sign: init #310

jleightcap · 2023-11-15T22:59:28Z

Summary

Add ability to sign artifacts à la sigstore-python, towards Bundle signing and verification.
Follow-up from #305, and the prerequisite motivation to #311.

Release Note

Expose added bundle and sign modules. No breaking changes to existing modules.

Documentation

src/bundle/mod.rs

src/sign.rs

jleightcap · 2023-11-16T19:22:22Z

src/fulcio/mod.rs

+        // TODO(tnytown): Implement SCT extraction.
+        // see: https://github.com/RustCrypto/formats/pull/1134
+        if sct_embedded {
+            debug!("PrecertificateSignedCertificateTimestamps isn't implemented yet in x509_cert.");
+        } else {
+            // No embedded SCT, Fulcio instance that provides detached SCT:
+            if let SigningCertificate::SignedCertificateDetachedSct(_sct) = response {}
+        };


Detached SCT verification is currently blocked by the linked issue. @tnytown mentioned having the availability to push that issue forward (CC @woodruffw)

Assume you meant embedded SCT verification, since that's the missing branch here 🙂

But yeah, we should get that in; xref RustCrypto/formats#1134

src/fulcio/models.rs

SantiagoTorres

Mostly questions/discussion. looking good!

src/fulcio/mod.rs

src/oauth/mod.rs

src/oauth/token.rs

src/sign.rs

src/fulcio/mod.rs

src/oauth/token.rs

src/fulcio/models.rs

src/sign.rs

src/tuf/repository_helper.rs

src/sign.rs

tnytown

I sketched out a fully async SigningSession. Although it's a bit ugly, it should make the sign crate fully async-safe.

src/sign.rs

woodruffw · 2023-11-29T09:01:00Z

I've done a quick pass on this, and it LGTM overall -- thanks @jleightcap and @tnytown!

@flavio Is there anything else we can or should do here? I see #310 (comment) as one (small) outstanding thing, but there might be others I've missed 🙂

Signed-off-by: Jack Leightcap <jack.leightcap@trailofbits.com> Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com> Co-authored-by: Jack Leightcap <jack.leightcap@trailofbits.com>

Signed-off-by: Jack Leightcap <jack.leightcap@trailofbits.com>

Signed-off-by: Andrew Pan <3821575+tnytown@users.noreply.github.com>

Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com>

Co-authored-by: Flavio Castelli <flavio@castelli.me> Signed-off-by: Andrew Pan <3821575+tnytown@users.noreply.github.com>

Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com>

flavio

This looks good to me, I've left one last minor comment. Once this is addressed we can merge it

src/oauth/token.rs

src/sign.rs

Signed-off-by: Jack Leightcap <jack.leightcap@trailofbits.com>

src/oauth/token.rs

Co-authored-by: Andrew Pan <3821575+tnytown@users.noreply.github.com> Signed-off-by: Jack Leightcap <30168080+jleightcap@users.noreply.github.com>

woodruffw

LGTM! @flavio anything else we can do here?

flavio · 2023-12-21T08:35:06Z

@woodruffw merged! thanks to all the people involved ❤️

@jleightcap

== What's Changed * sign: init by @jleightcap in sigstore#310 * cargo audit: ignore RUSTSEC-2023-0071 by @jleightcap in sigstore#321 * chore(deps): Update json-syntax requirement from 0.9.6 to 0.10.0 by @dependabot in sigstore#319 * chore(deps): Update cached requirement from 0.46.0 to 0.47.0 by @dependabot in sigstore#323 * chore(deps): Update serial_test requirement from 2.0.0 to 3.0.0 by @dependabot in sigstore#322 * dep: update rustls-webpki, fold in pki_types by @jleightcap in sigstore#324 * chore(deps): Update cached requirement from 0.47.0 to 0.48.0 by @dependabot in sigstore#325 * chore(deps): Update json-syntax requirement from 0.10.0 to 0.11.1 by @dependabot in sigstore#327 * chore(deps): Update cached requirement from 0.48.0 to 0.49.2 by @dependabot in sigstore#329 * chore(deps): Update json-syntax requirement from 0.11.1 to 0.12.2 by @dependabot in sigstore#330 * lint: fix lint error of chrono and tokio by @Xynnn007 in sigstore#334 * chore(deps): Update base64 requirement from 0.21.0 to 0.22.0 by @dependabot in sigstore#332 * The `Repository` trait and `ManualRepository` struct no longer require a feature flag by @tannaurus in sigstore#331 * chore(deps): Bump actions/checkout from 4.1.1 to 4.1.2 by @dependabot in sigstore#336 * chore(deps): Update reqwest requirement from 0.11 to 0.12 by @dependabot in sigstore#341 * update tough dep by @astoycos in sigstore#340 == New Contributors * @tannaurus made their first contribution in sigstore#331 * @astoycos made their first contribution in sigstore#340 **Full Changelog**: sigstore/sigstore-rs@v0.8.0...v0.9.0 Signed-off-by: Flavio Castelli <fcastelli@suse.com>

jleightcap force-pushed the jl/sign branch 6 times, most recently from 001a365 to de3f146 Compare November 16, 2023 17:09

jleightcap marked this pull request as ready for review November 16, 2023 18:38

woodruffw reviewed Nov 16, 2023

View reviewed changes

src/bundle/mod.rs Outdated Show resolved Hide resolved

woodruffw reviewed Nov 16, 2023

View reviewed changes

src/bundle/mod.rs Outdated Show resolved Hide resolved

jleightcap commented Nov 16, 2023

View reviewed changes

src/sign.rs Outdated Show resolved Hide resolved

jleightcap commented Nov 16, 2023

View reviewed changes

src/fulcio/models.rs Show resolved Hide resolved

SantiagoTorres reviewed Nov 16, 2023

View reviewed changes

jleightcap commented Nov 16, 2023

View reviewed changes

src/fulcio/mod.rs Outdated Show resolved Hide resolved

tnytown force-pushed the jl/sign branch 2 times, most recently from 04ed874 to 207b1c6 Compare November 16, 2023 23:21

woodruffw reviewed Nov 17, 2023

View reviewed changes

src/oauth/token.rs Outdated Show resolved Hide resolved

woodruffw mentioned this pull request Nov 21, 2023

sign/verify: add bundle support #309

Closed

flavio reviewed Nov 27, 2023

View reviewed changes

woodruffw reviewed Nov 28, 2023

View reviewed changes

src/sign.rs Outdated Show resolved Hide resolved

tnytown force-pushed the jl/sign branch 2 times, most recently from 4d4c060 to ac2a88a Compare November 29, 2023 00:56

tnytown reviewed Nov 29, 2023

View reviewed changes

src/sign.rs Outdated Show resolved Hide resolved

src/sign.rs Show resolved Hide resolved

src/sign.rs Show resolved Hide resolved

tnytown force-pushed the jl/sign branch from 140a4e1 to 6850de8 Compare November 29, 2023 16:24

tnytown and others added 4 commits December 6, 2023 10:44

sign: init

016c59e

Signed-off-by: Jack Leightcap <jack.leightcap@trailofbits.com> Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com> Co-authored-by: Jack Leightcap <jack.leightcap@trailofbits.com>

sign: review: string impls

2f02745

Signed-off-by: Jack Leightcap <jack.leightcap@trailofbits.com>

Apply suggestions from code review

ec15cac

Signed-off-by: Andrew Pan <3821575+tnytown@users.noreply.github.com>

oauth/token: collect JWT token parts into array

6b22737

Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com>

jleightcap force-pushed the jl/sign branch from 6850de8 to 56b5403 Compare December 6, 2023 15:49

tnytown and others added 7 commits December 6, 2023 10:51

Apply suggestions from code review

724d889

Co-authored-by: Flavio Castelli <flavio@castelli.me> Signed-off-by: Andrew Pan <3821575+tnytown@users.noreply.github.com>

sign: more changes from code review

1808cab

Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com>

sign: discard OnceCell pattern on SigningSession

91e6775

Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com>

treewide: bump webpki to 0.102.0-alpha.7

e56a6f8

Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com>

errors: &'static str -> String

123cee1

Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com>

sign: construct AsyncSigningSession

0292488

Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com>

tuf: remove chaff in RepositoryHelper

04dece2

Signed-off-by: Andrew Pan <andrew.pan@trailofbits.com>

jleightcap force-pushed the jl/sign branch from 56b5403 to 04dece2 Compare December 6, 2023 15:53

jleightcap requested a review from flavio December 6, 2023 17:20

This was referenced Dec 6, 2023

verify: init #311

Merged

test: bundles + conformance suite #315

Draft

flavio reviewed Dec 13, 2023

View reviewed changes

src/oauth/token.rs Outdated Show resolved Hide resolved

src/sign.rs Show resolved Hide resolved

sign: cleanup docstring

dc1a334

Signed-off-by: Jack Leightcap <jack.leightcap@trailofbits.com>

tnytown reviewed Dec 13, 2023

View reviewed changes

src/oauth/token.rs Show resolved Hide resolved

Update src/oauth/token.rs

275698d

Co-authored-by: Andrew Pan <3821575+tnytown@users.noreply.github.com> Signed-off-by: Jack Leightcap <30168080+jleightcap@users.noreply.github.com>

woodruffw approved these changes Dec 20, 2023

View reviewed changes

flavio approved these changes Dec 21, 2023

View reviewed changes

flavio merged commit ea5d69b into sigstore:main Dec 21, 2023
6 checks passed

jleightcap mentioned this pull request Jan 31, 2024

Route away from experimental to 1.0 #274

Open

flavio mentioned this pull request Mar 27, 2024

Tag the 0.9.0 release #342

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sign: init #310

sign: init #310

jleightcap commented Nov 15, 2023 •

edited

jleightcap Nov 16, 2023

woodruffw Nov 16, 2023

SantiagoTorres left a comment

tnytown left a comment

woodruffw commented Nov 29, 2023

flavio left a comment

woodruffw left a comment

flavio commented Dec 21, 2023

sign: init #310

sign: init #310

Conversation

jleightcap commented Nov 15, 2023 • edited

Summary

Release Note

Documentation

jleightcap Nov 16, 2023

Choose a reason for hiding this comment

woodruffw Nov 16, 2023

Choose a reason for hiding this comment

SantiagoTorres left a comment

Choose a reason for hiding this comment

tnytown left a comment

Choose a reason for hiding this comment

woodruffw commented Nov 29, 2023

flavio left a comment

Choose a reason for hiding this comment

woodruffw left a comment

Choose a reason for hiding this comment

flavio commented Dec 21, 2023

jleightcap commented Nov 15, 2023 •

edited