github.com/yogeshkumararora/slsa-github-generator@v1.10.1-0.20240520161934-11278bd5afb4/signing/sigstore/fulcio.go (about)

     1  // Copyright 2022 SLSA Authors
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     https://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package sigstore
    16  
    17  import (
    18  	"bytes"
    19  	"context"
    20  	"encoding/json"
    21  	"fmt"
    22  
    23  	"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
    24  	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
    25  	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
    26  	"github.com/sigstore/cosign/v2/pkg/providers"
    27  	"github.com/sigstore/sigstore/pkg/signature/dsse"
    28  	"github.com/yogeshkumararora/slsa-github-generator/signing"
    29  	"github.com/yogeshkumararora/slsa-github-generator/signing/envelope"
    30  
    31  	intoto "github.com/in-toto/in-toto-golang/in_toto"
    32  )
    33  
    34  const (
    35  	defaultFulcioAddr   = options.DefaultFulcioURL
    36  	defaultOIDCIssuer   = options.DefaultOIDCIssuerURL
    37  	defaultOIDCClientID = "sigstore"
    38  )
    39  
    40  // Fulcio is used to sign provenance statements using Fulcio.
    41  type Fulcio struct {
    42  	fulcioAddr   string
    43  	oidcIssuer   string
    44  	oidcClientID string
    45  }
    46  
    47  // attestation is a signed attestation.
    48  type attestation struct {
    49  	cert []byte
    50  	att  []byte
    51  }
    52  
    53  // Bytes returns the signed attestation as an encoded DSSE JSON envelope.
    54  func (a *attestation) Bytes() []byte {
    55  	return a.att
    56  }
    57  
    58  // Cert returns the certificate used to sign the attestation.
    59  func (a *attestation) Cert() []byte {
    60  	return a.cert
    61  }
    62  
    63  // NewDefaultFulcio creates a new Fulcio instance using the public Fulcio
    64  // server and public sigstore OIDC issuer.
    65  func NewDefaultFulcio() *Fulcio {
    66  	return NewFulcio(defaultFulcioAddr, defaultOIDCIssuer, defaultOIDCClientID)
    67  }
    68  
    69  // NewFulcio creates a new Fulcio instance.
    70  func NewFulcio(fulcioAddr, oidcIssuer, oidcClientID string) *Fulcio {
    71  	return &Fulcio{
    72  		fulcioAddr:   fulcioAddr,
    73  		oidcIssuer:   oidcIssuer,
    74  		oidcClientID: oidcClientID,
    75  	}
    76  }
    77  
    78  func (s *Fulcio) newSigner(ctx context.Context) (*fulcio.Signer, error) {
    79  	ko := options.KeyOpts{
    80  		OIDCIssuer:   s.oidcIssuer,
    81  		OIDCClientID: s.oidcClientID,
    82  		FulcioURL:    s.fulcioAddr,
    83  	}
    84  
    85  	sv, err := sign.SignerFromKeyOpts(ctx, "", "", ko)
    86  	if err != nil {
    87  		return nil, fmt.Errorf("getting signer: %w", err)
    88  	}
    89  
    90  	return fulcio.NewSigner(ctx, ko, sv)
    91  }
    92  
    93  // Sign signs the given provenance statement and returns the signed
    94  // attestation.
    95  func (s *Fulcio) Sign(ctx context.Context, p *intoto.Statement) (signing.Attestation, error) {
    96  	// Get Fulcio signer
    97  	if !providers.Enabled(ctx) {
    98  		return nil, fmt.Errorf("no auth provider is enabled. Are you running outside of Github Actions?")
    99  	}
   100  
   101  	attBytes, err := json.Marshal(p)
   102  	if err != nil {
   103  		return nil, fmt.Errorf("marshalling json: %w", err)
   104  	}
   105  
   106  	k, err := s.newSigner(ctx)
   107  	if err != nil {
   108  		return nil, fmt.Errorf("creating signer: %w", err)
   109  	}
   110  
   111  	signer := dsse.WrapSigner(k, intoto.PayloadType)
   112  	signedAtt, err := signer.SignMessage(bytes.NewReader(attBytes))
   113  	if err != nil {
   114  		return nil, fmt.Errorf("signing message: %w", err)
   115  	}
   116  
   117  	// Add certificate to envelope.
   118  	// TODO: Remove when DSSE spec includes a cert field inside the signatures.
   119  	signedAttWithCert, err := envelope.AddCertToEnvelope(signedAtt, k.Cert)
   120  	if err != nil {
   121  		return nil, fmt.Errorf("adding certificate to DSSE: %w", err)
   122  	}
   123  
   124  	return &attestation{
   125  		att:  signedAttWithCert,
   126  		cert: k.Cert,
   127  	}, nil
   128  }