-
Notifications
You must be signed in to change notification settings - Fork 32
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1900 from simonbaird/no-cosign-with-wrapper-v02
Replace cosign binary with bash wrapper [0.2]
- Loading branch information
Showing
12 changed files
with
353 additions
and
114 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| // Copyright The Enterprise Contract Contributors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| package sigstore | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| hd "github.com/MakeNowJust/heredoc" | ||
| "github.com/sigstore/cosign/v2/cmd/cosign/cli/options" | ||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| type sigstoreInitializeFunc func(ctx context.Context, root, mirror string) error | ||
|
|
||
| func sigstoreInitializeCmd(f sigstoreInitializeFunc) *cobra.Command { | ||
|
|
||
| opts := &options.InitializeOptions{} | ||
|
|
||
| cmd := &cobra.Command{ | ||
| Use: "initialize", | ||
| Short: "Initializes Sigstore root to retrieve trusted certificate and key targets for verification", | ||
|
|
||
| Long: hd.Doc(` | ||
| Initializes Sigstore root to retrieve trusted certificate and key targets for verification. | ||
| The following options are used by default: | ||
| - The current trusted Sigstore TUF root is embedded inside ec at the time of release. | ||
| - Sigstore remote TUF repository is pulled from the CDN mirror at tuf-repo-cdn.sigstore.dev. | ||
| To provide an out-of-band trusted initial root.json, use the --root flag with a file or | ||
| URL reference. This will enable you to point ec to a separate TUF root. | ||
| Any updated TUF repository will be written to $HOME/.sigstore/root/. | ||
| Trusted keys and certificate used in ec verification (e.g. verifying Fulcio issued certificates | ||
| with Fulcio root CA) are pulled form the trusted metadata. | ||
| This command is mostly a wrapper around "cosign initialize". | ||
| `), | ||
|
|
||
| Example: hd.Doc(` | ||
| ec initialize -mirror <url> -out <file> | ||
| Initialize root with distributed root keys, default mirror, and default out path. | ||
| ec initialize | ||
| Initialize with an out-of-band root key file, using the default mirror. | ||
| ec initialize -root <url> | ||
| Initialize with an out-of-band root key file and custom repository mirror. | ||
| ec initialize -mirror <url> -root <url> | ||
| `), | ||
|
|
||
| Args: cobra.NoArgs, | ||
| RunE: func(cmd *cobra.Command, _ []string) error { | ||
| return f(cmd.Context(), opts.Root, opts.Mirror) | ||
| }, | ||
| } | ||
|
|
||
| opts.AddFlags(cmd) | ||
|
|
||
| return cmd | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| // Copyright The Enterprise Contract Contributors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| //go:build unit | ||
|
|
||
| package sigstore | ||
|
|
||
| import ( | ||
| "context" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "github.com/enterprise-contract/ec-cli/cmd/root" | ||
| ) | ||
|
|
||
| func TestInitializeCmd(t *testing.T) { | ||
| cases := []struct { | ||
| name string | ||
| args []string | ||
| expectedRoot string | ||
| expectedMirror string | ||
| }{ | ||
| { | ||
| name: "no args", | ||
| expectedMirror: "https://tuf-repo-cdn.sigstore.dev", | ||
| }, | ||
| { | ||
| name: "with root", | ||
| args: []string{"--root", "/some/path/root.json"}, | ||
| expectedRoot: "/some/path/root.json", | ||
| expectedMirror: "https://tuf-repo-cdn.sigstore.dev", | ||
| }, | ||
| { | ||
| name: "with mirror", | ||
| args: []string{"--mirror", "https://tuf.local"}, | ||
| expectedMirror: "https://tuf.local", | ||
| }, | ||
| { | ||
| name: "with root and mirror", | ||
| args: []string{"--root", "/some/path/root.json", "--mirror", "https://tuf.local"}, | ||
| expectedRoot: "/some/path/root.json", | ||
| expectedMirror: "https://tuf.local", | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range cases { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| initF := func(ctx context.Context, root, mirror string) error { | ||
| require.Equal(t, tt.expectedRoot, root) | ||
| require.Equal(t, tt.expectedMirror, mirror) | ||
| return nil | ||
| } | ||
|
|
||
| sigInitCmd := sigstoreInitializeCmd(initF) | ||
|
|
||
| sigCmd := NewSigstoreCmd() | ||
| sigCmd.AddCommand(sigInitCmd) | ||
|
|
||
| rootCmd := root.NewRootCmd() | ||
| rootCmd.AddCommand(sigCmd) | ||
|
|
||
| rootCmd.SetContext(context.Background()) | ||
| rootCmd.SetArgs(append([]string{"sigstore", "initialize"}, tt.args...)) | ||
|
|
||
| err := rootCmd.Execute() | ||
| require.NoError(t, err) | ||
| }) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| // Copyright The Enterprise Contract Contributors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| package sigstore | ||
|
|
||
| import ( | ||
| "github.com/sigstore/cosign/v2/cmd/cosign/cli/initialize" | ||
| "github.com/spf13/cobra" | ||
|
|
||
| _ "github.com/enterprise-contract/ec-cli/internal/rego" | ||
| ) | ||
|
|
||
| var SigstoreCmd *cobra.Command | ||
|
|
||
| func init() { | ||
| SigstoreCmd = NewSigstoreCmd() | ||
| SigstoreCmd.AddCommand(sigstoreInitializeCmd(initialize.DoInitialize)) | ||
| } | ||
|
|
||
| func NewSigstoreCmd() *cobra.Command { | ||
| sigstoreCmd := &cobra.Command{ | ||
| Use: "sigstore", | ||
| Short: "Perform certain sigstore operations", | ||
| } | ||
| return sigstoreCmd | ||
| } |
Oops, something went wrong.