Skip to content

Commit 95dff84

Browse files
ret2libcret2libc
committed
Used LoadSignerVerifierWithOpts for more flexibility
* Use ED25519ph algorithm with sign/verify-blob commands Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>
1 parent 76c1162 commit 95dff84

File tree

12 files changed

+224
-96
lines changed

12 files changed

+224
-96
lines changed

‎cmd/cosign/cli/sign/sign.go‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -391,8 +391,8 @@ func signerFromSecurityKey(ctx context.Context, keySlot string) (*SignerVerifier
391391
}, nil
392392
}
393393

394-
func signerFromKeyRef(ctx context.Context, certPath, certChainPath, keyRef string, passFunc cosign.PassFunc) (*SignerVerifier, error) {
395-
k, err := sigs.SignerVerifierFromKeyRef(ctx, keyRef, passFunc)
394+
func signerFromKeyRef(ctx context.Context, certPath, certChainPath, keyRef string, passFunc cosign.PassFunc, opts ...signature.SignerVerifierOption) (*SignerVerifier, error) {
395+
k, err := sigs.SignerVerifierFromKeyRefWithOpts(ctx, keyRef, passFunc, opts...)
396396
if err != nil {
397397
return nil, fmt.Errorf("reading key: %w", err)
398398
}
@@ -559,15 +559,15 @@ func keylessSigner(ctx context.Context, ko options.KeyOpts, sv *SignerVerifier)
559559
}, nil
560560
}
561561

562-
func SignerFromKeyOpts(ctx context.Context, certPath string, certChainPath string, ko options.KeyOpts) (*SignerVerifier, error) {
562+
func signerFromKeyOptsWithSVOpts(ctx context.Context, certPath string, certChainPath string, ko options.KeyOpts, svOpts ...signature.SignerVerifierOption) (*SignerVerifier, error) {
563563
var sv *SignerVerifier
564564
var err error
565565
genKey := false
566566
switch {
567567
case ko.Sk:
568568
sv, err = signerFromSecurityKey(ctx, ko.Slot)
569569
case ko.KeyRef != "":
570-
sv, err = signerFromKeyRef(ctx, certPath, certChainPath, ko.KeyRef, ko.PassFunc)
570+
sv, err = signerFromKeyRef(ctx, certPath, certChainPath, ko.KeyRef, ko.PassFunc, svOpts...)
571571
default:
572572
genKey = true
573573
ui.Infof(ctx, "Generating ephemeral keys...")
@@ -584,6 +584,10 @@ func SignerFromKeyOpts(ctx context.Context, certPath string, certChainPath strin
584584
return sv, nil
585585
}
586586

587+
func SignerFromKeyOpts(ctx context.Context, certPath string, certChainPath string, ko options.KeyOpts) (*SignerVerifier, error) {
588+
return signerFromKeyOptsWithSVOpts(ctx, certPath, certChainPath, ko)
589+
}
590+
587591
type SignerVerifier struct {
588592
Cert []byte
589593
Chain []byte

‎cmd/cosign/cli/sign/sign_blob.go‎

Lines changed: 37 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,10 @@ package sign
1717

1818
import (
1919
"context"
20-
"crypto/sha256"
20+
"crypto"
21+
"crypto/ecdsa"
22+
"crypto/ed25519"
23+
"crypto/rsa"
2124
"encoding/base64"
2225
"encoding/json"
2326
"fmt"
@@ -33,9 +36,28 @@ import (
3336
"github.com/sigstore/cosign/v2/pkg/cosign"
3437
cbundle "github.com/sigstore/cosign/v2/pkg/cosign/bundle"
3538
"github.com/sigstore/sigstore/pkg/cryptoutils"
39+
"github.com/sigstore/sigstore/pkg/signature"
3640
signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
3741
)
3842

43+
func getHashAlgorithmFromSignerVerifier(sv *SignerVerifier) (crypto.Hash, error) {
44+
publicKey, err := sv.SignerVerifier.PublicKey()
45+
if err != nil {
46+
return crypto.Hash(0), err
47+
}
48+
49+
switch publicKey.(type) {
50+
case *ecdsa.PublicKey:
51+
return crypto.SHA256, nil
52+
case *rsa.PublicKey:
53+
return crypto.SHA256, nil
54+
case ed25519.PublicKey:
55+
return crypto.SHA512, nil
56+
default:
57+
return crypto.Hash(0), fmt.Errorf("unsupported public key type")
58+
}
59+
}
60+
3961
// nolint
4062
func SignBlobCmd(ro *options.RootOptions, ko options.KeyOpts, payloadPath string, b64 bool, outputSignature string, outputCertificate string, tlogUpload bool) ([]byte, error) {
4163
var payload internal.HashReader
@@ -44,26 +66,31 @@ func SignBlobCmd(ro *options.RootOptions, ko options.KeyOpts, payloadPath string
4466
ctx, cancel := context.WithTimeout(context.Background(), ro.Timeout)
4567
defer cancel()
4668

69+
sv, err := signerFromKeyOptsWithSVOpts(ctx, "", "", ko, signature.WithED25519ph())
70+
if err != nil {
71+
return nil, err
72+
}
73+
defer sv.Close()
74+
75+
hashAlgorithm, err := getHashAlgorithmFromSignerVerifier(sv)
76+
if err != nil {
77+
return nil, err
78+
}
79+
4780
if payloadPath == "-" {
48-
payload = internal.NewHashReader(os.Stdin, sha256.New())
81+
payload = internal.NewHashReader(os.Stdin, hashAlgorithm)
4982
} else {
5083
ui.Infof(ctx, "Using payload from: %s", payloadPath)
5184
f, err := os.Open(filepath.Clean(payloadPath))
5285
if err != nil {
5386
return nil, err
5487
}
55-
payload = internal.NewHashReader(f, sha256.New())
88+
payload = internal.NewHashReader(f, hashAlgorithm)
5689
}
5790
if err != nil {
5891
return nil, err
5992
}
6093

61-
sv, err := SignerFromKeyOpts(ctx, "", "", ko)
62-
if err != nil {
63-
return nil, err
64-
}
65-
defer sv.Close()
66-
6794
sig, err := sv.SignMessage(&payload, signatureoptions.WithContext(ctx))
6895
if err != nil {
6996
return nil, fmt.Errorf("signing blob: %w", err)
@@ -123,7 +150,7 @@ func SignBlobCmd(ro *options.RootOptions, ko options.KeyOpts, payloadPath string
123150
if err != nil {
124151
return nil, err
125152
}
126-
entry, err := cosign.TLogUpload(ctx, rekorClient, sig, &payload, rekorBytes)
153+
entry, err := cosign.TLogUploadWithCustomHash(ctx, rekorClient, sig, &payload, rekorBytes)
127154
if err != nil {
128155
return nil, err
129156
}

‎cmd/cosign/cli/verify/verify_blob.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ import (
4141
sigs "github.com/sigstore/cosign/v2/pkg/signature"
4242

4343
"github.com/sigstore/sigstore/pkg/cryptoutils"
44+
"github.com/sigstore/sigstore/pkg/signature"
4445
)
4546

4647
func isb64(data []byte) bool {
@@ -173,7 +174,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
173174
// Keys are optional!
174175
switch {
175176
case c.KeyRef != "":
176-
co.SigVerifier, err = sigs.PublicKeyFromKeyRef(ctx, c.KeyRef)
177+
co.SigVerifier, err = sigs.PublicKeyFromKeyRefWithOpts(ctx, c.KeyRef, crypto.SHA256, signature.WithED25519ph())
177178
if err != nil {
178179
return fmt.Errorf("loading public key: %w", err)
179180
}
@@ -218,7 +219,7 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
218219
bundleCert, err := loadCertFromPEM(certBytes)
219220
if err != nil {
220221
// check if cert is actually a public key
221-
co.SigVerifier, err = sigs.LoadPublicKeyRaw(certBytes, crypto.SHA256)
222+
co.SigVerifier, err = sigs.LoadPublicKeyRawWithOpts(certBytes, crypto.SHA256, signature.WithED25519ph())
222223
if err != nil {
223224
return fmt.Errorf("loading verifier from bundle: %w", err)
224225
}

‎cmd/cosign/cli/verify/verify_blob_attestation.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ package verify
1818
import (
1919
"context"
2020
"crypto"
21-
"crypto/sha256"
2221
"crypto/x509"
2322
"encoding/base64"
2423
"encoding/hex"
@@ -118,7 +117,7 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
118117
}
119118
defer f.Close()
120119

121-
payload = internal.NewHashReader(f, sha256.New())
120+
payload = internal.NewHashReader(f, crypto.SHA256)
122121
if _, err := io.ReadAll(&payload); err != nil {
123122
return err
124123
}

‎go.mod‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -145,19 +145,19 @@ require (
145145
github.com/go-chi/chi v4.1.2+incompatible // indirect
146146
github.com/go-ini/ini v1.67.0 // indirect
147147
github.com/go-jose/go-jose/v3 v3.0.1 // indirect
148-
github.com/go-logr/logr v1.3.0 // indirect
148+
github.com/go-logr/logr v1.4.1 // indirect
149149
github.com/go-logr/stdr v1.2.2 // indirect
150150
github.com/go-openapi/analysis v0.22.0 // indirect
151151
github.com/go-openapi/errors v0.21.0 // indirect
152152
github.com/go-openapi/jsonpointer v0.20.2 // indirect
153153
github.com/go-openapi/jsonreference v0.20.4 // indirect
154154
github.com/go-openapi/loads v0.21.5 // indirect
155-
github.com/go-openapi/spec v0.20.13 // indirect
156-
github.com/go-openapi/validate v0.22.3 // indirect
155+
github.com/go-openapi/spec v0.20.14 // indirect
156+
github.com/go-openapi/validate v0.22.6 // indirect
157157
github.com/gobwas/glob v0.2.3 // indirect
158158
github.com/gogo/protobuf v1.3.2 // indirect
159159
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
160-
github.com/golang-jwt/jwt/v5 v5.0.0 // indirect
160+
github.com/golang-jwt/jwt/v5 v5.1.0 // indirect
161161
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
162162
github.com/golang/protobuf v1.5.3 // indirect
163163
github.com/golang/snappy v0.0.4 // indirect
@@ -261,7 +261,7 @@ require (
261261
golang.org/x/tools v0.15.0 // indirect
262262
google.golang.org/appengine v1.6.8 // indirect
263263
google.golang.org/genproto v0.0.0-20231212172506-995d672761c0 // indirect
264-
google.golang.org/genproto/googleapis/api v0.0.0-20231212172506-995d672761c0 // indirect
264+
google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 // indirect
265265
google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 // indirect
266266
google.golang.org/grpc v1.60.1 // indirect
267267
google.golang.org/protobuf v1.32.0 // indirect
@@ -270,9 +270,13 @@ require (
270270
gopkg.in/ini.v1 v1.67.0 // indirect
271271
gopkg.in/yaml.v2 v2.4.0 // indirect
272272
gopkg.in/yaml.v3 v3.0.1 // indirect
273-
k8s.io/klog/v2 v2.100.1 // indirect
273+
k8s.io/klog/v2 v2.120.0 // indirect
274274
k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
275275
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
276276
sigs.k8s.io/structured-merge-diff/v4 v4.3.0 // indirect
277277
sigs.k8s.io/yaml v1.4.0 // indirect
278278
)
279+
280+
replace github.com/sigstore/sigstore => github.com/trail-of-forks/sigstore v0.0.0-20240117103256-3095d93bafe8
281+
282+
replace github.com/sigstore/rekor => github.com/trail-of-forks/rekor v0.0.0-20240117141752-51caf324f906

‎go.sum‎

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ cuelang.org/go v0.7.0 h1:gMztinxuKfJwMIxtboFsNc6s8AxwJGgsJV+3CuLffHI=
1515
cuelang.org/go v0.7.0/go.mod h1:ix+3dM/bSpdG9xg6qpCgnJnpeLtciZu+O/rDbywoMII=
1616
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
1717
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
18-
github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230618160516-e936619f9f18 h1:rd389Q26LMy03gG4anandGFC2LW/xvjga5GezeeaxQk=
19-
github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230618160516-e936619f9f18/go.mod h1:fgJuSBrJP5qZtKqaMJE0hmhS2tmRH+44IkfZvjtaf1M=
18+
github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg=
19+
github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM=
2020
github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 h1:8+4G8JaejP8Xa6W46PzJEwisNgBXMvFcz78N6zG/ARw=
2121
github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0/go.mod h1:GgeIE+1be8Ivm7Sh4RgwI42aTtC9qrcj+Y9Y6CjJhJs=
2222
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
@@ -285,10 +285,9 @@ github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
285285
github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
286286
github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
287287
github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
288-
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
289288
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
290-
github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
291-
github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
289+
github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
290+
github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
292291
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
293292
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
294293
github.com/go-openapi/analysis v0.22.0 h1:wQ/d07nf78HNj4u+KiSY0sT234IAyePPbMgpUjUJQR0=
@@ -303,14 +302,14 @@ github.com/go-openapi/loads v0.21.5 h1:jDzF4dSoHw6ZFADCGltDb2lE4F6De7aWSpe+IcsRz
303302
github.com/go-openapi/loads v0.21.5/go.mod h1:PxTsnFBoBe+z89riT+wYt3prmSBP6GDAQh2l9H1Flz8=
304303
github.com/go-openapi/runtime v0.26.2 h1:elWyB9MacRzvIVgAZCBJmqTi7hBzU0hlKD4IvfX0Zl0=
305304
github.com/go-openapi/runtime v0.26.2/go.mod h1:O034jyRZ557uJKzngbMDJXkcKJVzXJiymdSfgejrcRw=
306-
github.com/go-openapi/spec v0.20.13 h1:XJDIN+dLH6vqXgafnl5SUIMnzaChQ6QTo0/UPMbkIaE=
307-
github.com/go-openapi/spec v0.20.13/go.mod h1:8EOhTpBoFiask8rrgwbLC3zmJfz4zsCUueRuPM6GNkw=
305+
github.com/go-openapi/spec v0.20.14 h1:7CBlRnw+mtjFGlPDRZmAMnq35cRzI91xj03HVyUi/Do=
306+
github.com/go-openapi/spec v0.20.14/go.mod h1:8EOhTpBoFiask8rrgwbLC3zmJfz4zsCUueRuPM6GNkw=
308307
github.com/go-openapi/strfmt v0.22.0 h1:Ew9PnEYc246TwrEspvBdDHS4BVKXy/AOVsfqGDgAcaI=
309308
github.com/go-openapi/strfmt v0.22.0/go.mod h1:HzJ9kokGIju3/K6ap8jL+OlGAbjpSv27135Yr9OivU4=
310309
github.com/go-openapi/swag v0.22.7 h1:JWrc1uc/P9cSomxfnsFSVWoE1FW6bNbrVPmpQYpCcR8=
311310
github.com/go-openapi/swag v0.22.7/go.mod h1:Gl91UqO+btAM0plGGxHqJcQZ1ZTy6jbmridBTsDy8A0=
312-
github.com/go-openapi/validate v0.22.3 h1:KxG9mu5HBRYbecRb37KRCihvGGtND2aXziBAv0NNfyI=
313-
github.com/go-openapi/validate v0.22.3/go.mod h1:kVxh31KbfsxU8ZyoHaDbLBWU5CnMdqBUEtadQ2G4d5M=
311+
github.com/go-openapi/validate v0.22.6 h1:+NhuwcEYpWdO5Nm4bmvhGLW0rt1Fcc532Mu3wpypXfo=
312+
github.com/go-openapi/validate v0.22.6/go.mod h1:eaddXSqKeTg5XpSmj1dYyFTK/95n/XHwcOY+BMxKMyM=
314313
github.com/go-piv/piv-go v1.11.0 h1:5vAaCdRTFSIW4PeqMbnsDlUZ7odMYWnHBDGdmtU/Zhg=
315314
github.com/go-piv/piv-go v1.11.0/go.mod h1:NZ2zmjVkfFaL/CF8cVQ/pXdXtuj110zEKGdJM6fJZZM=
316315
github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
@@ -332,8 +331,8 @@ github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzw
332331
github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
333332
github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
334333
github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
335-
github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE=
336-
github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
334+
github.com/golang-jwt/jwt/v5 v5.1.0 h1:UGKbA/IPjtS6zLcdB7i5TyACMgSbOTiR8qzXgw8HWQU=
335+
github.com/golang-jwt/jwt/v5 v5.1.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
337336
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
338337
github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
339338
github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
@@ -393,8 +392,8 @@ github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
393392
github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
394393
github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
395394
github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
396-
github.com/google/trillian v1.5.3 h1:3ioA5p09qz+U9/t2riklZtaQdZclaStp0/eQNfewNRg=
397-
github.com/google/trillian v1.5.3/go.mod h1:p4tcg7eBr7aT6DxrAoILpc3uXNfcuAvZSnQKonVg+Eo=
395+
github.com/google/trillian v1.6.0 h1:jMBeDBIkINFvS2n6oV5maDqfRlxREAc6CW9QYWQ0qT4=
396+
github.com/google/trillian v1.6.0/go.mod h1:Yu3nIMITzNhhMJEHjAtp6xKiu+H/iHu2Oq5FjV2mCWI=
398397
github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
399398
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
400399
github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
@@ -609,10 +608,6 @@ github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh
609608
github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
610609
github.com/sigstore/fulcio v1.4.3 h1:9JcUCZjjVhRF9fmhVuz6i1RyhCc/EGCD7MOl+iqCJLQ=
611610
github.com/sigstore/fulcio v1.4.3/go.mod h1:BQPWo7cfxmJwgaHlphUHUpFkp5+YxeJes82oo39m5og=
612-
github.com/sigstore/rekor v1.3.4 h1:RGIia1iOZU7fOiiP2UY/WFYhhp50S5aUm7YrM8aiA6E=
613-
github.com/sigstore/rekor v1.3.4/go.mod h1:1GubPVO2yO+K0m0wt/3SHFqnilr/hWbsjSOe7Vzxrlg=
614-
github.com/sigstore/sigstore v1.8.0 h1:sSRWXv1JiDsK4T2wNWVYcvKCgxcSrhQ/QUJxsfCO4OM=
615-
github.com/sigstore/sigstore v1.8.0/go.mod h1:l12B1gFlLIpBIVeqk/q1Lb+6YSOGNuN3xLExIjYH+qc=
616611
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.0 h1:nLaaOX85YjBKQOQHWY2UlDkbx+je8ozTEM+t1ySAb78=
617612
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.0/go.mod h1:fLxrKqPP9lIz/B3UBD4ZK6j6984eX2czu/0zxm99fkE=
618613
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.0 h1:Txd7Fjei2NVb/sjBNYybrl+FcZGptO6FXXH4pVNBQMs=
@@ -677,6 +672,10 @@ github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHT
677672
github.com/tjfoc/gmsm v1.3.2/go.mod h1:HaUcFuY0auTiaHB9MHFGCPx5IaLhTUd2atbCFBQXn9w=
678673
github.com/tjfoc/gmsm v1.4.1 h1:aMe1GlZb+0bLjn+cKTPEvvn9oUEBlJitaZiiBwsbgho=
679674
github.com/tjfoc/gmsm v1.4.1/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE=
675+
github.com/trail-of-forks/rekor v0.0.0-20240117141752-51caf324f906 h1:xiHDiDcZ3yeBikoG6RZvjkDqwWQnmslPQqvZxueZV3E=
676+
github.com/trail-of-forks/rekor v0.0.0-20240117141752-51caf324f906/go.mod h1:20v68aaBb2C/sUjSluGGhhL+eR8G9+Vd4SLX5F1u/cU=
677+
github.com/trail-of-forks/sigstore v0.0.0-20240117103256-3095d93bafe8 h1:0tnfVIeZPhbzIOmpHJrrOKH4Fb1W1rmIAJsgkwnc2TU=
678+
github.com/trail-of-forks/sigstore v0.0.0-20240117103256-3095d93bafe8/go.mod h1:l12B1gFlLIpBIVeqk/q1Lb+6YSOGNuN3xLExIjYH+qc=
680679
github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
681680
github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
682681
github.com/urfave/negroni v1.0.0 h1:kIimOitoypq34K7TG7DUaJ9kq/N4Ofuwi1sjz0KipXc=
@@ -902,8 +901,8 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
902901
google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
903902
google.golang.org/genproto v0.0.0-20231212172506-995d672761c0 h1:YJ5pD9rF8o9Qtta0Cmy9rdBwkSjrTCT6XTiUQVOtIos=
904903
google.golang.org/genproto v0.0.0-20231212172506-995d672761c0/go.mod h1:l/k7rMz0vFTBPy+tFSGvXEd3z+BcoG1k7EHbqm+YBsY=
905-
google.golang.org/genproto/googleapis/api v0.0.0-20231212172506-995d672761c0 h1:s1w3X6gQxwrLEpxnLd/qXTVLgQE2yXwaOaoa6IlY/+o=
906-
google.golang.org/genproto/googleapis/api v0.0.0-20231212172506-995d672761c0/go.mod h1:CAny0tYF+0/9rmDB9fahA9YLzX3+AEVl1qXbv5hhj6c=
904+
google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 h1:rcS6EyEaoCO52hQDupoSfrxI3R6C2Tq741is7X8OvnM=
905+
google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917/go.mod h1:CmlNWB9lSezaYELKS5Ym1r44VrrbPUa7JTvw+6MbpJ0=
907906
google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 h1:6G8oQ016D88m1xAKljMlBOOGWDZkes4kMhgGFlf8WcQ=
908907
google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917/go.mod h1:xtjpI3tXFPP051KaWnhvxkiubL/6dJ18vLVf7q2pTOU=
909908
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -960,8 +959,8 @@ k8s.io/apimachinery v0.28.3 h1:B1wYx8txOaCQG0HmYF6nbpU8dg6HvA06x5tEffvOe7A=
960959
k8s.io/apimachinery v0.28.3/go.mod h1:uQTKmIqs+rAYaq+DFaoD2X7pcjLOqbQX2AOiO0nIpb8=
961960
k8s.io/client-go v0.28.3 h1:2OqNb72ZuTZPKCl+4gTKvqao0AMOl9f3o2ijbAj3LI4=
962961
k8s.io/client-go v0.28.3/go.mod h1:LTykbBp9gsA7SwqirlCXBWtK0guzfhpoW4qSm7i9dxo=
963-
k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
964-
k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
962+
k8s.io/klog/v2 v2.120.0 h1:z+q5mfovBj1fKFxiRzsa2DsJLPIVMk/KFL81LMOfK+8=
963+
k8s.io/klog/v2 v2.120.0/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
965964
k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
966965
k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
967966
k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=

‎internal/pkg/cosign/common.go‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
package cosign
1616

1717
import (
18+
"crypto"
1819
"errors"
1920
"hash"
2021
"io"
@@ -38,14 +39,17 @@ func FileExists(filename string) (bool, error) {
3839

3940
// HashReader hashes while it reads.
4041
type HashReader struct {
41-
r io.Reader
42-
h hash.Hash
42+
r io.Reader
43+
h hash.Hash
44+
ch crypto.Hash
4345
}
4446

45-
func NewHashReader(r io.Reader, h hash.Hash) HashReader {
47+
func NewHashReader(r io.Reader, ch crypto.Hash) HashReader {
48+
h := ch.New()
4649
return HashReader{
47-
r: io.TeeReader(r, h),
48-
h: h,
50+
r: io.TeeReader(r, h),
51+
h: h,
52+
ch: ch,
4953
}
5054
}
5155

@@ -66,3 +70,6 @@ func (h *HashReader) BlockSize() int { return h.h.BlockSize() }
6670

6771
// Write implements hash.Hash
6872
func (h *HashReader) Write(p []byte) (int, error) { return 0, errors.New("not implemented") } //nolint: revive
73+
74+
// HashFunc implements cosign.NamedHash
75+
func (h *HashReader) HashFunc() crypto.Hash { return h.ch }

‎internal/pkg/cosign/common_test.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ package cosign
1717

1818
import (
1919
"bytes"
20+
"crypto"
2021
"crypto/sha256"
2122
"io"
2223
"os"
@@ -55,7 +56,7 @@ func Test_FileExists(t *testing.T) {
5556

5657
func Test_HashReader(t *testing.T) {
5758
input := []byte("hello world")
58-
r := NewHashReader(bytes.NewReader(input), sha256.New())
59+
r := NewHashReader(bytes.NewReader(input), crypto.SHA256)
5960

6061
got, err := io.ReadAll(&r)
6162
if err != nil {

0 commit comments

Comments
 (0)