fix: npm publish verification #705

laurentsimon · 2023-09-26T23:01:49Z

adding support for IEEE P1363 formatted signatures
fix the npm publish attestation bug. The verification always return success, because it was not using PAE signature

Signed-off-by: laurentsimon <laurentsimon@google.com>

laurentsimon · 2023-09-26T23:22:14Z

@trishankatdatadog PTAL

verifiers/utils/dsse.go

verifiers/internal/gha/npm.go

ianlewis · 2023-09-27T01:48:17Z

I like that you used the dsselib.EnvelopeVerifier interface.

Could you maybe add a bit more in the PR description as to what this PR is doing? esp. that this is adding support for IEEE P1363 formatted signatures.

Signed-off-by: laurentsimon <laurentsimon@google.com>

trishankatdatadog · 2023-09-27T03:24:35Z

Can confirm the patch works:

➜  slsa-verifier git:(fix/npm-publish-sig) SLSA_VERIFIER_EXPERIMENTAL=1 go run ./cli/slsa-verifier verify-npm-package ~/GitHub.com/trishankatdatadog/hekate/supreme-goggles.tgz \
  --attestations-path ~/GitHub.com/trishankatdatadog/hekate/attestations.json \
  --builder-id "https://github.com/actions/runner/github-hosted" \
  --package-name "@trishankatdatadog/supreme-goggles" \
  --package-version 1.0.5 \
  --source-uri github.com/trishankatdatadog/supreme-goggles
Verified build using builder https://github.com/actions/runner/github-hosted at commit 38ebf99444e033b2f1550c9aaaeacd62d02a12ba
Verifying npm package /Users/trishank.kuppusamy/GitHub.com/trishankatdatadog/hekate/supreme-goggles.tgz: FAILED: invalid signature: accepted signatures do not match threshold, Found: 0, Expected 1

FAILED: SLSA verification failed: invalid signature: accepted signatures do not match threshold, Found: 0, Expected 1
exit status 1

Will try to review code ASAP. Thanks for fixing this!

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Signed-off-by: laurentsimon <laurentsimon@google.com>

cli/slsa-verifier/main_regression_test.go

verifiers/internal/gha/npm.go

Co-authored-by: Trishank Karthik Kuppusamy <trishank.kuppusamy@datadoghq.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

trishankatdatadog

LGTM, could use another pair of eyes to see whether I missed anything, thx!

laurentsimon · 2023-09-27T21:04:25Z

LGTM, could use another pair of eyes to see whether I missed anything, thx!

@ianlewis provided a good review already. Waiting for his LGTM too. Thanks again!

trishankatdatadog · 2023-09-27T21:06:35Z

Just to double-check: we do verify that the observed artefact digest does match the expected subject digest in both the provenance and publish attestations, correct?

laurentsimon · 2023-09-27T22:04:54Z

Just to double-check: we do verify that the observed artefact digest does match the expected subject digest in both the provenance and publish attestations, correct?

yes

trishankatdatadog · 2023-09-29T23:04:20Z

yes

Sorry to press you, but is there a test to this effect? I may have missed it...

ianlewis

LGTM

ianlewis · 2023-10-02T01:33:35Z

cli/slsa-verifier/main_regression_test.go

+			err:       serrors.ErrorInvalidSignature,
+		},
+		{
+			name:      "invalid signature publish npm CLI",


We have tests for package name, version, and signature mismatches but @trishankatdatadog mentioned that we are missing a test for a publish attestation digest mismatch.

Should we create an issue to track this?

is #707 ok?

ianlewis · 2023-10-02T01:40:39Z

verifiers/utils/dsse.go

+func DsseVerifierNew(content []byte, format KeyFormat, keyID string, sigEncoding *SignatureEncoding) (*dsselib.EnvelopeVerifier, error) {
+	if format == KeyFormatPEM {
+		block, rest := pem.Decode(content)
+		if rest != nil {


nit

Suggested change

if rest != nil {

if len(rest) != 0 {

laurentsimon · 2023-10-02T17:12:45Z

yes

Sorry to press you, but is there a test to this effect? I may have missed it...

the tests are not part of this PR. They are present in the rest of the code.

closes #707 Signed-off-by: laurentsimon <laurentsimon@google.com>

laurentsimon requested review from asraa, ianlewis and kpk47 as code owners September 26, 2023 23:01

laurentsimon added 2 commits September 26, 2023 23:21

Fix npm publish verification

0e4ca98

Signed-off-by: laurentsimon <laurentsimon@google.com>

update

90a9a36

Signed-off-by: laurentsimon <laurentsimon@google.com>

laurentsimon force-pushed the fix/npm-publish-sig branch from b333e6c to 90a9a36 Compare September 26, 2023 23:22

ianlewis reviewed Sep 27, 2023

View reviewed changes

laurentsimon added 2 commits September 27, 2023 02:34

Add tests and fix linter

1e17039

Signed-off-by: laurentsimon <laurentsimon@google.com>

remove file

fd1dbdf

Signed-off-by: laurentsimon <laurentsimon@google.com>

laurentsimon and others added 14 commits September 27, 2023 09:36

Update verifiers/utils/dsse.go

fad0f3d

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/utils/dsse.go

ed19f8e

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/utils/dsse.go

e86dfad

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/internal/gha/npm.go

cdc4e4c

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/internal/gha/npm.go

5d4f1c2

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/internal/gha/npm.go

167025f

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/internal/gha/npm.go

7dcaf77

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/utils/dsse.go

0362bdf

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/utils/dsse.go

4236743

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/internal/gha/verifier.go

58a9896

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/utils/dsse.go

a468d49

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update verifiers/utils/dsse.go

52b156f

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

address comments

fa57b03

Signed-off-by: laurentsimon <laurentsimon@google.com>

update

f258675

Signed-off-by: laurentsimon <laurentsimon@google.com>

trishankatdatadog reviewed Sep 27, 2023

View reviewed changes

laurentsimon and others added 2 commits September 27, 2023 12:53

Update cli/slsa-verifier/main_regression_test.go

ca7c111

Co-authored-by: Trishank Karthik Kuppusamy <trishank.kuppusamy@datadoghq.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Update cli/slsa-verifier/main_regression_test.go

45225ba

Co-authored-by: Trishank Karthik Kuppusamy <trishank.kuppusamy@datadoghq.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

trishankatdatadog approved these changes Sep 27, 2023

View reviewed changes

ianlewis approved these changes Oct 2, 2023

View reviewed changes

laurentsimon merged commit f6ae402 into slsa-framework:main Oct 2, 2023
14 checks passed

laurentsimon mentioned this pull request Oct 2, 2023

feat: address missed comments in #705 #707

Closed

laurentsimon added a commit that referenced this pull request Oct 9, 2023

feat: Address unresolved comments from #705 (#708)

3b171c4

closes #707 Signed-off-by: laurentsimon <laurentsimon@google.com>

ramonpetgrave64 mentioned this pull request Jul 2, 2024

Add end-to-end tests for npm CLI #571

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: npm publish verification #705

fix: npm publish verification #705

laurentsimon commented Sep 26, 2023 •

edited

Loading

laurentsimon commented Sep 26, 2023

ianlewis commented Sep 27, 2023

trishankatdatadog commented Sep 27, 2023

trishankatdatadog left a comment

laurentsimon commented Sep 27, 2023

trishankatdatadog commented Sep 27, 2023

laurentsimon commented Sep 27, 2023

trishankatdatadog commented Sep 29, 2023

ianlewis left a comment

ianlewis Oct 2, 2023

trishankatdatadog Oct 2, 2023

laurentsimon Oct 2, 2023

ianlewis Oct 2, 2023

laurentsimon commented Oct 2, 2023

fix: npm publish verification #705

fix: npm publish verification #705

Conversation

laurentsimon commented Sep 26, 2023 • edited Loading

laurentsimon commented Sep 26, 2023

ianlewis commented Sep 27, 2023

trishankatdatadog commented Sep 27, 2023

trishankatdatadog left a comment

Choose a reason for hiding this comment

laurentsimon commented Sep 27, 2023

trishankatdatadog commented Sep 27, 2023

laurentsimon commented Sep 27, 2023

trishankatdatadog commented Sep 29, 2023

ianlewis left a comment

Choose a reason for hiding this comment

ianlewis Oct 2, 2023

Choose a reason for hiding this comment

trishankatdatadog Oct 2, 2023

Choose a reason for hiding this comment

laurentsimon Oct 2, 2023

Choose a reason for hiding this comment

ianlewis Oct 2, 2023

Choose a reason for hiding this comment

laurentsimon commented Oct 2, 2023

laurentsimon commented Sep 26, 2023 •

edited

Loading