Skip to content

Commit 6028298

Browse files
cmurphycmurphy
committed
Deduplicate TUF v1 fetch and rekor client setup
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
1 parent 797e604 commit 6028298

File tree

5 files changed

+57
-161
lines changed

5 files changed

+57
-161
lines changed

‎cmd/cosign/cli/verify/common.go‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"fmt"
2121
"reflect"
2222

23+
"github.com/sigstore/cosign/v3/cmd/cosign/cli/rekor"
2324
"github.com/sigstore/cosign/v3/pkg/cosign"
2425
"github.com/sigstore/cosign/v3/pkg/cosign/pivkey"
2526
"github.com/sigstore/cosign/v3/pkg/cosign/pkcs11key"
@@ -109,3 +110,47 @@ func LoadVerifierFromKeyOrCert(ctx context.Context, keyRef, slot, certRef, certC
109110
}
110111
return nil, nil, func() {}, nil
111112
}
113+
114+
// SetLegacyClientsAndKeys sets up TSA and rekor clients and keys for TSA, rekor, and CT log.
115+
// It may perform an online fetch of keys, so using trusted root instead of these TUF v1 methos is recommended.
116+
// It takes a CheckOpts as input and modifies it.
117+
func SetLegacyClientsAndKeys(ctx context.Context, ignoreTlog, shouldVerifySCT, keylessVerification bool, rekorURL, tsaCertChain, certChain, caRoots, caIntermediates string, co *cosign.CheckOpts) error {
118+
var err error
119+
if !ignoreTlog && !co.NewBundleFormat && rekorURL != "" {
120+
co.RekorClient, err = rekor.NewClient(rekorURL)
121+
if err != nil {
122+
return fmt.Errorf("creating rekor client: %w", err)
123+
}
124+
}
125+
// If trusted material is set, we don't need to fetch disparate keys.
126+
if co.TrustedMaterial != nil {
127+
return nil
128+
}
129+
if co.UseSignedTimestamps {
130+
tsaCertificates, err := cosign.GetTSACerts(ctx, tsaCertChain, cosign.GetTufTargets)
131+
if err != nil {
132+
return fmt.Errorf("loading TSA certificates: %w", err)
133+
}
134+
co.TSACertificate = tsaCertificates.LeafCert
135+
co.TSARootCertificates = tsaCertificates.RootCert
136+
co.TSAIntermediateCertificates = tsaCertificates.IntermediateCerts
137+
}
138+
if !ignoreTlog {
139+
co.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
140+
if err != nil {
141+
return fmt.Errorf("getting rekor public keys: %w", err)
142+
}
143+
}
144+
if shouldVerifySCT {
145+
co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx)
146+
if err != nil {
147+
return fmt.Errorf("getting ctlog public keys: %w", err)
148+
}
149+
}
150+
if keylessVerification {
151+
if err := loadCertsKeylessVerification(certChain, caRoots, caIntermediates, co); err != nil {
152+
return fmt.Errorf("loading certs for keyless verification: %w", err)
153+
}
154+
}
155+
return nil
156+
}

‎cmd/cosign/cli/verify/verify.go‎

Lines changed: 3 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ import (
3232
"github.com/in-toto/in-toto-golang/in_toto"
3333
"github.com/sigstore/cosign/v3/cmd/cosign/cli/fulcio"
3434
"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
35-
"github.com/sigstore/cosign/v3/cmd/cosign/cli/rekor"
3635
"github.com/sigstore/cosign/v3/cmd/cosign/cli/sign"
3736
cosignError "github.com/sigstore/cosign/v3/cmd/cosign/errors"
3837
"github.com/sigstore/cosign/v3/internal/ui"
@@ -177,46 +176,9 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) {
177176
co.ClaimVerifier = cosign.SimpleClaimVerifier
178177
}
179178

180-
// If we are using signed timestamps and there is no trusted root, we need to load the TSA certificates
181-
if co.UseSignedTimestamps && co.TrustedMaterial == nil && !co.NewBundleFormat {
182-
tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets)
183-
if err != nil {
184-
return fmt.Errorf("unable to load TSA certificates: %w", err)
185-
}
186-
co.TSACertificate = tsaCertificates.LeafCert
187-
co.TSARootCertificates = tsaCertificates.RootCert
188-
co.TSAIntermediateCertificates = tsaCertificates.IntermediateCerts
189-
}
190-
191-
if !c.IgnoreTlog && !co.NewBundleFormat {
192-
if c.RekorURL != "" {
193-
rekorClient, err := rekor.NewClient(c.RekorURL)
194-
if err != nil {
195-
return fmt.Errorf("creating Rekor client: %w", err)
196-
}
197-
co.RekorClient = rekorClient
198-
}
199-
if co.TrustedMaterial == nil {
200-
// This performs an online fetch of the Rekor public keys, but this is needed
201-
// for verifying tlog entries (both online and offline).
202-
co.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
203-
if err != nil {
204-
return fmt.Errorf("getting Rekor public keys: %w", err)
205-
}
206-
}
207-
}
208-
if co.TrustedMaterial == nil && keylessVerification(c.KeyRef, c.Sk) {
209-
if err := loadCertsKeylessVerification(c.CertChain, c.CARoots, c.CAIntermediates, co); err != nil {
210-
return err
211-
}
212-
}
213-
214-
// Ignore Signed Certificate Timestamp if the flag is set or a key is provided
215-
if co.TrustedMaterial == nil && shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) {
216-
co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx)
217-
if err != nil {
218-
return fmt.Errorf("getting ctlog public keys: %w", err)
219-
}
179+
err = SetLegacyClientsAndKeys(ctx, c.IgnoreTlog, shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk), keylessVerification(c.KeyRef, c.Sk), c.RekorURL, c.TSACertChainPath, c.CertChain, c.CARoots, c.CAIntermediates, co)
180+
if err != nil {
181+
return fmt.Errorf("setting up clients and keys: %w", err)
220182
}
221183

222184
// Keys are optional!

‎cmd/cosign/cli/verify/verify_attestation.go‎

Lines changed: 3 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ import (
2727

2828
"github.com/google/go-containerregistry/pkg/name"
2929
"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
30-
"github.com/sigstore/cosign/v3/cmd/cosign/cli/rekor"
3130
"github.com/sigstore/cosign/v3/internal/ui"
3231
"github.com/sigstore/cosign/v3/pkg/cosign"
3332
"github.com/sigstore/cosign/v3/pkg/cosign/cue"
@@ -156,47 +155,9 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e
156155
return err
157156
}
158157

159-
// Ignore Signed Certificate Timestamp if the flag is set or a key is provided
160-
if co.TrustedMaterial == nil && shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) && !co.NewBundleFormat {
161-
co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx)
162-
if err != nil {
163-
return fmt.Errorf("getting ctlog public keys: %w", err)
164-
}
165-
}
166-
167-
// If we are using signed timestamps, we need to load the TSA certificates
168-
if co.UseSignedTimestamps && co.TrustedMaterial == nil && !co.NewBundleFormat {
169-
tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets)
170-
if err != nil {
171-
return fmt.Errorf("unable to load TSA certificates: %w", err)
172-
}
173-
co.TSACertificate = tsaCertificates.LeafCert
174-
co.TSARootCertificates = tsaCertificates.RootCert
175-
co.TSAIntermediateCertificates = tsaCertificates.IntermediateCerts
176-
}
177-
178-
if !c.IgnoreTlog && !co.NewBundleFormat {
179-
if c.RekorURL != "" {
180-
rekorClient, err := rekor.NewClient(c.RekorURL)
181-
if err != nil {
182-
return fmt.Errorf("creating Rekor client: %w", err)
183-
}
184-
co.RekorClient = rekorClient
185-
}
186-
if co.TrustedMaterial == nil {
187-
// This performs an online fetch of the Rekor public keys, but this is needed
188-
// for verifying tlog entries (both online and offline).
189-
co.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
190-
if err != nil {
191-
return fmt.Errorf("getting Rekor public keys: %w", err)
192-
}
193-
}
194-
}
195-
196-
if co.TrustedMaterial == nil && keylessVerification(c.KeyRef, c.Sk) {
197-
if err := loadCertsKeylessVerification(c.CertChain, c.CARoots, c.CAIntermediates, co); err != nil {
198-
return err
199-
}
158+
err = SetLegacyClientsAndKeys(ctx, c.IgnoreTlog, shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk), keylessVerification(c.KeyRef, c.Sk), c.RekorURL, c.TSACertChainPath, c.CertChain, c.CARoots, c.CAIntermediates, co)
159+
if err != nil {
160+
return fmt.Errorf("setting up clients and keys: %w", err)
200161
}
201162

202163
// Keys are optional!

‎cmd/cosign/cli/verify/verify_blob.go‎

Lines changed: 3 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ import (
3232
"strings"
3333

3434
"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
35-
"github.com/sigstore/cosign/v3/cmd/cosign/cli/rekor"
3635
"github.com/sigstore/cosign/v3/internal/ui"
3736
"github.com/sigstore/cosign/v3/pkg/blob"
3837
"github.com/sigstore/cosign/v3/pkg/cosign"
@@ -184,39 +183,12 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
184183
} else if c.RFC3161TimestampPath == "" && co.UseSignedTimestamps {
185184
return fmt.Errorf("when specifying --use-signed-timestamps or --timestamp-certificate-chain, you must also specify --rfc3161-timestamp-path")
186185
}
187-
if co.UseSignedTimestamps && co.TrustedMaterial == nil {
188-
tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets)
189-
if err != nil {
190-
return fmt.Errorf("unable to load TSA certificates: %w", err)
191-
}
192-
co.TSACertificate = tsaCertificates.LeafCert
193-
co.TSARootCertificates = tsaCertificates.RootCert
194-
co.TSAIntermediateCertificates = tsaCertificates.IntermediateCerts
195-
}
196186

197-
if !c.IgnoreTlog {
198-
if c.RekorURL != "" {
199-
rekorClient, err := rekor.NewClient(c.RekorURL)
200-
if err != nil {
201-
return fmt.Errorf("creating Rekor client: %w", err)
202-
}
203-
co.RekorClient = rekorClient
204-
}
205-
if co.TrustedMaterial == nil {
206-
// This performs an online fetch of the Rekor public keys, but this is needed
207-
// for verifying tlog entries (both online and offline).
208-
co.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
209-
if err != nil {
210-
return fmt.Errorf("getting Rekor public keys: %w", err)
211-
}
212-
}
187+
err = SetLegacyClientsAndKeys(ctx, c.IgnoreTlog, shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk), keylessVerification(c.KeyRef, c.Sk), c.RekorURL, c.TSACertChainPath, c.CertChain, c.CARoots, c.CAIntermediates, co)
188+
if err != nil {
189+
return fmt.Errorf("setting up clients and keys: %w", err)
213190
}
214191

215-
if co.TrustedMaterial == nil && keylessVerification(c.KeyRef, c.Sk) {
216-
if err := loadCertsKeylessVerification(c.CertChain, c.CARoots, c.CAIntermediates, co); err != nil {
217-
return err
218-
}
219-
}
220192
opts := make([]static.Option, 0)
221193
if c.BundlePath != "" {
222194
b, err := cosign.FetchLocalSignedPayloadFromPath(c.BundlePath)
@@ -310,14 +282,6 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
310282
opts = append(opts, static.WithCertChain(certPEM, chainPEM))
311283
}
312284

313-
// Ignore Signed Certificate Timestamp if the flag is set or a key is provided
314-
if co.TrustedMaterial == nil && shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) {
315-
co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx)
316-
if err != nil {
317-
return fmt.Errorf("getting ctlog public keys: %w", err)
318-
}
319-
}
320-
321285
sig, err := base64signature(c.SigRef, c.BundlePath)
322286
if err != nil {
323287
return err

‎cmd/cosign/cli/verify/verify_blob_attestation.go‎

Lines changed: 3 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ import (
3030

3131
v1 "github.com/google/go-containerregistry/pkg/v1"
3232
"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
33-
"github.com/sigstore/cosign/v3/cmd/cosign/cli/rekor"
3433
internal "github.com/sigstore/cosign/v3/internal/pkg/cosign"
3534
payloadsize "github.com/sigstore/cosign/v3/internal/pkg/cosign/payload/size"
3635
"github.com/sigstore/cosign/v3/internal/ui"
@@ -229,45 +228,10 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
229228
} else if c.RFC3161TimestampPath == "" && co.UseSignedTimestamps {
230229
return fmt.Errorf("when specifying --use-signed-timestamps or --timestamp-certificate-chain, you must also specify --rfc3161-timestamp-path")
231230
}
232-
if co.UseSignedTimestamps && co.TrustedMaterial == nil {
233-
tsaCertificates, err := cosign.GetTSACerts(ctx, c.TSACertChainPath, cosign.GetTufTargets)
234-
if err != nil {
235-
return fmt.Errorf("unable to load TSA certificates: %w", err)
236-
}
237-
co.TSACertificate = tsaCertificates.LeafCert
238-
co.TSARootCertificates = tsaCertificates.RootCert
239-
co.TSAIntermediateCertificates = tsaCertificates.IntermediateCerts
240-
}
241231

242-
if !c.IgnoreTlog {
243-
if c.RekorURL != "" {
244-
rekorClient, err := rekor.NewClient(c.RekorURL)
245-
if err != nil {
246-
return fmt.Errorf("creating Rekor client: %w", err)
247-
}
248-
co.RekorClient = rekorClient
249-
}
250-
if co.TrustedMaterial == nil {
251-
// This performs an online fetch of the Rekor public keys, but this is needed
252-
// for verifying tlog entries (both online and offline).
253-
co.RekorPubKeys, err = cosign.GetRekorPubs(ctx)
254-
if err != nil {
255-
return fmt.Errorf("getting Rekor public keys: %w", err)
256-
}
257-
}
258-
}
259-
if co.TrustedMaterial == nil && keylessVerification(c.KeyRef, c.Sk) {
260-
if err := loadCertsKeylessVerification(c.CertChain, c.CARoots, c.CAIntermediates, co); err != nil {
261-
return err
262-
}
263-
}
264-
265-
// Ignore Signed Certificate Timestamp if the flag is set or a key is provided
266-
if co.TrustedMaterial == nil && shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk) {
267-
co.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx)
268-
if err != nil {
269-
return fmt.Errorf("getting ctlog public keys: %w", err)
270-
}
232+
err = SetLegacyClientsAndKeys(ctx, c.IgnoreTlog, shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk), keylessVerification(c.KeyRef, c.Sk), c.RekorURL, c.TSACertChainPath, c.CertChain, c.CARoots, c.CAIntermediates, co)
233+
if err != nil {
234+
return fmt.Errorf("setting up clients and keys: %w", err)
271235
}
272236

273237
var encodedSig []byte

0 commit comments

Comments
 (0)