Skip to content

Commit 362bd1a

Browse files
asraaasraa
authored
feat: add offline bundle signature verification (#457)
* feat: add bundle signature verification Signed-off-by: Asra Ali <[email protected]>
1 parent 0af383c commit 362bd1a

24 files changed

+630
-86
lines changed

‎cli/slsa-verifier/main_regression_test.go

+7-17
Original file line numberDiff line numberDiff line change
@@ -465,15 +465,15 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
465465
{
466466
name: "annotated tag",
467467
artifacts: []string{"annotated-tag"},
468-
source: "github.com/laurentsimon/slsa-on-github-test",
469-
pversiontag: pString("v5.0.1"),
468+
source: "github.com/asraa/slsa-on-github-test",
469+
pversiontag: pString("v1.5.0"),
470470
noversion: true,
471471
},
472472
{
473473
name: "no branch",
474474
artifacts: []string{"annotated-tag"},
475-
source: "github.com/laurentsimon/slsa-on-github-test",
476-
pversiontag: pString("v5.0.1"),
475+
source: "github.com/asraa/slsa-on-github-test",
476+
pversiontag: pString("v1.5.0"),
477477
pbranch: pString("main"),
478478
err: serrors.ErrorMismatchBranch,
479479
noversion: true,
@@ -484,7 +484,7 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
484484
artifacts: []string{"workflow-inputs"},
485485
source: "github.com/laurentsimon/slsa-on-github-test",
486486
inputs: map[string]string{
487-
"release_version": "v1.2.3",
487+
"release_version": "(for example, 0.1.0)",
488488
"some_bool": "true",
489489
"some_integer": "123",
490490
},
@@ -495,7 +495,7 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
495495
artifacts: []string{"workflow-inputs"},
496496
source: "github.com/laurentsimon/slsa-on-github-test",
497497
inputs: map[string]string{
498-
"release_version": "v1.2.3",
498+
"release_version": "(for example, 0.1.0)",
499499
"some_bool": "true",
500500
"missing_field": "123",
501501
},
@@ -507,29 +507,19 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
507507
artifacts: []string{"workflow-inputs"},
508508
source: "github.com/laurentsimon/slsa-on-github-test",
509509
inputs: map[string]string{
510-
"release_version": "v1.2.3",
510+
"release_version": "(for example, 0.1.0)",
511511
"some_bool": "true",
512512
"some_integer": "321",
513513
},
514514
err: serrors.ErrorMismatchWorkflowInputs,
515515
noversion: true,
516516
},
517-
// Regression test of sharded UUID.
518-
{
519-
name: "regression: sharded uuids",
520-
artifacts: []string{"binary-linux-amd64-sharded"},
521-
source: "github.com/slsa-framework/slsa-verifier",
522-
pbranch: pString("release/v1.0"),
523-
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml"),
524-
noversion: true,
525-
},
526517
}
527518
for _, tt := range tests {
528519
tt := tt // Re-initializing variable so it is not changed while executing the closure below
529520
t.Run(tt.name, func(t *testing.T) {
530521
// Avoid rate limiting by not running the tests in parallel.
531522
// t.Parallel()
532-
533523
checkVersions := getBuildersAndVersions(t, "v1.2.2", tt.builders, GHA_ARTIFACT_PATH_BUILDERS)
534524
if tt.noversion {
535525
checkVersions = []string{""}

‎cli/slsa-verifier/testdata/annotated-tag.intoto.jsonl

+1-1
Large diffs are not rendered by default.

‎cli/slsa-verifier/testdata/binary-linux-amd64-e2e-builder-repo

1 KB
Binary file not shown.

‎cli/slsa-verifier/testdata/binary-linux-amd64-e2e-builder-repo.intoto.jsonl

+1-1
Large diffs are not rendered by default.

‎cli/slsa-verifier/testdata/binary-linux-amd64-multi-subject-first.intoto.jsonl

+1-1
Large diffs are not rendered by default.

‎cli/slsa-verifier/testdata/binary-linux-amd64-multi-subject-second.intoto.jsonl

+1-1
Large diffs are not rendered by default.

‎cli/slsa-verifier/testdata/binary-linux-amd64-untrusted-builder

-2.2 KB
Binary file not shown.

‎cli/slsa-verifier/testdata/binary-linux-amd64-untrusted-builder.intoto.jsonl

+1-1
Large diffs are not rendered by default.

‎cli/slsa-verifier/testdata/workflow-inputs.intoto.jsonl

+1-1
Large diffs are not rendered by default.

‎errors/errors.go

+2
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,6 @@ var (
3131
ErrorImageHash = errors.New("cannot retrieve sha256 of image")
3232
ErrorInvalidEncoding = errors.New("invalid encoding")
3333
ErrorInternal = errors.New("internal error")
34+
ErrorInvalidRekorEntry = errors.New("invalid Rekor entry")
35+
ErrorRekorPubKey = errors.New("error retrieving Rekor public keys")
3436
)

‎go.mod

+34-24
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ require (
66
github.com/docker/go v1.5.1-1
77
github.com/go-openapi/runtime v0.25.0
88
github.com/google/go-cmp v0.5.9
9-
github.com/google/trillian v1.5.0 // indirect
9+
github.com/google/trillian v1.5.1-0.20220819043421-0a389c4bb8d9 // indirect
1010
github.com/in-toto/in-toto-golang v0.5.0
1111
github.com/secure-systems-lab/go-securesystemslib v0.4.0
1212
github.com/sigstore/rekor v1.0.1
@@ -19,13 +19,22 @@ require (
1919
github.com/google/go-containerregistry v0.13.0
2020
github.com/gorilla/mux v1.8.0
2121
github.com/sigstore/cosign v1.13.1
22+
github.com/sigstore/cosign/v2 v2.0.0-rc.1
2223
github.com/slsa-framework/slsa-github-generator v1.4.0
2324
github.com/spf13/cobra v1.6.1
2425
github.com/transparency-dev/merkle v0.0.1
2526
golang.org/x/mod v0.7.0
2627
sigs.k8s.io/release-utils v0.7.3
2728
)
2829

30+
require (
31+
filippo.io/edwards25519 v1.0.0 // indirect
32+
github.com/digitorus/pkcs7 v0.0.0-20221212123742-001c36b64ec3 // indirect
33+
github.com/digitorus/timestamp v0.0.0-20221019182153-ef3b63b79b31 // indirect
34+
github.com/sigstore/timestamp-authority v0.2.1 // indirect
35+
go.step.sm/crypto v0.23.1 // indirect
36+
)
37+
2938
require (
3039
bitbucket.org/creachadair/shell v0.0.7 // indirect
3140
cloud.google.com/go/compute v1.14.0 // indirect
@@ -88,14 +97,14 @@ require (
8897
github.com/cyberphone/json-canonicalization v0.0.0-20210823021906-dc406ceaf94b // indirect
8998
github.com/davecgh/go-spew v1.1.1 // indirect
9099
github.com/dimchansky/utfbom v1.1.1 // indirect
91-
github.com/docker/cli v20.10.20+incompatible // indirect
100+
github.com/docker/cli v20.10.21+incompatible // indirect
92101
github.com/docker/distribution v2.8.1+incompatible // indirect
93-
github.com/docker/docker v20.10.20+incompatible // indirect
102+
github.com/docker/docker v20.10.21+incompatible // indirect
94103
github.com/docker/docker-credential-helpers v0.7.0 // indirect
95-
github.com/dustin/go-humanize v1.0.0 // indirect
104+
github.com/dustin/go-humanize v1.0.1 // indirect
96105
github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1 // indirect
97106
github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
98-
github.com/fsnotify/fsnotify v1.5.4 // indirect
107+
github.com/fsnotify/fsnotify v1.6.0 // indirect
99108
github.com/fullstorydev/grpcurl v1.8.7 // indirect
100109
github.com/ghodss/yaml v1.0.0 // indirect
101110
github.com/go-chi/chi v4.1.2+incompatible // indirect
@@ -112,7 +121,7 @@ require (
112121
github.com/go-playground/locales v0.14.0 // indirect
113122
github.com/go-playground/universal-translator v0.18.0 // indirect
114123
github.com/go-playground/validator/v10 v10.11.1 // indirect
115-
github.com/gogo/protobuf v1.3.2 // indirect
124+
github.com/gogo/protobuf v1.3.2
116125
github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
117126
github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
118127
github.com/golang/glog v1.0.0 // indirect
@@ -121,7 +130,7 @@ require (
121130
github.com/golang/protobuf v1.5.2 // indirect
122131
github.com/golang/snappy v0.0.4 // indirect
123132
github.com/google/btree v1.1.2 // indirect
124-
github.com/google/certificate-transparency-go v1.1.3 // indirect
133+
github.com/google/certificate-transparency-go v1.1.4 // indirect
125134
github.com/google/go-github/v45 v45.2.0 // indirect
126135
github.com/google/go-querystring v1.1.0 // indirect
127136
github.com/google/gofuzz v1.2.0 // indirect
@@ -145,10 +154,10 @@ require (
145154
github.com/klauspost/compress v1.15.11 // indirect
146155
github.com/leodido/go-urn v1.2.1 // indirect
147156
github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf // indirect
148-
github.com/magiconair/properties v1.8.6 // indirect
157+
github.com/magiconair/properties v1.8.7 // indirect
149158
github.com/mailru/easyjson v0.7.7 // indirect
150159
github.com/mattn/go-runewidth v0.0.13 // indirect
151-
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
160+
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
152161
github.com/miekg/pkcs11 v1.1.1 // indirect
153162
github.com/mitchellh/go-homedir v1.1.0 // indirect
154163
github.com/mitchellh/mapstructure v1.5.0 // indirect
@@ -161,10 +170,10 @@ require (
161170
github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
162171
github.com/opentracing/opentracing-go v1.2.0 // indirect
163172
github.com/pelletier/go-toml v1.9.5 // indirect
164-
github.com/pelletier/go-toml/v2 v2.0.5 // indirect
173+
github.com/pelletier/go-toml/v2 v2.0.6 // indirect
165174
github.com/pkg/errors v0.9.1 // indirect
166175
github.com/pmezard/go-difflib v1.0.0 // indirect
167-
github.com/prometheus/client_golang v1.13.0 // indirect
176+
github.com/prometheus/client_golang v1.14.0 // indirect
168177
github.com/prometheus/client_model v0.3.0 // indirect
169178
github.com/prometheus/common v0.37.0 // indirect
170179
github.com/prometheus/procfs v0.8.0 // indirect
@@ -173,27 +182,28 @@ require (
173182
github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74 // indirect
174183
github.com/segmentio/ksuid v1.0.4 // indirect
175184
github.com/shibumi/go-pathspec v1.3.0 // indirect
176-
github.com/sigstore/fulcio v0.6.0 // indirect
185+
github.com/sigstore/fulcio v1.0.0 // indirect
186+
github.com/sigstore/protobuf-specs v0.1.1-0.20230120212552-16541696de13
177187
github.com/sirupsen/logrus v1.9.0 // indirect
178188
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
179189
github.com/soheilhy/cmux v0.1.5 // indirect
180-
github.com/spf13/afero v1.8.2 // indirect
190+
github.com/spf13/afero v1.9.3 // indirect
181191
github.com/spf13/cast v1.5.0 // indirect
182192
github.com/spf13/jwalterweatherman v1.1.0 // indirect
183193
github.com/spf13/pflag v1.0.5 // indirect
184-
github.com/spf13/viper v1.13.0 // indirect
194+
github.com/spf13/viper v1.15.0 // indirect
185195
github.com/stretchr/testify v1.8.1 // indirect
186-
github.com/subosito/gotenv v1.4.1 // indirect
196+
github.com/subosito/gotenv v1.4.2 // indirect
187197
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
188198
github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
189199
github.com/thales-e-security/pool v0.0.2 // indirect
190-
github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 // indirect
200+
github.com/theupdateframework/go-tuf v0.5.2 // indirect
191201
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
192202
github.com/tjfoc/gmsm v1.3.2 // indirect
193203
github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
194204
github.com/urfave/cli v1.22.7 // indirect
195205
github.com/vbatts/tar-split v0.11.2 // indirect
196-
github.com/xanzy/go-gitlab v0.73.1 // indirect
206+
github.com/xanzy/go-gitlab v0.79.0 // indirect
197207
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
198208
go.etcd.io/bbolt v1.3.6 // indirect
199209
go.etcd.io/etcd/api/v3 v3.6.0-alpha.0 // indirect
@@ -218,7 +228,7 @@ require (
218228
go.opentelemetry.io/proto/otlp v0.16.0 // indirect
219229
go.uber.org/atomic v1.10.0 // indirect
220230
go.uber.org/multierr v1.8.0 // indirect
221-
go.uber.org/zap v1.23.0 // indirect
231+
go.uber.org/zap v1.24.0 // indirect
222232
golang.org/x/crypto v0.5.0 // indirect
223233
golang.org/x/exp v0.0.0-20220823124025-807a23277127 // indirect
224234
golang.org/x/net v0.5.0 // indirect
@@ -227,12 +237,12 @@ require (
227237
golang.org/x/sys v0.4.0 // indirect
228238
golang.org/x/term v0.4.0 // indirect
229239
golang.org/x/text v0.6.0 // indirect
230-
golang.org/x/time v0.2.0 // indirect
231-
golang.org/x/tools v0.1.12 // indirect
240+
golang.org/x/time v0.3.0 // indirect
241+
golang.org/x/tools v0.5.0 // indirect
232242
google.golang.org/appengine v1.6.7 // indirect
233-
google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef // indirect
234-
google.golang.org/grpc v1.51.0 // indirect
235-
google.golang.org/protobuf v1.28.1 // indirect
243+
google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa // indirect
244+
google.golang.org/grpc v1.52.0 // indirect
245+
google.golang.org/protobuf v1.28.1
236246
gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
237247
gopkg.in/inf.v0 v0.9.1 // indirect
238248
gopkg.in/ini.v1 v1.67.0 // indirect
@@ -243,7 +253,7 @@ require (
243253
k8s.io/api v0.23.5 // indirect
244254
k8s.io/apimachinery v0.23.5 // indirect
245255
k8s.io/client-go v0.23.5 // indirect
246-
k8s.io/klog/v2 v2.60.1-0.20220317184644-43cc75f9ae89 // indirect
256+
k8s.io/klog/v2 v2.80.1 // indirect
247257
k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf // indirect
248258
k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
249259
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect

0 commit comments

Comments
 (0)