Skip to content
This repository has been archived by the owner on Jun 25, 2024. It is now read-only.

[WIP] Add verify command and enable use with CI/CD #34

Draft
wants to merge 82 commits into
base: main
Choose a base branch
from
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
82 commits
Select commit Hold shift + click to select a range
013e186
fix connection to rekor
doodzik Oct 28, 2021
1dcc6ac
Merge pull request #1 from Shopify/fix_connection_to_sigstore
doodzik Oct 28, 2021
a53f3a5
add rubocop
doodzik Oct 29, 2021
a5eb3a5
add rubygems rubocop file
doodzik Oct 29, 2021
f64477c
apply rubocop changes
doodzik Oct 29, 2021
9a09388
sign gem
doodzik Oct 29, 2021
cf7fba9
Merge pull request #2 from Shopify/use_rubygems_style_guide
doodzik Oct 29, 2021
8a7d2ad
Restore default SSL peer verification for connections to fulcio (#4)
rochlefebvre Oct 29, 2021
6bb57af
push cert chain to rekord
doodzik Oct 29, 2021
25a4ec2
Merge pull request #8 from Shopify/sign_gem
doodzik Oct 29, 2021
b8f637a
super terrible `gem verify` implementation
rochlefebvre Oct 29, 2021
13afc81
Merge pull request #11 from Shopify/gem-install--verify
doodzik Oct 29, 2021
3613202
add gemfile class
doodzik Oct 29, 2021
286d05f
add namespaces
doodzik Oct 30, 2021
0e0f307
move fulcio api calls out of http client
doodzik Oct 30, 2021
5e945af
move rekor api out of http
doodzik Oct 30, 2021
195bd1b
add gem signer and verifier classes
doodzik Oct 30, 2021
ac7728f
misc fixes
rochlefebvre Oct 30, 2021
f20d826
various fixes to get sign & verify working
rochlefebvre Nov 1, 2021
3994ba0
Merge pull request #9 from Shopify/refactor
doodzik Nov 1, 2021
193ed4b
exclude byebug_history from git
rochlefebvre Nov 1, 2021
a37e8f1
Retrieve root certificate using signing certificate's AIA extension (…
rochlefebvre Nov 1, 2021
714cda5
print all unique emails from valid signature entries
rochlefebvre Nov 1, 2021
ce9d0bc
Merge pull request #20 from Shopify/list_all_signer_emails
rochlefebvre Nov 1, 2021
83428c0
Clean up some of the printed messages
rochlefebvre Nov 2, 2021
7467a4f
Merge pull request #22 from Shopify/improve-output-messaging
rochlefebvre Nov 2, 2021
bd97622
update gitignore, Rakefile and dependencies; remove rspec
rochlefebvre Nov 18, 2021
e5076ef
add rake workflow; temporarily remove verify workflow
rochlefebvre Nov 18, 2021
cd278f3
Use Gem::UserInteration instead of put $stdout
rochlefebvre Nov 18, 2021
dc81dd6
stub requests with webmock; add integration test for `gem sign`
rochlefebvre Nov 18, 2021
6d14b92
Merge pull request #23 from Shopify/set_up_tests
rochlefebvre Nov 18, 2021
a90fc2a
remore circular `require`; declare Gem::Sigstore module in Gemfile
rochlefebvre Nov 22, 2021
f5c4c14
stub log and CA cert requests; add `gem verify` integration suite
rochlefebvre Nov 22, 2021
8b48032
Merge pull request #28 from Shopify/first-gem-verify-integration-test
rochlefebvre Nov 22, 2021
cb9b5b1
Partial refactor of the rekor client code
rochlefebvre Nov 19, 2021
980d49e
add missing require statements
rochlefebvre Nov 22, 2021
6e08b10
Merge pull request #27 from Shopify/sigstore_rekor_module
rochlefebvre Nov 23, 2021
5538614
add sigstore module file; clean up require statements
rochlefebvre Nov 22, 2021
4d63839
rename crypto.rb to pkey.rb
rochlefebvre Nov 23, 2021
8aefcfe
Merge pull request #29 from Shopify/clean-up-require-statements
rochlefebvre Nov 23, 2021
d699044
add rubocop
doodzik Nov 23, 2021
ea6fdbe
apply rubocop changes
doodzik Nov 23, 2021
54907c5
Correct style errors from newer commits
rochlefebvre Nov 23, 2021
73a1b1c
Merge pull request #31 from Shopify/add_rubocop
doodzik Nov 23, 2021
97e3b3f
move openid class to openid::dynamic
doodzik Nov 23, 2021
3229a77
change openid::dynamic interface to expose token and proof
doodzik Nov 24, 2021
de11ce3
remove some go-isms
doodzik Nov 24, 2021
93c9037
move openid from cert provider to gem signer
doodzik Nov 24, 2021
61f318a
simplify run method of gem_signer
doodzik Nov 24, 2021
1b58419
Merge pull request #39 from Shopify/refacetor_openid
doodzik Nov 24, 2021
80bcfd9
bulk-retrieve log entries by uuid; add two-sig verify test
rochlefebvre Nov 24, 2021
7be944c
Merge pull request #40 from Shopify/bulk-retrieve-log-entries
rochlefebvre Dec 1, 2021
574e658
add static openid provider
doodzik Nov 25, 2021
1d573e1
Merge pull request #41 from Shopify/add_static_openid_provider_2
doodzik Dec 2, 2021
d5ba747
Support empty responses in Rekor::Api#where
rochlefebvre Dec 15, 2021
770c03a
add decision log
doodzik Dec 15, 2021
d20d841
Merge pull request #48 from Shopify/create_decision_log
doodzik Dec 15, 2021
96c1553
Merge pull request #45 from Shopify/fix-verify-unsigned-gem
rochlefebvre Dec 16, 2021
7c00ea3
Combine `sign` and `verify` into a new `signature` command
rochlefebvre Dec 16, 2021
c5869f7
Merge pull request #51 from Shopify/add-signatures-command
rochlefebvre Dec 17, 2021
f9684af
add verify to install command
doodzik Dec 16, 2021
1ea850b
Merge pull request #50 from Shopify/bundler_verify_command
rochlefebvre Dec 17, 2021
e09fa5a
Delete gem sign and gem verify
rochlefebvre Dec 17, 2021
0508d64
Rename `install` command's --verify option to --verify-signatures
rochlefebvre Dec 17, 2021
858e7d7
Merge pull request #53 from Shopify/clean-up-commands
aellispierce Dec 21, 2021
c2eee4c
Merge pull request #54 from Shopify/rename-verify-option-to-verify-si…
aellispierce Dec 21, 2021
3983a41
Merge pull request #55 from Shopify/clean-up-commands
jchestershopify Dec 21, 2021
393af47
Update the README
rochlefebvre Dec 14, 2021
2ede6a0
Merge pull request #44 from Shopify/update-readme
aellispierce Dec 21, 2021
e2eeeac
Validate file is a gem on signatures command
aellispierce Dec 22, 2021
37460c4
Remove unreachable raise
aellispierce Dec 22, 2021
86a64be
Fix Ruby 3.1 net/smtp bug
aellispierce Jan 18, 2022
489a1a4
Add quotes around ruby version numbers
aellispierce Jan 18, 2022
3274d9b
Test 3.1
aellispierce Jan 18, 2022
d157c51
Merge pull request #56 from Shopify/validate_file_gemminess
aellispierce Jan 18, 2022
6c65818
Fix reference to undefined variable
rochlefebvre Jan 24, 2022
4bc8603
Check responses from Fulcio/Rekor POSTs, raise unless expected
rochlefebvre Jan 27, 2022
b8621f0
Merge pull request #62 from Shopify/raise-on-unexpected-fulcio-rekor-…
rochlefebvre Jan 27, 2022
a9a6f90
extract Signature module from Rekord
rochlefebvre Feb 15, 2022
14c84d9
store signatures in hashedrekord
rochlefebvre Feb 15, 2022
19c0606
support verification of hashedrekord signatures
rochlefebvre Feb 15, 2022
1fd5157
Merge pull request #63 from Shopify/use-hashedrekord
rochlefebvre Feb 15, 2022
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions .github/workflows/main.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
name: Test

on:
push:
branches:
- main

pull_request:

jobs:
build:
runs-on: ubuntu-latest

strategy:
matrix:
ruby-version:
- '2.6'
- '2.7'
- '3.0'
- '3.1'

steps:
- uses: actions/checkout@v2
- name: Set up Ruby
uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby-version }}
bundler-cache: true
- name: Run Tests
run: bundle exec rake

lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Set up Ruby
uses: ruby/setup-ruby@v1
with:
ruby-version: 2.6
bundler-cache: true
- name: Run Lint
run: bundle exec rubocop
24 changes: 0 additions & 24 deletions .github/workflows/verify.yml

This file was deleted.

6 changes: 5 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,9 @@
/tmp/
/vendor/
/certs/
*.gem
/*.gem

.byebug_history

# rspec failure tracking
.rspec_status
Expand All @@ -21,3 +23,5 @@ data.tar.gz.sig
metadata.gz
metadata.gz.sig
ruby-sigstore-*.gem

rekor-cli
3 changes: 0 additions & 3 deletions .rspec

This file was deleted.

153 changes: 153 additions & 0 deletions .rubocop.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,153 @@
require: rubocop-performance

AllCops:
DisabledByDefault: true
Exclude:
- 'bundler/**/*'
- 'lib/rubygems/resolver/molinillo/**/*'
- 'pkg/**/*'
- 'vendor/bundle/**/*'
- 'tmp/**/*'
TargetRubyVersion: 2.3

Layout/AccessModifierIndentation:
Enabled: true

Layout/ArrayAlignment:
Enabled: true

Layout/BlockAlignment:
Enabled: true

Layout/CaseIndentation:
Enabled: true

Layout/ClosingParenthesisIndentation:
Enabled: true

Layout/CommentIndentation:
Enabled: true

Layout/ElseAlignment:
Enabled: true

Layout/EmptyLinesAroundAccessModifier:
Enabled: true

# Force Unix line endings.
Layout/EndOfLine:
Enabled: true
EnforcedStyle: lf

Layout/EmptyLines:
Enabled: true

Layout/EmptyLinesAroundClassBody:
Enabled: true

Layout/EmptyLinesAroundMethodBody:
Enabled: true

Layout/ExtraSpacing:
Enabled: true

Layout/FirstHashElementIndentation:
Enabled: true
EnforcedStyle: consistent

Layout/FirstArrayElementIndentation:
Enabled: true
EnforcedStyle: consistent

Layout/IndentationConsistency:
Enabled: true

Layout/IndentationWidth:
Enabled: true

Layout/LeadingEmptyLines:
Enabled: true

Layout/SpaceAroundOperators:
Enabled: true

Layout/SpaceInsideBlockBraces:
Enabled: true
SpaceBeforeBlockParameters: false

Layout/SpaceInsideParens:
Enabled: true

Layout/TrailingEmptyLines:
Enabled: true

Layout/TrailingWhitespace:
Enabled: true

Lint/DuplicateMethods:
Enabled: true

Lint/ParenthesesAsGroupedExpression:
Enabled: true

Layout/EndAlignment:
Enabled: true

Naming/HeredocDelimiterCase:
Enabled: true

Naming/HeredocDelimiterNaming:
Enabled: true
ForbiddenDelimiters:
- ^RB$

Performance/StartWith:
Enabled: true

Performance/StringReplacement:
Enabled: true

Security/Open:
Enabled: true

Style/Encoding:
Enabled: true
Exclude:
- test/rubygems/specifications/foo-0.0.1-x86-mswin32.gemspec

Style/EvalWithLocation:
Enabled: true

Style/IfInsideElse:
Enabled: false

Style/MethodCallWithoutArgsParentheses:
Enabled: true

Style/MethodDefParentheses:
Enabled: true

Style/MultilineIfThen:
Enabled: true

Style/MutableConstant:
Enabled: true

Style/NilComparison:
Enabled: true

Style/BlockDelimiters:
Enabled: true

Style/PercentLiteralDelimiters:
Enabled: true

# Having these make it easier to *not* forget to add one when adding a new
# value and you can simply copy the previous line.
Style/TrailingCommaInArrayLiteral:
Enabled: true
EnforcedStyleForMultiline: comma

Style/TrailingCommaInHashLiteral:
Enabled: true
EnforcedStyleForMultiline: comma
3 changes: 3 additions & 0 deletions DECISIONLOG
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# 2021-12-15

We decided to keep a decision log to capture key resolutions and make them available for future reference.
20 changes: 17 additions & 3 deletions Gemfile
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,20 @@ gem "faraday_middleware", "~> 1.0.0"
gem "oa-openid", "~> 0.0.2"
gem "omniauth-openid", "~> 2.0.1"
gem "ruby-openid-apps-discovery", "~> 1.2.0"
gem "rake", "~> 12.0"
gem "rspec", "~> 3.0"
gem "json-jwt", "~> 1.13.0"
gem "json-jwt", "~> 1.13.0"
gem 'net-smtp', require: false

group :development do
gem "rubocop", "~> 0.80.1"
gem "rubocop-performance", "~> 1.5.2"
gem "rake", "~> 12.0"
end

group :test do
gem "test-unit", "~> 3.0"
gem "webmock", "~> 3.0"
end

group :development, :test do
gem "byebug"
end
Loading