyOUhDdjhudlpSZ2R5bkllL2Z2WkRhNWdXZjM5LzBDNzF3K2VTVkFDY1NzcGcKS0N3Q01CTWx3MnpqaVJPeE5MeFBGNVV6N0JlaGxha2hYdm9tN1lpQjN3ZktGZjBJSTFPYXYwcTdKclNlQzBaKwptMURrd1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==",
            "sig":"TUVZQ0lRQ3IxSXlsUTBHUnFqMEFCbm8zNmlOL1d1MFFpYncwUTY2d08xOGcvSnNHNFFJaEFJMlZBTUFTa2hRTTdDd3U2a29BKzBzbWF2WGRKUDJIK0cvOWlmUlRoa085"
          }
        ]
      },
      "hash":{
        "algorithm":"sha256",
        "value":"d0dd92729d5d6273186f9083dccc4c53f0eb9d13f6f61b79bdbad22abbdb8aca"
      }
    }
  }
}

[haydentherapper]

@bobcallaway Can this be closed as won't fix? We've now got the DSSE type that should fix this