Adding protobuf bundle support to sign-blob and attest-blob #3752

steiza · 2024-06-28T18:57:14Z

Summary

This pull requests addresses the first part of #3139: adding protobuf bundle support for cosign sign-blob and cosign attest-blob.

You can test this by generating the new bundles, for example signing a local file with a cosign provisioned key (requesting a signed timestamp to corroborate):

go run cmd/cosign/main.go sign-blob --bundle="test-bundle.sigstore.json" --new-bundle-format=true --key="cosign.key" --tlog-upload=false --timestamp-server-url="https://timestamp.githubapp.com/api/v1/timestamp" ../sigstore-go/examples/sigstore-go-signing/hello_world.txt

Or using Fulcio to get a signing certificate for an attestation:

go run cmd/cosign/main.go attest-blob --bundle="pgi-bundle.sigstore.json" --new-bundle-format=true --fulcio-url='https://fulcio.sigstore.dev' --rekor-url='https://rekor.sigstore.dev' --identity-token='...' --type=something --predicate="../sigstore-go/examples/sigstore-go-signing/intoto.txt" ../sigstore-go/examples/sigstore-go-signing/hello_world.txt

You can then verify the public good instance bundle using sigstore-go doing something like:

go run cmd/sigstore-go/main.go -artifact examples/sigstore-go-signing/hello_world.txt -trustedrootJSONpath public-good-trusted-root.json -expectedIssuer "https://token.actions.githubusercontent.com" -expectedSANRegex ".+" ../cosign/pgi-bundle.sigstore.json

Release Note

NONE - we probably want to finish #3139 (especially the more comprehensive conformance testing!) before we announce this as released.

Documentation

N/A - same as above

codecov · 2024-07-01T13:00:21Z

Codecov Report

Attention: Patch coverage is 34.44976% with 137 lines in your changes missing coverage. Please review.

Project coverage is 37.67%. Comparing base (2ef6022) to head (5892fed).
Report is 166 commits behind head on main.

Files	Patch %	Lines
cmd/cosign/cli/attest/attest_blob.go	5.68%	82 Missing and 1 partial ⚠️
cmd/cosign/cli/sign/sign_blob.go	46.75%	34 Missing and 7 partials ⚠️
cmd/cosign/cli/options/attest_blob.go	0.00%	4 Missing ⚠️
cmd/cosign/cli/options/signblob.go	0.00%	4 Missing ⚠️
pkg/cosign/bundle/protobundle.go	91.17%	2 Missing and 1 partial ⚠️
cmd/cosign/cli/attest_blob.go	0.00%	1 Missing ⚠️
cmd/cosign/cli/signblob.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3752      +/-   ##
==========================================
- Coverage   40.10%   37.67%   -2.44%     
==========================================
  Files         155      201      +46     
  Lines       10044    12436    +2392     
==========================================
+ Hits         4028     4685     +657     
- Misses       5530     7175    +1645     
- Partials      486      576      +90

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

cmd/cosign/cli/options/attest_blob.go

cmd/cosign/cli/attest/attest_blob.go

haydentherapper

Fantastic!! Just a few tiny comments, also needs a rebase.

cmd/cosign/cli/attest/attest_blob.go

pkg/cosign/bundle/protobundle_test.go

haydentherapper

Great work on this!

haydentherapper · 2024-07-23T00:58:42Z

@steiza can you rebase? Just to check, anything else here or any other testing, or is this good to merge?

Signed-off-by: Zach Steindler <steiza@github.com>

steiza · 2024-07-23T13:37:20Z

Just to check, anything else here or any other testing, or is this good to merge?

I think this is good to merge!

When adding bundles support to `attest-blob`, we sent the wrong data to the timestamp authority to sign. Signed-off-by: Zach Steindler <steiza@github.com>

…les (#3877) * Fix bug in #3752 When adding bundles support to `attest-blob`, we sent the wrong data to the timestamp authority to sign. Signed-off-by: Zach Steindler <steiza@github.com> * Only change timestamp authority signature behavior for new bundles Also add TODO when we get to updating `cosign attest` Signed-off-by: Zach Steindler <steiza@github.com> * Add happy path e2e test Signed-off-by: Zach Steindler <steiza@github.com> --------- Signed-off-by: Zach Steindler <steiza@github.com>

…les (sigstore#3877) * Fix bug in sigstore#3752 When adding bundles support to `attest-blob`, we sent the wrong data to the timestamp authority to sign. Signed-off-by: Zach Steindler <steiza@github.com> * Only change timestamp authority signature behavior for new bundles Also add TODO when we get to updating `cosign attest` Signed-off-by: Zach Steindler <steiza@github.com> * Add happy path e2e test Signed-off-by: Zach Steindler <steiza@github.com> --------- Signed-off-by: Zach Steindler <steiza@github.com>

…#3752) This pull requests addresses the first part of sigstore#3139: adding protobuf bundle support for cosign sign-blob and cosign attest-blob. Signed-off-by: Zach Steindler <steiza@github.com>

…les (sigstore#3877) * Fix bug in sigstore#3752 When adding bundles support to `attest-blob`, we sent the wrong data to the timestamp authority to sign. Signed-off-by: Zach Steindler <steiza@github.com> * Only change timestamp authority signature behavior for new bundles Also add TODO when we get to updating `cosign attest` Signed-off-by: Zach Steindler <steiza@github.com> * Add happy path e2e test Signed-off-by: Zach Steindler <steiza@github.com> --------- Signed-off-by: Zach Steindler <steiza@github.com>

haydentherapper requested review from haydentherapper and cmurphy June 28, 2024 21:04

cmurphy reviewed Jul 2, 2024

View reviewed changes

cmd/cosign/cli/options/attest_blob.go Outdated Show resolved Hide resolved

cmd/cosign/cli/attest/attest_blob.go Show resolved Hide resolved

steiza force-pushed the sign-blob-bundle branch from a169d49 to fb90891 Compare July 3, 2024 17:55

steiza mentioned this pull request Jul 8, 2024

Support the protobuf bundle format in Cosign #3139

Closed

8 tasks

haydentherapper reviewed Jul 11, 2024

View reviewed changes

cmd/cosign/cli/attest/attest_blob.go Outdated Show resolved Hide resolved

cmd/cosign/cli/attest/attest_blob.go Outdated Show resolved Hide resolved

pkg/cosign/bundle/protobundle_test.go Show resolved Hide resolved

steiza force-pushed the sign-blob-bundle branch from 1629e5c to 94fd652 Compare July 16, 2024 14:53

haydentherapper previously approved these changes Jul 23, 2024

View reviewed changes

steiza added 14 commits July 23, 2024 08:47

Adding protobuf bundle support to sign-blob and attest-blob

c1ed1d9

Signed-off-by: Zach Steindler <steiza@github.com>

Don't require RFC3161 timestamp path if you are using protobuf bundle

58a87dd

Signed-off-by: Zach Steindler <steiza@github.com>

Fix e2e test and add test coverage

31a5e50

Signed-off-by: Zach Steindler <steiza@github.com>

Add basic tests for SignBlobCmd

bfe8d37

Signed-off-by: Zach Steindler <steiza@github.com>

Add more SignBlobCmd test coverage

59aaca9

Signed-off-by: Zach Steindler <steiza@github.com>

Check result of call in test

3783ce3

Signed-off-by: Zach Steindler <steiza@github.com>

Fix Windows tests

d932ceb

Signed-off-by: Zach Steindler <steiza@github.com>

Change flag to new-bundle-format, move bundle creation to function

38c0420

Signed-off-by: Zach Steindler <steiza@github.com>

Fix lint; docs

689ad7f

Signed-off-by: Zach Steindler <steiza@github.com>

gofmt -s fixes

c9f6084

Signed-off-by: Zach Steindler <steiza@github.com>

Update hint generation

4c5e8c9

Signed-off-by: Zach Steindler <steiza@github.com>

Add protobundle test case for Rekor

96d662e

Signed-off-by: Zach Steindler <steiza@github.com>

Remove import comment

c792600

Signed-off-by: Zach Steindler <steiza@github.com>

Fix signature for attest-blob

5892fed

Signed-off-by: Zach Steindler <steiza@github.com>

steiza dismissed haydentherapper’s stale review via 5892fed July 23, 2024 12:55

steiza force-pushed the sign-blob-bundle branch from f78e262 to 5892fed Compare July 23, 2024 12:55

haydentherapper approved these changes Jul 23, 2024

View reviewed changes

haydentherapper merged commit c6cdf1b into sigstore:main Jul 23, 2024

steiza mentioned this pull request Jul 23, 2024

Add new bundle support to verify-blob and verify-blob-attestation #3796

Merged

steiza added a commit to steiza/cosign that referenced this pull request Sep 11, 2024

Fix bug in sigstore#3752

b88c748

When adding bundles support to `attest-blob`, we sent the wrong data to the timestamp authority to sign. Signed-off-by: Zach Steindler <steiza@github.com>

steiza mentioned this pull request Sep 11, 2024

Fix bug in attest-blob when using a timestamp authority with new bundles #3877

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Adding protobuf bundle support to sign-blob and attest-blob #3752

Adding protobuf bundle support to sign-blob and attest-blob #3752

Uh oh!

steiza commented Jun 28, 2024 •

edited

Loading

Uh oh!

codecov bot commented Jul 1, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

haydentherapper left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

haydentherapper left a comment

Uh oh!

haydentherapper commented Jul 23, 2024

Uh oh!

steiza commented Jul 23, 2024

Uh oh!

Uh oh!

Adding protobuf bundle support to sign-blob and attest-blob #3752

Adding protobuf bundle support to sign-blob and attest-blob #3752

Uh oh!

Conversation

steiza commented Jun 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Release Note

Documentation

Uh oh!

codecov bot commented Jul 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

haydentherapper left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

haydentherapper left a comment

Choose a reason for hiding this comment

Uh oh!

haydentherapper commented Jul 23, 2024

Uh oh!

steiza commented Jul 23, 2024

Uh oh!

Uh oh!

steiza commented Jun 28, 2024 •

edited

Loading

codecov bot commented Jul 1, 2024 •

edited

Loading