-
Notifications
You must be signed in to change notification settings - Fork 53
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
13 changed files
with
259 additions
and
326 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,123 @@ | ||
| /* | ||
| Copyright (c) Edgeless Systems GmbH | ||
| SPDX-License-Identifier: AGPL-3.0-only | ||
| */ | ||
|
|
||
| package measurements | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "net/http" | ||
|
|
||
| "github.com/edgelesssys/constellation/v2/internal/api/versionsapi" | ||
| "github.com/edgelesssys/constellation/v2/internal/attestation/variant" | ||
| "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" | ||
| "github.com/edgelesssys/constellation/v2/internal/sigstore" | ||
| "github.com/edgelesssys/constellation/v2/internal/sigstore/keyselect" | ||
| ) | ||
|
|
||
| // ErrRekor is returned when verifying measurements with Rekor fails. | ||
| type ErrRekor struct { | ||
| error | ||
| } | ||
|
|
||
| func newRekorErr(err error) error { | ||
| return ErrRekor{ | ||
| error: fmt.Errorf("verifying measurements with Rekor: %w", err), | ||
| } | ||
| } | ||
|
|
||
| type cosignVerifierConstructor func([]byte) (sigstore.Verifier, error) | ||
|
|
||
| // VerifyFetcher is a high-level fetcher that fetches measurements and verifies them. | ||
| type VerifyFetcher struct { | ||
| client *http.Client | ||
| newCosignVerifier cosignVerifierConstructor | ||
| rekor rekorVerifier | ||
| noVerify bool // do not verify measurements | ||
| } | ||
|
|
||
| // NewVerifyFetcher creates a new MeasurementFetcher. | ||
| func NewVerifyFetcher(client *http.Client) (*VerifyFetcher, error) { | ||
| rekor, err := sigstore.NewRekor() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("constructing Rekor client: %w", err) | ||
| } | ||
| return &VerifyFetcher{ | ||
| newCosignVerifier: sigstore.NewCosignVerifier, | ||
| rekor: rekor, | ||
| client: client, | ||
| }, nil | ||
| } | ||
|
|
||
| type rekorVerifier interface { | ||
| SearchByHash(context.Context, string) ([]string, error) | ||
| VerifyEntry(context.Context, string, string) error | ||
| } | ||
|
|
||
| // NewVerifyFetcherWith creates a new MeasurementFetcher with custom clients. | ||
| func NewVerifyFetcherWith(newCosignVerifier func([]byte) (sigstore.Verifier, error), noVerify bool, rekor rekorVerifier, client *http.Client) *VerifyFetcher { | ||
| return &VerifyFetcher{ | ||
| newCosignVerifier: newCosignVerifier, | ||
| rekor: rekor, | ||
| client: client, | ||
| noVerify: noVerify, | ||
| } | ||
| } | ||
|
|
||
| // FetchAndVerifyMeasurements fetches and verifies measurements for the given version and attestation variant. | ||
| func (m *VerifyFetcher) FetchAndVerifyMeasurements(ctx context.Context, | ||
| image string, csp cloudprovider.Provider, attestationVariant variant.Variant, | ||
| ) (M, error) { | ||
| version, err := versionsapi.NewVersionFromShortPath(image, versionsapi.VersionKindImage) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("parsing image version: %w", err) | ||
| } | ||
| publicKey, err := keyselect.CosignPublicKeyForVersion(version) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("getting public key: %w", err) | ||
| } | ||
|
|
||
| cosign, err := m.newCosignVerifier(publicKey) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("creating cosign verifier: %w", err) | ||
| } | ||
|
|
||
| measurementsURL, signatureURL, err := versionsapi.MeasurementURL(version) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| var fetchedMeasurements M | ||
| if m.noVerify { | ||
| if err := fetchedMeasurements.FetchNoVerify( | ||
| ctx, | ||
| m.client, | ||
| measurementsURL, | ||
| version, | ||
| csp, | ||
| attestationVariant, | ||
| ); err != nil { | ||
| return nil, fmt.Errorf("fetching measurements: %w", err) | ||
| } | ||
| } else { | ||
| hash, err := fetchedMeasurements.FetchAndVerify( | ||
| ctx, | ||
| m.client, | ||
| cosign, | ||
| measurementsURL, | ||
| signatureURL, | ||
| version, | ||
| csp, | ||
| attestationVariant, | ||
| ) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("fetching and verifying measurements: %w", err) | ||
| } | ||
| if err := sigstore.VerifyWithRekor(ctx, publicKey, m.rekor, hash); err != nil { | ||
| return nil, newRekorErr(err) | ||
| } | ||
| } | ||
| return fetchedMeasurements, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.