github/slsa-verifier
1
0
Fork 0
mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-08-18 02:56:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

handle dssev001 tlog entry types

Browse Source 
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
This commit is contained in:
Ramon Petgrave
2024-08-13 15:42:58 +00:00
parent e8275856e0
commit bc65aede98
2 changed files with 238 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
verifiers/internal/gha/bundle.go
+48 -4
View File
@@ -111,12 +111,20 @@ func getLeafCertFromBundle(bundle *bundle_v1.Bundle) (*x509.Certificate, error)
// tlog timestamp attests to the signature creation time.
func matchRekorEntryWithEnvelope(tlogEntry *v1.TransparencyLogEntry, env *dsselib.Envelope) error {
kindVersion := tlogEntry.GetKindVersion()
if kindVersion.Kind != "intoto" &&
kindVersion.Version != "0.0.2" {
return fmt.Errorf("%w: expected intoto:0.0.2, got %s:%s", ErrorUnexpectedEntryType,
kindVersion.Kind, kindVersion.Version)
if kindVersion.Kind == "intoto" && kindVersion.Version == "0.0.2" {
return matchRekorEntryWithEnvelopeIntotov002(tlogEntry, env)
}
if kindVersion.Kind == "dsse" && kindVersion.Version == "0.0.1" {
return matchRekorEntryWithEnvelopeDSSEv001(tlogEntry, env)
}
return fmt.Errorf("%w: %s: %s", ErrorUnexpectedEntryType, kindVersion.Kind, kindVersion.Version)
}
// matchRekorEntryWithEnvelopeDSSEv001 handles matchRekorEntryWithEnvelope for the intoto v0.0.1 type version.
func matchRekorEntryWithEnvelopeIntotov002(tlogEntry *v1.TransparencyLogEntry, env *dsselib.Envelope) error {
canonicalBody := tlogEntry.GetCanonicalizedBody()
var toto models.Intoto
var intotoObj models.IntotoV002Schema
@@ -156,6 +164,42 @@ func matchRekorEntryWithEnvelope(tlogEntry *v1.TransparencyLogEntry, env *dsseli
return nil
}
// matchRekorEntryWithEnvelopeDSSEv001 handles matchRekorEntryWithEnvelope for the dsse v0.0.1 type version.
func matchRekorEntryWithEnvelopeDSSEv001(tlogEntry *v1.TransparencyLogEntry, env *dsselib.Envelope) error {
canonicalBody := tlogEntry.GetCanonicalizedBody()
var dsseObj models.DSSE
if err := json.Unmarshal(canonicalBody, &dsseObj); err != nil {
return fmt.Errorf("%w: %s", ErrorUnexpectedEntryType, err)
}
var dsseSchemaObj models.DSSEV001Schema
specMarshal, err := json.Marshal(dsseObj.Spec)
fmt.Println(fmt.Sprintf("%s", specMarshal))
if err != nil {
return fmt.Errorf("%w: %s", ErrorUnexpectedEntryType, err)
}
if err := json.Unmarshal(specMarshal, &dsseSchemaObj); err != nil {
return fmt.Errorf("%w: %s", ErrorUnexpectedEntryType, err)
}
if len(env.Signatures) != len(dsseSchemaObj.Signatures) {
return fmt.Errorf("expected %d sigs in canonical body, got %d",
len(env.Signatures),
len(dsseSchemaObj.Signatures))
}
// TODO(#487): verify the certs match.
for _, sig := range env.Signatures {
var matchCanonical bool
for _, canonicalSig := range dsseSchemaObj.Signatures {
if *canonicalSig.Signature == sig.Sig {
matchCanonical = true
}
}
if !matchCanonical {
return ErrorMismatchSignature
}
}
return nil
}
// VerifyProvenanceBundle verifies the DSSE envelope using the offline Rekor bundle and
// returns the verified DSSE envelope containing the provenance
// and the signing certificate given the provenance.
verifiers/internal/gha/bundle_test.go
+190
View File
@@ -7,7 +7,10 @@ import (
"testing"
"github.com/google/go-cmp/cmp"
dsselib "github.com/secure-systems-lab/go-securesystemslib/dsse"
rekorpbv1 "github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1"
serrors "github.com/slsa-framework/slsa-verifier/v2/errors"
"github.com/slsa-framework/slsa-verifier/v2/verifiers/utils"
)
@@ -76,3 +79,190 @@ func Test_verifyBundle(t *testing.T) {
})
}
}
func Test_matchRekorEntryWithEnvelope(t *testing.T) {
t.Parallel()
tests := []struct {
name string
tlog *rekorpbv1.TransparencyLogEntry
env *dsselib.Envelope
err error
}{
{
name: "success: dsse v0.0.1",
tlog: &rekorpbv1.TransparencyLogEntry{
KindVersion: &rekorpbv1.KindVersion{
Kind: "dsse",
Version: "0.0.1",
},
CanonicalizedBody: []byte(`
{
"apiVersion": "0.0.1",
"kind": "dsse",
"spec": {
"signatures": [
{
"signature": "MEUCIHiah7zQLL9LK9m9/0JH3rHIaYlvcus4h84KOdaR3iAlAiEAio+tnbpkW+V+FPYxpuiJBY0MuD43RVX5QmMwk3sgnUE="
}
]
}
}
`),
},
env: &dsselib.Envelope{
Signatures: []dsselib.Signature{
{
Sig: "MEUCIHiah7zQLL9LK9m9/0JH3rHIaYlvcus4h84KOdaR3iAlAiEAio+tnbpkW+V+FPYxpuiJBY0MuD43RVX5QmMwk3sgnUE=",
},
},
},
err: nil,
},
{
name: "success: intoto v0.0.2",
tlog: &rekorpbv1.TransparencyLogEntry{
KindVersion: &rekorpbv1.KindVersion{
Kind: "intoto",
Version: "0.0.2",
},
CanonicalizedBody: []byte(`
{
"apiVersion": "0.0.2",
"kind": "intoto",
"spec": {
"content": {
"envelope": {
"signatures": [
{
"publicKey": "mypubkey",
"sig": "TUVVQ0lRRGVoVlQ0MFRLUDNxWnlVN3BDcXhwMzRyeGt1Wk1ZRTVBWGhBb0x4NTdzdmdJZ0xSa3NCV1hPamUyMCtrKzh4M3ViZkZzNlpxQ2dLNXc3eXlITFB6SC9tcGs9"
}
]
}
}
}
}
`),
},
env: &dsselib.Envelope{
Signatures: []dsselib.Signature{
{
Sig: "MEUCIQDehVT40TKP3qZyU7pCqxp34rxkuZMYE5AXhAoLx57svgIgLRksBWXOje20+k+8x3ubfFs6ZqCgK5w7yyHLPzH/mpk=",
},
},
},
err: nil,
},
{
name: "faiulure: dsse v0.0.1: mismatch signatures",
tlog: &rekorpbv1.TransparencyLogEntry{
KindVersion: &rekorpbv1.KindVersion{
Kind: "dsse",
Version: "0.0.1",
},
CanonicalizedBody: []byte(`
{
"apiVersion": "0.0.1",
"kind": "dsse",
"spec": {
"signatures": [
{
"signature": "MEUCIHiah7zQLL9LK9m9/0JH3rHIaYlvcus4h84KOdaR3iAlAiEAio+tnbpkW+V+FPYxpuiJBY0MuD43RVX5QmMwk3sgnUE="
}
]
}
}
`),
},
env: &dsselib.Envelope{
Signatures: []dsselib.Signature{
{
Sig: "d3Jvbmcgc2lnCg==",
},
},
},
err: ErrorMismatchSignature,
},
{
name: "faiulure: intoto v0.0.2: mismatch signatures",
tlog: &rekorpbv1.TransparencyLogEntry{
KindVersion: &rekorpbv1.KindVersion{
Kind: "intoto",
Version: "0.0.2",
},
CanonicalizedBody: []byte(`
{
"apiVersion": "0.0.2",
"kind": "intoto",
"spec": {
"content": {
"envelope": {
"signatures": [
{
"publicKey": "mypubkey",
"sig": "TUVVQ0lRRGVoVlQ0MFRLUDNxWnlVN3BDcXhwMzRyeGt1Wk1ZRTVBWGhBb0x4NTdzdmdJZ0xSa3NCV1hPamUyMCtrKzh4M3ViZkZzNlpxQ2dLNXc3eXlITFB6SC9tcGs9"
}
]
}
}
}
}
`),
},
env: &dsselib.Envelope{
Signatures: []dsselib.Signature{
{
Sig: "d3Jvbmcgc2lnCg==",
},
},
},
err: ErrorMismatchSignature,
},
{
name: "failure: unknown type",
tlog: &rekorpbv1.TransparencyLogEntry{
KindVersion: &rekorpbv1.KindVersion{
Kind: "slsa",
Version: "0.0.x",
},
},
env: &dsselib.Envelope{},
err: ErrorUnexpectedEntryType,
},
{
name: "failure: unknown dsse type version",
tlog: &rekorpbv1.TransparencyLogEntry{
KindVersion: &rekorpbv1.KindVersion{
Kind: "dsse",
Version: "0.0.x",
},
},
env: &dsselib.Envelope{},
err: ErrorUnexpectedEntryType,
},
{
name: "failure: unknown intoto type version",
tlog: &rekorpbv1.TransparencyLogEntry{
KindVersion: &rekorpbv1.KindVersion{
Kind: "dsse",
Version: "0.0.x",
},
},
env: &dsselib.Envelope{},
err: ErrorUnexpectedEntryType,
},
}
for _, tt := range tests {
tt := tt // Re-initializing variable so it is not changed while executing the closure below
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
err := matchRekorEntryWithEnvelope(tt.tlog, tt.env)
if !errCmp(err, tt.err) {
t.Errorf(cmp.Diff(err, tt.err))
}
})
}
}