Skip to content

Commit

Permalink
Bump sigstore/sigstore, cosign, in-toto-golang (tektoncd#739)
Browse files Browse the repository at this point in the history 
* Bump sigstore/sigstore, sigstore/cosign, in-toto-golang

Bumps s/s to 1.6
Bumps cosign to v2 (needed due to conflicting dependencies due to a
breaking change in intoto)
Bumps intoto to latest commit to pull in in-toto/in-toto-golang@2d81ebf

* Fix e2e test.

Increases timeout for failed pipeline run test. Cosign v2 introduces
retries for transparency log writing, which I think is pushing us past
the 1 minute threshold.

* Use in-toto-golang v0.7.1
  • Loading branch information
@wlynch
wlynch authored Apr 6, 2023
1 parent db763c3 commit 50a40c0
Show file tree
Hide file tree
Showing 3,055 changed files with 89,754 additions and 564,948 deletions.
The diff you're trying to view is too large. We only load the first 3000 changed files.
2 changes: 1 addition & 1 deletion cmd/controller/main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ import (
// We link this here to give downstreams greater choice/control over
// which providers they pull in, by linking their own variants in their
// own binary entrypoint.
_ "github.com/sigstore/cosign/pkg/providers/all"
_ "github.com/sigstore/cosign/v2/pkg/providers/all"

// Register the provider-specific plugins
_ "github.com/sigstore/sigstore/pkg/signature/kms/aws"
Expand Down
228 changes: 88 additions & 140 deletions go.mod
View file

Large diffs are not rendered by default.

659 changes: 187 additions & 472 deletions go.sum
View file

Large diffs are not rendered by default.

10 changes: 8 additions & 2 deletions pkg/chains/rekor.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,10 @@ package chains

import (
"context"
"crypto/sha256"

"github.com/pkg/errors"
"github.com/sigstore/cosign/pkg/cosign"
"github.com/sigstore/cosign/v2/pkg/cosign"
rc "github.com/sigstore/rekor/pkg/client"
"github.com/sigstore/rekor/pkg/generated/client"
"github.com/sigstore/rekor/pkg/generated/models"
Expand Down Expand Up @@ -50,7 +51,12 @@ func (r *rekor) UploadTlog(ctx context.Context, signer signing.Signer, signature
if _, ok := formats.IntotoAttestationSet[config.PayloadType(payloadFormat)]; ok {
return cosign.TLogUploadInTotoAttestation(ctx, r.c, signature, pkoc)
}
return cosign.TLogUpload(ctx, r.c, signature, rawPayload, pkoc)

h := sha256.New()
if _, err := h.Write(rawPayload); err != nil {
return nil, errors.Wrap(err, "error checksuming payload")
}
return cosign.TLogUpload(ctx, r.c, signature, h, pkoc)
}

// return the cert if we have it, otherwise return public key
Expand Down
2 changes: 2 additions & 0 deletions pkg/chains/signing.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -194,6 +194,7 @@ func (o *ObjectSigner) Sign(ctx context.Context, tektonObj objects.TektonObject)

entry, err := rekorClient.UploadTlog(ctx, signer, signature, rawPayload, signer.Cert(), string(payloadFormat))
if err != nil {
logger.Warnf("error uploading entry to tlog: %v", err)
merr = multierror.Append(merr, err)
} else {
logger.Infof("Uploaded entry to %s with index %d", cfg.Transparency.URL, *entry.LogIndex)
Expand All @@ -205,6 +206,7 @@ func (o *ObjectSigner) Sign(ctx context.Context, tektonObj objects.TektonObject)
}
if merr.ErrorOrNil() != nil {
if err := HandleRetry(ctx, tektonObj, o.Pipelineclientset, extraAnnotations); err != nil {
logger.Warnf("error handling retry: %v", err)
merr = multierror.Append(merr, err)
}
return merr
Expand Down
8 changes: 4 additions & 4 deletions pkg/chains/signing/wrap.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ type sslAdapter struct {
pk crypto.PublicKey
}

func (w *sslAdapter) Sign(data []byte) ([]byte, error) {
func (w *sslAdapter) Sign(ctx context.Context, data []byte) ([]byte, error) {
sig, err := w.wrapped.SignMessage(bytes.NewReader(data))
return sig, err
}
Expand All @@ -80,7 +80,7 @@ func (w *sslAdapter) Public() crypto.PublicKey {
return w.pk
}

func (w *sslAdapter) Verify(data, sig []byte) error {
func (w *sslAdapter) Verify(_ context.Context, data, sig []byte) error {
panic("unimplemented")
}

Expand All @@ -101,7 +101,7 @@ func (w *sslSigner) PublicKey(opts ...signature.PublicKeyOption) (crypto.PublicK
}

func (w *sslSigner) Sign(ctx context.Context, payload []byte) ([]byte, []byte, error) {
env, err := w.wrapper.SignPayload(in_toto.PayloadType, payload)
env, err := w.wrapper.SignPayload(ctx, in_toto.PayloadType, payload)
if err != nil {
return nil, nil, err
}
Expand All @@ -117,7 +117,7 @@ func (w *sslSigner) SignMessage(payload io.Reader, opts ...signature.SignOption)
if err != nil {
return nil, err
}
env, err := w.wrapper.SignPayload(in_toto.PayloadType, m)
env, err := w.wrapper.SignPayload(context.TODO(), in_toto.PayloadType, m)
if err != nil {
return nil, err
}
Expand Down
4 changes: 2 additions & 2 deletions pkg/chains/signing/x509/fsprovider.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@ import (
"context"
"os"

"github.com/sigstore/cosign/pkg/providers"
"github.com/sigstore/cosign/pkg/providers/filesystem"
"github.com/sigstore/cosign/v2/pkg/providers"
"github.com/sigstore/cosign/v2/pkg/providers/filesystem"
)

const (
Expand Down
20 changes: 14 additions & 6 deletions pkg/chains/signing/x509/x509.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,10 @@ import (
"path/filepath"

"github.com/pkg/errors"
"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
"github.com/sigstore/cosign/cmd/cosign/cli/options"
"github.com/sigstore/cosign/pkg/cosign"
"github.com/sigstore/cosign/pkg/providers"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v2/pkg/cosign"
"github.com/sigstore/cosign/v2/pkg/providers"

"github.com/sigstore/sigstore/pkg/signature"
"github.com/sigstore/sigstore/pkg/tuf"
Expand Down Expand Up @@ -110,17 +110,25 @@ func fulcioSigner(ctx context.Context, cfg config.X509Signer, logger *zap.Sugare
}

logger.Info("Signing with fulcio ...")
priv, err := cosign.GeneratePrivateKey()
if err != nil {
return nil, fmt.Errorf("error generating keypair: %w", err)
}
signer, err := signature.LoadECDSASignerVerifier(priv, crypto.SHA256)
if err != nil {
return nil, fmt.Errorf("error loading sigstore signer: %w", err)
}
k, err := fulcio.NewSigner(ctx, options.KeyOpts{
FulcioURL: cfg.FulcioAddr,
IDToken: tok,
OIDCIssuer: cfg.FulcioOIDCIssuer,
OIDCClientID: defaultOIDCClientID,
})
}, signer)
if err != nil {
return nil, errors.Wrap(err, "new signer")
}
return &Signer{
SignerVerifier: k.ECDSASignerVerifier,
SignerVerifier: signer,
cert: string(k.Cert),
chain: string(k.Chain),
logger: logger,
Expand Down
2 changes: 1 addition & 1 deletion pkg/chains/signing/x509/x509_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ import (
"strings"
"testing"

"github.com/sigstore/cosign/pkg/providers"
"github.com/sigstore/cosign/v2/pkg/providers"
"github.com/tektoncd/chains/pkg/config"
logtesting "knative.dev/pkg/logging/testing"
)
Expand Down
2 changes: 1 addition & 1 deletion pkg/chains/storage/grafeas/grafeas.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ import (
pb "github.com/grafeas/grafeas/proto/v1/grafeas_go_proto"
intoto "github.com/in-toto/in-toto-golang/in_toto"
"github.com/pkg/errors"
"github.com/sigstore/cosign/pkg/types"
"github.com/sigstore/cosign/v2/pkg/types"
"github.com/tektoncd/chains/pkg/chains/formats"
"github.com/tektoncd/chains/pkg/chains/formats/slsa/extract"
"github.com/tektoncd/chains/pkg/chains/objects"
Expand Down
10 changes: 5 additions & 5 deletions pkg/chains/storage/oci/oci.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,11 @@ import (
"github.com/google/go-containerregistry/pkg/name"
"github.com/google/go-containerregistry/pkg/v1/remote"
"github.com/pkg/errors"
"github.com/sigstore/cosign/pkg/oci"
"github.com/sigstore/cosign/pkg/oci/mutate"
ociremote "github.com/sigstore/cosign/pkg/oci/remote"
"github.com/sigstore/cosign/pkg/oci/static"
"github.com/sigstore/cosign/pkg/types"
"github.com/sigstore/cosign/v2/pkg/oci"
"github.com/sigstore/cosign/v2/pkg/oci/mutate"
ociremote "github.com/sigstore/cosign/v2/pkg/oci/remote"
"github.com/sigstore/cosign/v2/pkg/oci/static"
"github.com/sigstore/cosign/v2/pkg/types"
"github.com/tektoncd/chains/pkg/artifacts"
"github.com/tektoncd/chains/pkg/chains/formats/simple"
"github.com/tektoncd/chains/pkg/config"
Expand Down
2 changes: 1 addition & 1 deletion test/clients.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ import (
"testing"
"time"

"github.com/sigstore/cosign/pkg/cosign"
"github.com/sigstore/cosign/v2/pkg/cosign"
"github.com/sigstore/sigstore/pkg/signature"
"github.com/tektoncd/pipeline/pkg/names"

Expand Down
2 changes: 1 addition & 1 deletion test/e2e_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -569,7 +569,7 @@ func TestRetryFailed(t *testing.T) {
obj := tekton.CreateObject(t, ctx, c.PipelineClient, test.getObject(ns))

// Give it a minute to complete.
if got := waitForCondition(ctx, t, c.PipelineClient, obj, failed, time.Minute); got == nil {
if got := waitForCondition(ctx, t, c.PipelineClient, obj, failed, 2*time.Minute); got == nil {
t.Fatal("expected failure; object never failed")
}
})
Expand Down
4 changes: 2 additions & 2 deletions test/examples_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ func runInTotoFormatterTests(ctx context.Context, t *testing.T, ns string, c *cl
t.Fatal(err)
}

if _, err := ev.Verify(&env); err != nil {
if _, err := ev.Verify(ctx, &env); err != nil {
t.Fatal(err)
}
})
Expand All @@ -186,7 +186,7 @@ type verifier struct {
pub *ecdsa.PublicKey
}

func (v *verifier) Verify(data, sig []byte) error {
func (v *verifier) Verify(_ context.Context, data, sig []byte) error {
h := sha256.Sum256(data)
if ecdsa.VerifyASN1(v.pub, h[:], sig) {
return nil
Expand Down
27 changes: 0 additions & 27 deletions vendor/bitbucket.org/creachadair/shell/LICENSE
View file

This file was deleted.

7 changes: 0 additions & 7 deletions vendor/bitbucket.org/creachadair/shell/README.md
View file

This file was deleted.

23 changes: 0 additions & 23 deletions vendor/bitbucket.org/creachadair/shell/bitbucket-pipelines.yml
View file

This file was deleted.

Loading

0 comments on commit 50a40c0

Please sign in to comment.