github.com/yogeshkumararora/slsa-github-generator@v1.10.1-0.20240520161934-11278bd5afb4/signing/sigstore/fulcio.go (about) 1 // Copyright 2022 SLSA Authors 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // https://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 package sigstore 16 17 import ( 18 "bytes" 19 "context" 20 "encoding/json" 21 "fmt" 22 23 "github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio" 24 "github.com/sigstore/cosign/v2/cmd/cosign/cli/options" 25 "github.com/sigstore/cosign/v2/cmd/cosign/cli/sign" 26 "github.com/sigstore/cosign/v2/pkg/providers" 27 "github.com/sigstore/sigstore/pkg/signature/dsse" 28 "github.com/yogeshkumararora/slsa-github-generator/signing" 29 "github.com/yogeshkumararora/slsa-github-generator/signing/envelope" 30 31 intoto "github.com/in-toto/in-toto-golang/in_toto" 32 ) 33 34 const ( 35 defaultFulcioAddr = options.DefaultFulcioURL 36 defaultOIDCIssuer = options.DefaultOIDCIssuerURL 37 defaultOIDCClientID = "sigstore" 38 ) 39 40 // Fulcio is used to sign provenance statements using Fulcio. 41 type Fulcio struct { 42 fulcioAddr string 43 oidcIssuer string 44 oidcClientID string 45 } 46 47 // attestation is a signed attestation. 48 type attestation struct { 49 cert []byte 50 att []byte 51 } 52 53 // Bytes returns the signed attestation as an encoded DSSE JSON envelope. 54 func (a *attestation) Bytes() []byte { 55 return a.att 56 } 57 58 // Cert returns the certificate used to sign the attestation. 59 func (a *attestation) Cert() []byte { 60 return a.cert 61 } 62 63 // NewDefaultFulcio creates a new Fulcio instance using the public Fulcio 64 // server and public sigstore OIDC issuer. 65 func NewDefaultFulcio() *Fulcio { 66 return NewFulcio(defaultFulcioAddr, defaultOIDCIssuer, defaultOIDCClientID) 67 } 68 69 // NewFulcio creates a new Fulcio instance. 70 func NewFulcio(fulcioAddr, oidcIssuer, oidcClientID string) *Fulcio { 71 return &Fulcio{ 72 fulcioAddr: fulcioAddr, 73 oidcIssuer: oidcIssuer, 74 oidcClientID: oidcClientID, 75 } 76 } 77 78 func (s *Fulcio) newSigner(ctx context.Context) (*fulcio.Signer, error) { 79 ko := options.KeyOpts{ 80 OIDCIssuer: s.oidcIssuer, 81 OIDCClientID: s.oidcClientID, 82 FulcioURL: s.fulcioAddr, 83 } 84 85 sv, err := sign.SignerFromKeyOpts(ctx, "", "", ko) 86 if err != nil { 87 return nil, fmt.Errorf("getting signer: %w", err) 88 } 89 90 return fulcio.NewSigner(ctx, ko, sv) 91 } 92 93 // Sign signs the given provenance statement and returns the signed 94 // attestation. 95 func (s *Fulcio) Sign(ctx context.Context, p *intoto.Statement) (signing.Attestation, error) { 96 // Get Fulcio signer 97 if !providers.Enabled(ctx) { 98 return nil, fmt.Errorf("no auth provider is enabled. Are you running outside of Github Actions?") 99 } 100 101 attBytes, err := json.Marshal(p) 102 if err != nil { 103 return nil, fmt.Errorf("marshalling json: %w", err) 104 } 105 106 k, err := s.newSigner(ctx) 107 if err != nil { 108 return nil, fmt.Errorf("creating signer: %w", err) 109 } 110 111 signer := dsse.WrapSigner(k, intoto.PayloadType) 112 signedAtt, err := signer.SignMessage(bytes.NewReader(attBytes)) 113 if err != nil { 114 return nil, fmt.Errorf("signing message: %w", err) 115 } 116 117 // Add certificate to envelope. 118 // TODO: Remove when DSSE spec includes a cert field inside the signatures. 119 signedAttWithCert, err := envelope.AddCertToEnvelope(signedAtt, k.Cert) 120 if err != nil { 121 return nil, fmt.Errorf("adding certificate to DSSE: %w", err) 122 } 123 124 return &attestation{ 125 att: signedAttWithCert, 126 cert: k.Cert, 127 }, nil 128 }