Initial Sigstore bundle support

[woodruffw]

This adds initial support for Sigstore bundles during signing, in the form of the --bundle flag. When passed, sigstore sign will generate a single {input}.sigstore instead of separate .crt, .sig, and .rekor files.

I haven't included sigstore verify support in the initial changeset, in an effort to keep the diff small. But adding it shouldn't be difficult, and will provide a good dogfood/smoke test for round-tripping through the bundle format.

See #251.

Signed-off-by: William Woodruff william@trailofbits.com

[woodruffw]

Example generated bundle:

{
    "mediaType": "application/vnd.dev.sigstore.bundle+json;version=0.1",
    "verificationMaterial": {
        "x509CertificateChain": {
            "certificates": [
                {
                    "rawBytes": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN3akNDQWtlZ0F3SUJBZ0lVU0NpWUVuTzVLa0g0YWxaNTlDNmEyMUVwUENZd0NnWUlLb1pJemowRUF3TXcKTnpFVk1CTUdBMVVFQ2hNTWMybG5jM1J2Y21VdVpHVjJNUjR3SEFZRFZRUURFeFZ6YVdkemRHOXlaUzFwYm5SbApjbTFsWkdsaGRHVXdIaGNOTWpNd01USXdNVFkxTkRBeVdoY05Nak13TVRJd01UY3dOREF5V2pBQU1IWXdFQVlICktvWkl6ajBDQVFZRks0RUVBQ0lEWWdBRW5RRUZsMmUzdzdySjQ5eHdGbWVheWN3ZnZTajBMWXB1WFZ1d3R0aE4KaTF3TWY0ZGF0SGNSeFpMN3ZTaXp1VHY5M2twZEZ5UTBhOGJYeTBTYUpia2NBUFVEVDFTY05VVkZwOEVOOTdTTApBbmJ2dzJLRlk1YjF4QmtwR0VwajMwNmVvNElCU1RDQ0FVVXdEZ1lEVlIwUEFRSC9CQVFEQWdlQU1CTUdBMVVkCkpRUU1NQW9HQ0NzR0FRVUZCd01ETUIwR0ExVWREZ1FXQkJUdFpicTBIYmk5RWc3eThIaXZQKzFvV2NNNzh6QWYKQmdOVkhTTUVHREFXZ0JSeGhqQ21GSHhpYi9uMzF2UUZHbjlmLyt0dnJEQWpCZ05WSFJFQkFmOEVHVEFYZ1JWMwphV3hzYVdGdFFIbHZjM05oY21saGJpNXVaWFF3TEFZS0t3WUJCQUdEdnpBQkFRUWVhSFIwY0hNNkx5OW5hWFJvCmRXSXVZMjl0TDJ4dloybHVMMjloZFhSb01JR0tCZ29yQmdFRUFkWjVBZ1FDQkh3RWVnQjRBSFlBS3pDODNHaUkKeWVMaDJDWXBYblFmU0RreGxnTHluRFBMWGtOQS9yS3Nobm9BQUFHRjBCbitCZ0FBQkFNQVJ6QkZBaUJ6TENLbwpOUzlqS01iaHYwU2FteGdoWUJQK3RlbExGRzlYcDBBVXlQQmlpUUloQUxXTXpzU1pBaVdYZHN6S0xXQU15b01LClBNcjVOWndTM1Q4SmE0ZFhWbUJWTUFvR0NDcUdTTTQ5QkFNREEya0FNR1lDTVFDNGU1cktGcWRHbEZkTzJEemkKR3k3ajZJVkpZdENhQStraitUL0MwVWhwZ0xON2h2dGVXOXdkSUwrU1l0bjRvVG9DTVFDMmswNDVFdktBcTdHRwpEbngwaEhrTWJmS2ZKK0NCZjV1bjZSODkxOWpST1ZVdUdEeUlLUWhFSi9RQjBhaVV3bDg9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
                }
            ]
        },
        "tlogEntries": [
            {
                "logIndex": "2242969",
                "logId": {
                    "keyId": "0y8wo8MtY5wrdiIFohx7sHeI5oKDpK5vQhGHI6G+pJY="
                },
                "kindVersion": {
                    "kind": "hashedrekord",
                    "version": "0.0.1"
                },
                "integratedTime": "1674233642",
                "inclusionPromise": {
                    "signedEntryTimestamp": "MEUCIQD31VsczBNtApPFNW31nn20hzxULvVCtLTe7BnAjJCQiwIgN4RlYRkfRSdC7A8E6FufttvH53L5GCE+gmuh2TKVx+I="
                },
                "inclusionProof": {
                    "logIndex": "2228150",
                    "rootHash": "sxhOFoisbFXhJmKOSlimQWBpgkrDT5eCaSaUcydRGEg=",
                    "treeSize": "2228151",
                    "hashes": [
                        "TwqHCU5ELTQy/KKeu+0+Qlnjr0zzPziKXjE5TGXeRT0=",
                        "HtGiDzArXW02VJtZKJVYEIW1cyB7jR0d9c60io54x8s=",
                        "Wjgnj5IgRwHKGVnpu6DKjZWP2ZDRyIvXC2OKO437mQ8=",
                        "ZXWmnfXIqBNf4a2+MosY2T0zeCGACcqlYxrYXdY5INU=",
                        "rkq9/Kqf8fYE4vhLb5vzhhbcsI5kT2JNY06JZmLMlC0=",
                        "O8GhxttbaSwc3hOClnMY2tliEqlpXiUKhuUKPbPYZbA=",
                        "UaBSu2yb0gg+mg7gWVuQViCWJroP3wAo9sm+70DtT94=",
                        "hbzBh170Y7wu6HE4gFaJX1m3tcnffbIbneNVNitxEQ8=",
                        "7RquioMcFFcBwp8L9WgAYvNdmFIX2PLFRO3Ig3I4aG4=",
                        "sEdlyfBp6l2RMcB1BIr7PJyI8d6jWYNBbz4EO0ocBH0=",
                        "PbBHHJ1PoLFq1tjP/Z4nE7yCxtIxUhtqkSdpbkLmrE4=",
                        "d8Hx9AnJ483YnmugSNyUJyzV+dWJfK4wEcn9d9Q+4hM=",
                        "KCciPEwSUhXM04e8244YynDhwh+722/pabo6ZAtt0fc=",
                        "cfT2nw0gal6i8QktNkaFsq6w3Aeu62pnB6sDRzKkAZw=",
                        "VwBj5hN1tw74kRJeHAQaqdSWrXWk7Zb4c1PJfrpiKNw="
                    ]
                },
                "canonicalizedBody": "eyJib2R5IjoiZXlKaGNHbFdaWEp6YVc5dUlqb2lNQzR3TGpFaUxDSnJhVzVrSWpvaWFHRnphR1ZrY21WcmIzSmtJaXdpYzNCbFl5STZleUprWVhSaElqcDdJbWhoYzJnaU9uc2lZV3huYjNKcGRHaHRJam9pYzJoaE1qVTJJaXdpZG1Gc2RXVWlPaUl5TVdKbU9XRmxNR1F5WkRsaFpETmlOMlppTmpSbU1tUTJNV0prTWpFeU1XSXhZemMxWldWaU1UaGlNekJqWmpjeVptRm1NVEV3TW1aa01tRm1ZMlkzSW4xOUxDSnphV2R1WVhSMWNtVWlPbnNpWTI5dWRHVnVkQ0k2SWsxSFdVTk5VVU5IZEdnck1tWjRlRVkxZWpWNVIwVTVaSEZrVVhwWFFXTTJWMFoxVUhCV1ExcEljakF6UTJSM2F6UXpaV2RRVmpWRU9GaE9Wak51WjA5dlJqUkdWMWx2UTAxUlEwd3hkVFZTWVhGTUwwUXlSMGw0ZUdOQ2JHTkVjREJMZEhVcllUQTVhVlZMYlRCUlFVZDFVR1pLTUVZeGVraDFRMmxTVWxndk0zWXdLMWcxVTNOcFNWVTlJaXdpY0hWaWJHbGpTMlY1SWpwN0ltTnZiblJsYm5RaU9pSk1VekIwVEZNeFExSlZaRXBVYVVKRVVsWktWVk5WV2twUk1FWlZVbE13ZEV4VE1IUkRhekZLVTFWT00yRnJUa1JSVjNSc1dqQkdNMU5WU2tKYU1HeFdWVEJPY0ZkVlZuVlVlbFpNWVRCbk1GbFhlR0ZPVkd4RVRtMUZlVTFWVm5kVlJVNWFaREJPYmxkVmJFeGlNWEJLWlcxdmQxSlZSak5VV0dOTFZHNXdSbFpyTVVOVVZXUkNUVlpXUmxFeWFFNVVWMDE1WWtjMWFrMHhTakpaTWpGV1pGWndTRlpxU2s1VmFsSXpVMFZHV2xKR1dsSlZWVkpHWlVaYU5sbFdaR3RsYlZKSVQxaHNZVlY2Um5kWmJUVlRZa0Z3YW1KVVJuTlhhMlJ6WVVkU1NGWllaRWxoUjA1UFZGZHdUbVF3TVZWVFdHUk9Wa1pyZUZSclVrSmxWbVJ2V1RBMVRtRnJNVE5VVmxKS1pEQXhWVmt6WkU5U1JVWTFWakp3UWxGVk1VbFhXR1JHVVZac1NVTnJkSFpYYTJ3MllXcENSRkZXUmxwU2EzTXdVbFZXUWxFd2JFVlhWMlJDVWxjMVVsSlZXbk5OYlZWNlpIcGtlVk5xVVRWbFNHUkhZbGRXYUdWWFRqTmFibHBVWVdwQ1RWZFlRakZYUmxveFpETlNNR0ZGTkV0aFZFWXpWRmRaTUZwSFJqQlRSMDVUWlVad1RVNHpXbFJoV0hBeFZraFpOVTB5ZEhkYVJWbzFWVlJDYUU5SFNsbGxWRUpVV1ZWd2FXRXlUa0pWUmxaRlZrUkdWRmt3TlZaV2ExcDNUMFZXVDA5VVpGUlVRWEJDWW0xS01tUjZTa3hTYkdzeFdXcEdORkZ0ZEhkU01GWjNZV3BOZDA1dFZuWk9SV3hEVlRGU1JGRXdSbFpXV0dSRldqRnNSVlpzU1hkVlJVWlNVME01UTFGV1JrVlJWMlJzVVZVeFExUlZaRUpOVmxaclEydHdVbFZWTVU1UlZ6bElVVEJPZWxJd1JsSldWVnBEWkRBeFJWUlZTWGRTTUVWNFZsZFNSVm94UmxoUmEwcFZaRVp3YVdOVVFrbFpiV3MxVWxkak0yVlVhRWxoV0ZwUlMzcEdkbFl5VGs1T2VtZzJVVmRaUzFGdFpFOVdhMmhVVkZWV1NGSkZSbGhhTUVwVFpVZG9jVkV5TVVkVFNHaHdXV2s1ZFUxNlJqSlZWVnBJWW1wc2JVeDVkREJrYmtwRlVWZHdRMW93TlZkVFJrcEdVV3RHYlU5RlZraFdSVVpaV2pGS1YwMTNjR2hXTTJoNldWWmtSMlJHUmtsaVNGcHFUVEExYjFreU1YTmhSMHB3VGxoV1lWZEdSak5VUlVaYVV6QjBNMWRWU2tOUlZXUkZaRzV3UWxGclJsSlZWMVpvVTBaSmQxa3dhRTVPYTNnMVQxYzFhRmRHU25aRGJWSllVMWhXV2sxcWJEQlVSRW8wWkd4dmVXSklWazFOYW14dldrWm9VMkl3TVVwU01IUkRXakk1ZVZGdFpFWlNWVVpyVjJwV1Fsb3hSa1JSYTJnelVsZFdibEZxVWtKVFJteENVek53UkU5RVRraGhWV3RMWlZkV1RXRkVTa1JYV0VKWllteEdiVlV3VW5KbFIzaHVWRWhzZFZKR1FrMVhSM1JQVVZNNWVWTXpUbTlpYlRsQ1VWVkdTRkpxUWtOaWFYUkRXakJHUWxGclJrNVJWa28yVVd0YVFtRlZTalpVUlU1TVluZHdUMVY2YkhGVE1ERnBZVWhaZDFVeVJuUmxSMlJ2VjFWS1VVc3pVbXhpUlhoSFVucHNXV05FUWtKV1dHeFJVVzFzY0ZWVmJHOVJWWGhZVkZod2VsVXhjRUpoVm1SWldraE9ObE13ZUZoUlZURTFZakF4VEVOc1FrNWphbFpQVjI1a1ZFMHhVVFJUYlVVd1drWm9WMkpWU2xkVVZVWjJVakJPUkdOVlpGUlVWRkUxVVd0R1RsSkZSWGxoTUVaT1VqRnNSRlJXUmtST1IxVXhZMnQwUjJOWFVraGlSVnByVkhwS1JXVnRhMHRTTTJzellXcGFTbFpyY0Zwa1JVNW9VVk4wY21GcGRGVk1NRTEzVmxkb2Qxb3dlRTlPTW1neVpFZFdXRTlZWkd0VFZYZHlWVEZzTUdKcVVuWldSemxFVkZaR1JFMXRjM2RPUkZaR1pHdDBRbU5VWkVoU2QzQkZZbTVuZDJGRmFISlVWMHB0VXpKYVMwc3dUa05hYWxZeFltcGFVMDlFYTNoUFYzQlRWREZhVm1SVlpFVmxWV3hNVlZkb1JsTnBPVkpSYWtKb1lWWldNMkpFWnpsRGFUQjBURk13ZEZKVk5VVkpSVTVHVld4U1NsSnJiRVJSVmxKR1RGTXdkRXhUTUVzaWZYMTlmUT09IiwiaW50ZWdyYXRlZFRpbWUiOjE2NzQyMzM2NDIsImxvZ0lEIjoiZDMyZjMwYTNjMzJkNjM5YzJiNzYyMjA1YTIxYzdiYjA3Nzg4ZTY4MjgzYTRhZTZmNDIxMTg3MjNhMWJlYTQ5NiIsImxvZ0luZGV4IjoyMjQyOTY5fQ=="
            }
        ]
    },
    "messageSignature": {
        "messageDigest": {
            "algorithm": "SHA2_256",
            "digest": "Ib+a4NLZrTt/tk8tYb0hIbHHXusYswz3L68RAv0q/Pc="
        },
        "signature": "MGYCMQCGth+2fxxF5z5yGE9dqdQzWAc6WFuPpVCZHr03Cdwk43egPV5D8XNV3ngOoF4FWYoCMQCL1u5RaqL/D2GIxxcBlcDp0Ktu+a09iUKm0QAGuPfJ0F1zHuCiRRX/3v0+X5SsiIU="
    }
}

That bundle signs for README.md as of a0377a4.

[woodruffw]

cc @znewman01 and @kommendorkapten for visibility 🙂

[woodruffw]

Currently evaluating against sigstore-js; blocked on resolution of sigstore/protobuf-specs#62

Edit: Unblocked; #465 (comment) was incorrect.

[znewman01]

Overall looks great

[woodruffw]

It'd be nice if there was some way to default to this media_type, but I have no idea if that's possible 🙂

[znewman01]

IIUC no :(

That said, I think that's sort-of by design? You should only set that media_type if you immediately plan to serialize to JSON

[woodruffw]

Aha, I missed that detail! That makes sense, then, and it's not a huge deal here.

[kommendorkapten]

Yeah, it would be nice to have const values in the language bindings that would capture the current media type used.

[woodruffw]

100% agreed -- I'm not sure how best to accomplish that without hacky patches to the codegen, though...

[kommendorkapten]

Yes, would be messy. I would love for Protobufs to support that natively, so many use-cases I have seen where it would make our lives easier.

[tetsuo-cpp]

I changed these back from:

if "rekor_bundle" in outputs:

This is because when we don't write to an output, the entry still gets added to the map, the file is just set to None. Previously, if specified some outputs but not all, we'd crash.

[woodruffw]

Makes sense! I've re-fixed #465 (comment) based on that.

[tetsuo-cpp]

LGTM!

@woodruffw I pushed a few commits to make the CLI work as we described, so please take a look at that when you get a moment. Other than that, this looks great. 🎉

[di]

Overall LGTM, aside from the bug with writing .sig files.

Just a note: we probably don't want to make a release with this until verification is supported as well.

[woodruffw]

Just a note: we probably don't want to make a release with this until verification is supported as well.

Sounds good!