Skip to content

Commit f740aab

Browse files
cmurphycmurphy
committed
Deduplicate trusted material setting
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
1 parent 6028298 commit f740aab

File tree

5 files changed

+40
-68
lines changed

5 files changed

+40
-68
lines changed

‎cmd/cosign/cli/verify/common.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,15 @@ import (
2020
"fmt"
2121
"reflect"
2222

23+
"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
2324
"github.com/sigstore/cosign/v3/cmd/cosign/cli/rekor"
25+
"github.com/sigstore/cosign/v3/internal/ui"
2426
"github.com/sigstore/cosign/v3/pkg/cosign"
27+
"github.com/sigstore/cosign/v3/pkg/cosign/env"
2528
"github.com/sigstore/cosign/v3/pkg/cosign/pivkey"
2629
"github.com/sigstore/cosign/v3/pkg/cosign/pkcs11key"
2730
csignature "github.com/sigstore/cosign/v3/pkg/signature"
31+
"github.com/sigstore/sigstore-go/pkg/root"
2832
"github.com/sigstore/sigstore/pkg/signature"
2933
)
3034

@@ -154,3 +158,27 @@ func SetLegacyClientsAndKeys(ctx context.Context, ignoreTlog, shouldVerifySCT, k
154158
}
155159
return nil
156160
}
161+
162+
// SetTrustedMaterial sets TrustedMaterial on CheckOpts, either from the provided trusted root path or from TUF.
163+
// It does not set TrustedMaterial if the user provided trusted material via other flags or environment variables.
164+
func SetTrustedMaterial(ctx context.Context, trustedRootPath, certChain, caRoots, caIntermediates, tsaCertChainPath string, co *cosign.CheckOpts) error {
165+
var err error
166+
if trustedRootPath != "" {
167+
co.TrustedMaterial, err = root.NewTrustedRootFromPath(trustedRootPath)
168+
if err != nil {
169+
return fmt.Errorf("loading trusted root: %w", err)
170+
}
171+
return nil
172+
}
173+
if options.NOf(certChain, caRoots, caIntermediates, tsaCertChainPath) == 0 &&
174+
env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "" &&
175+
env.Getenv(env.VariableSigstoreRootFile) == "" &&
176+
env.Getenv(env.VariableSigstoreRekorPublicKey) == "" &&
177+
env.Getenv(env.VariableSigstoreTSACertificateFile) == "" {
178+
co.TrustedMaterial, err = cosign.TrustedRoot()
179+
if err != nil {
180+
ui.Warnf(ctx, "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
181+
}
182+
}
183+
return nil
184+
}

‎cmd/cosign/cli/verify/verify.go‎

Lines changed: 3 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,10 @@ import (
3737
"github.com/sigstore/cosign/v3/internal/ui"
3838
"github.com/sigstore/cosign/v3/pkg/blob"
3939
"github.com/sigstore/cosign/v3/pkg/cosign"
40-
"github.com/sigstore/cosign/v3/pkg/cosign/env"
4140
"github.com/sigstore/cosign/v3/pkg/oci"
4241
"github.com/sigstore/cosign/v3/pkg/oci/static"
4342
sigs "github.com/sigstore/cosign/v3/pkg/signature"
4443
"github.com/sigstore/protobuf-specs/gen/pb-go/dsse"
45-
"github.com/sigstore/sigstore-go/pkg/root"
4644
"github.com/sigstore/sigstore/pkg/cryptoutils"
4745
"github.com/sigstore/sigstore/pkg/signature/payload"
4846
)
@@ -151,21 +149,9 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) {
151149
}
152150
}
153151

154-
if c.TrustedRootPath != "" {
155-
co.TrustedMaterial, err = root.NewTrustedRootFromPath(c.TrustedRootPath)
156-
if err != nil {
157-
return fmt.Errorf("loading trusted root: %w", err)
158-
}
159-
} else if options.NOf(c.CertChain, c.CARoots, c.CAIntermediates, c.TSACertChainPath) == 0 &&
160-
env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "" &&
161-
env.Getenv(env.VariableSigstoreRootFile) == "" &&
162-
env.Getenv(env.VariableSigstoreRekorPublicKey) == "" &&
163-
env.Getenv(env.VariableSigstoreTSACertificateFile) == "" {
164-
// don't overrule the user's intentions if they provided their own keys
165-
co.TrustedMaterial, err = cosign.TrustedRoot()
166-
if err != nil {
167-
ui.Warnf(ctx, "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
168-
}
152+
err = SetTrustedMaterial(ctx, c.TrustedRootPath, c.CertChain, c.CARoots, c.CAIntermediates, c.TSACertChainPath, co)
153+
if err != nil {
154+
return fmt.Errorf("setting trusted material: %w", err)
169155
}
170156

171157
if err = CheckSigstoreBundleUnsupportedOptions(*c, co); err != nil {

‎cmd/cosign/cli/verify/verify_attestation.go‎

Lines changed: 3 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,9 @@ import (
3030
"github.com/sigstore/cosign/v3/internal/ui"
3131
"github.com/sigstore/cosign/v3/pkg/cosign"
3232
"github.com/sigstore/cosign/v3/pkg/cosign/cue"
33-
"github.com/sigstore/cosign/v3/pkg/cosign/env"
3433
"github.com/sigstore/cosign/v3/pkg/cosign/rego"
3534
"github.com/sigstore/cosign/v3/pkg/oci"
3635
"github.com/sigstore/cosign/v3/pkg/policy"
37-
"github.com/sigstore/sigstore-go/pkg/root"
3836
)
3937

4038
// VerifyAttestationCommand verifies a signature on a supplied container image
@@ -132,23 +130,9 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e
132130
co.ClaimVerifier = cosign.IntotoSubjectClaimVerifier
133131
}
134132

135-
if c.TrustedRootPath != "" {
136-
if !co.NewBundleFormat {
137-
return fmt.Errorf("unsupported: trusted root path currently only supported with --new-bundle-format")
138-
}
139-
co.TrustedMaterial, err = root.NewTrustedRootFromPath(c.TrustedRootPath)
140-
if err != nil {
141-
return fmt.Errorf("loading trusted root: %w", err)
142-
}
143-
} else if options.NOf(c.CertChain, c.CARoots, c.CAIntermediates, c.TSACertChainPath) == 0 &&
144-
env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "" &&
145-
env.Getenv(env.VariableSigstoreRootFile) == "" &&
146-
env.Getenv(env.VariableSigstoreRekorPublicKey) == "" &&
147-
env.Getenv(env.VariableSigstoreTSACertificateFile) == "" {
148-
co.TrustedMaterial, err = cosign.TrustedRoot()
149-
if err != nil {
150-
ui.Warnf(ctx, "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
151-
}
133+
err = SetTrustedMaterial(ctx, c.TrustedRootPath, c.CertChain, c.CARoots, c.CAIntermediates, c.TSACertChainPath, co)
134+
if err != nil {
135+
return fmt.Errorf("setting trusted material: %w", err)
152136
}
153137

154138
if err = CheckSigstoreBundleUnsupportedOptions(*c, co); err != nil {

‎cmd/cosign/cli/verify/verify_blob.go‎

Lines changed: 3 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,9 @@ import (
3636
"github.com/sigstore/cosign/v3/pkg/blob"
3737
"github.com/sigstore/cosign/v3/pkg/cosign"
3838
"github.com/sigstore/cosign/v3/pkg/cosign/bundle"
39-
"github.com/sigstore/cosign/v3/pkg/cosign/env"
4039
"github.com/sigstore/cosign/v3/pkg/oci/static"
4140
sigs "github.com/sigstore/cosign/v3/pkg/signature"
4241
sgbundle "github.com/sigstore/sigstore-go/pkg/bundle"
43-
"github.com/sigstore/sigstore-go/pkg/root"
4442
sgverify "github.com/sigstore/sigstore-go/pkg/verify"
4543

4644
"github.com/sigstore/sigstore/pkg/cryptoutils"
@@ -123,20 +121,9 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
123121
}
124122
defer closeSV()
125123

126-
if c.TrustedRootPath != "" {
127-
co.TrustedMaterial, err = root.NewTrustedRootFromPath(c.TrustedRootPath)
128-
if err != nil {
129-
return fmt.Errorf("loading trusted root: %w", err)
130-
}
131-
} else if options.NOf(c.CertChain, c.CARoots, c.CAIntermediates, c.TSACertChainPath) == 0 &&
132-
env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "" &&
133-
env.Getenv(env.VariableSigstoreRootFile) == "" &&
134-
env.Getenv(env.VariableSigstoreRekorPublicKey) == "" &&
135-
env.Getenv(env.VariableSigstoreTSACertificateFile) == "" {
136-
co.TrustedMaterial, err = cosign.TrustedRoot()
137-
if err != nil {
138-
ui.Warnf(ctx, "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
139-
}
124+
err = SetTrustedMaterial(ctx, c.TrustedRootPath, c.CertChain, c.CARoots, c.CAIntermediates, c.TSACertChainPath, co)
125+
if err != nil {
126+
return fmt.Errorf("setting trusted material: %w", err)
140127
}
141128

142129
if err = CheckSigstoreBundleUnsupportedOptions(*c, co); err != nil {

‎cmd/cosign/cli/verify/verify_blob_attestation.go‎

Lines changed: 3 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,10 @@ import (
3636
"github.com/sigstore/cosign/v3/pkg/blob"
3737
"github.com/sigstore/cosign/v3/pkg/cosign"
3838
"github.com/sigstore/cosign/v3/pkg/cosign/bundle"
39-
"github.com/sigstore/cosign/v3/pkg/cosign/env"
4039
"github.com/sigstore/cosign/v3/pkg/oci/static"
4140
"github.com/sigstore/cosign/v3/pkg/policy"
4241
sigs "github.com/sigstore/cosign/v3/pkg/signature"
4342
sgbundle "github.com/sigstore/sigstore-go/pkg/bundle"
44-
"github.com/sigstore/sigstore-go/pkg/root"
4543
sgverify "github.com/sigstore/sigstore-go/pkg/verify"
4644
"github.com/sigstore/sigstore/pkg/cryptoutils"
4745
)
@@ -178,20 +176,9 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st
178176
co.ClaimVerifier = cosign.IntotoSubjectClaimVerifier
179177
}
180178

181-
if c.TrustedRootPath != "" {
182-
co.TrustedMaterial, err = root.NewTrustedRootFromPath(c.TrustedRootPath)
183-
if err != nil {
184-
return fmt.Errorf("loading trusted root: %w", err)
185-
}
186-
} else if options.NOf(c.CertChain, c.CARoots, c.CAIntermediates, c.TSACertChainPath) == 0 &&
187-
env.Getenv(env.VariableSigstoreCTLogPublicKeyFile) == "" &&
188-
env.Getenv(env.VariableSigstoreRootFile) == "" &&
189-
env.Getenv(env.VariableSigstoreRekorPublicKey) == "" &&
190-
env.Getenv(env.VariableSigstoreTSACertificateFile) == "" {
191-
co.TrustedMaterial, err = cosign.TrustedRoot()
192-
if err != nil {
193-
ui.Warnf(ctx, "Could not fetch trusted_root.json from the TUF repository. Continuing with individual targets. Error from TUF: %v", err)
194-
}
179+
err = SetTrustedMaterial(ctx, c.TrustedRootPath, c.CertChain, c.CARoots, c.CAIntermediates, c.TSACertChainPath, co)
180+
if err != nil {
181+
return fmt.Errorf("setting trusted material: %w", err)
195182
}
196183

197184
if err = CheckSigstoreBundleUnsupportedOptions(*c, co); err != nil {

0 commit comments

Comments
 (0)