Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use default Verifier for the public key contained in a certificate (closes #74) #424

Open
wants to merge 17 commits into
base: main
Choose a base branch
from
Open

Use default Verifier for the public key contained in a certificate (closes #74) #424

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
82a67fb
pkg/verify: load default Verifier given a public key
ret2libc Mar 4, 2025
53b1b91
Merge remote-tracking branch 'origin/main' into crypto-agility-extra-arg
ret2libc Mar 31, 2025
16c9a0b
REMOVE ME: update protobuf-specs/sigstore to trails
ret2libc Mar 31, 2025
9c851da
pkg/verify: try to verify some key types with multiple algos
ret2libc Mar 31, 2025
fd708b7
REMOVE ME: update to trail repos
ret2libc Apr 1, 2025
91dfb97
REMOVE ME: update to trail repos 2
ret2libc Apr 1, 2025
3300ca9
REMOVE ME: update to trail repos 3
ret2libc Apr 1, 2025
6e2376c
pkg/verify: fix lint
ret2libc Apr 1, 2025
fe832c6
allow to enable/disable fallback verifications
ret2libc Apr 2, 2025
7dd8ae3
fix lint
ret2libc Apr 2, 2025
46f1b31
perform the version check in sigstore-go
ret2libc Apr 2, 2025
b1a3e0e
fix lint
ret2libc Apr 2, 2025
943af1d
pkg/verify: make sure to support 0.1/0.2/0.3
ret2libc Apr 2, 2025
fd8ce60
update deps
ret2libc Apr 8, 2025
b9bc219
Merge remote-tracking branch 'origin/main' into crypto-agility-extra-arg
ret2libc Apr 8, 2025
b9c3924
rename NewVirtualSigstoreCustom
ret2libc Apr 8, 2025
e2560fc
pkg/bundle: fix linting
ret2libc Apr 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion examples/oci-image-verification/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ replace github.com/sigstore/sigstore-go => ../../
require (
github.com/google/go-containerregistry v0.20.3
github.com/sigstore/protobuf-specs v0.4.0
github.com/sigstore/sigstore v1.9.0
github.com/sigstore/sigstore v1.9.1
github.com/sigstore/sigstore-go v0.6.2
)

Expand Down
4 changes: 2 additions & 2 deletions examples/oci-image-verification/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,8 +281,8 @@ github.com/sigstore/protobuf-specs v0.4.0 h1:yoZbdh0kZYKOSiVbYyA8J3f2wLh5aUk2SQB
github.com/sigstore/protobuf-specs v0.4.0/go.mod h1:FKW5NYhnnFQ/Vb9RKtQk91iYd0MKJ9AxyqInEwU6+OI=
github.com/sigstore/rekor v1.3.9 h1:sUjRpKVh/hhgqGMs0t+TubgYsksArZ6poLEC3MsGAzU=
github.com/sigstore/rekor v1.3.9/go.mod h1:xThNUhm6eNEmkJ/SiU/FVU7pLY2f380fSDZFsdDWlcM=
github.com/sigstore/sigstore v1.9.0 h1:zUfcKbp8RiJ4wEmA4nvcnEySQAqzF1NtV+v6rVzLwNY=
github.com/sigstore/sigstore v1.9.0/go.mod h1:zUoATYzR1J3rLNp3jmp4fzIJtWdhC3ZM6MnpcBtnsE4=
github.com/sigstore/sigstore v1.9.1 h1:bNMsfFATsMPaagcf+uppLk4C9rQZ2dh5ysmCxQBYWaw=
github.com/sigstore/sigstore v1.9.1/go.mod h1:zUoATYzR1J3rLNp3jmp4fzIJtWdhC3ZM6MnpcBtnsE4=
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.12 h1:EC3UmIaa7nV9sCgSpVevmvgvTYTkMqyrRbj5ojPp7tE=
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.12/go.mod h1:aw60vs3crnQdM/DYH+yF2P0MVKtItwAX34nuaMrY7Lk=
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.12 h1:FPpliDTywSy0woLHMAdmTSZ5IS/lVBZ0dY0I+2HmnSY=
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ require (
github.com/secure-systems-lab/go-securesystemslib v0.9.0
github.com/sigstore/protobuf-specs v0.4.0
github.com/sigstore/rekor v1.3.9
github.com/sigstore/sigstore v1.9.0
github.com/sigstore/sigstore v1.9.1
github.com/sigstore/timestamp-authority v1.2.4
github.com/stretchr/testify v1.10.0
github.com/theupdateframework/go-tuf/v2 v2.0.2
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,8 +287,8 @@ github.com/sigstore/protobuf-specs v0.4.0 h1:yoZbdh0kZYKOSiVbYyA8J3f2wLh5aUk2SQB
github.com/sigstore/protobuf-specs v0.4.0/go.mod h1:FKW5NYhnnFQ/Vb9RKtQk91iYd0MKJ9AxyqInEwU6+OI=
github.com/sigstore/rekor v1.3.9 h1:sUjRpKVh/hhgqGMs0t+TubgYsksArZ6poLEC3MsGAzU=
github.com/sigstore/rekor v1.3.9/go.mod h1:xThNUhm6eNEmkJ/SiU/FVU7pLY2f380fSDZFsdDWlcM=
github.com/sigstore/sigstore v1.9.0 h1:zUfcKbp8RiJ4wEmA4nvcnEySQAqzF1NtV+v6rVzLwNY=
github.com/sigstore/sigstore v1.9.0/go.mod h1:zUoATYzR1J3rLNp3jmp4fzIJtWdhC3ZM6MnpcBtnsE4=
github.com/sigstore/sigstore v1.9.1 h1:bNMsfFATsMPaagcf+uppLk4C9rQZ2dh5ysmCxQBYWaw=
github.com/sigstore/sigstore v1.9.1/go.mod h1:zUoATYzR1J3rLNp3jmp4fzIJtWdhC3ZM6MnpcBtnsE4=
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.12 h1:EC3UmIaa7nV9sCgSpVevmvgvTYTkMqyrRbj5ojPp7tE=
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.12/go.mod h1:aw60vs3crnQdM/DYH+yF2P0MVKtItwAX34nuaMrY7Lk=
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.12 h1:FPpliDTywSy0woLHMAdmTSZ5IS/lVBZ0dY0I+2HmnSY=
Expand Down
9 changes: 7 additions & 2 deletions pkg/verify/signature.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,8 +97,13 @@ func VerifySignatureWithArtifactDigest(sigContent SignatureContent, verification

func getSignatureVerifier(verificationContent VerificationContent, tm root.TrustedMaterial) (signature.Verifier, error) {
if leafCert := verificationContent.Certificate(); leafCert != nil {
// TODO: Inspect certificate's SignatureAlgorithm to determine hash function
return signature.LoadVerifier(leafCert.PublicKey, crypto.SHA256)
// LoadDefaultSigner/Verifier functions accept a few options to select
// the default signer/verifier when there are ambiguities, like for
// ED25519 keys, which could be used with PureEd25519 or Ed25519ph.
//
// Pass `WithED25519ph()` to select Ed25519ph by default, when ED25519
// key is found, because for hashedrekord entries this is the only option.
return signature.LoadDefaultVerifier(leafCert.PublicKey, options.WithED25519ph())
} else if pk := verificationContent.PublicKey(); pk != nil {
return tm.PublicKeyVerifier(pk.Hint())
}
Expand Down
Loading