Skip to content

Commit

Permalink
Allow cli to run with alt tuf remote repository
Browse files Browse the repository at this point in the history 
Signed-off-by: Appu Goundan <[email protected]>
  • Loading branch information
@loosebazooka
loosebazooka committed May 28, 2024
1 parent 8fdbdac commit e41df29
Show file tree
Hide file tree
Showing 5 changed files with 118 additions and 22 deletions.
67 changes: 57 additions & 10 deletions sigstore-cli/src/main/java/dev/sigstore/cli/Sign.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,12 @@
package dev.sigstore.cli;

import dev.sigstore.KeylessSigner;
import dev.sigstore.TrustedRootProvider;
import dev.sigstore.encryption.certificates.Certificates;
import dev.sigstore.oidc.client.OidcClients;
import dev.sigstore.tuf.RootProvider;
import dev.sigstore.tuf.SigstoreTufClient;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
Expand All @@ -40,12 +44,29 @@ public class Sign implements Callable<Integer> {
@ArgGroup(multiplicity = "1", exclusive = true)
SignatureFiles signatureFiles;

@Option(
names = {"--staging"},
description = "test against staging",
required = false,
defaultValue = "false")
Boolean staging;
@ArgGroup(multiplicity = "0..1", exclusive = true)
Verify.Target target;

static class Target {
@Option(
names = {"--staging"},
description = "test against staging",
required = false,
defaultValue = "false")
Boolean staging;

@Option(
names = {"--public-good-with-tuf-url-override"},
description = "use public good with a tuf remote repository override",
required = false)
String publicGoodWithTufUrlOverride;

@Option(
names = {"--staging-with-tuf-url-override"},
description = "use staging with a tuf remote repository override",
required = false)
String stagingWithTufUrlOverride;
}

@Option(
names = {"--identity-token"},
Expand All @@ -55,10 +76,36 @@ public class Sign implements Callable<Integer> {

@Override
public Integer call() throws Exception {
var signerBuilder =
staging
? KeylessSigner.builder().sigstoreStagingDefaults()
: KeylessSigner.builder().sigstorePublicDefaults();
KeylessSigner.Builder signerBuilder;
if (target == null) {
signerBuilder = new KeylessSigner.Builder().sigstorePublicDefaults();
} else if (target.staging) {
signerBuilder = new KeylessSigner.Builder().sigstoreStagingDefaults();
} else if (target.publicGoodWithTufUrlOverride != null) {
var tufClientBuilder =
SigstoreTufClient.builder()
.usePublicGoodInstance()
.tufMirror(
new URL(target.publicGoodWithTufUrlOverride),
RootProvider.fromResource(SigstoreTufClient.PUBLIC_GOOD_ROOT_RESOURCE));
signerBuilder =
KeylessSigner.builder()
.sigstorePublicDefaults()
.trustedRootProvider(TrustedRootProvider.from(tufClientBuilder));
} else if (target.stagingWithTufUrlOverride != null) {
var tufClientBuilder =
SigstoreTufClient.builder()
.useStagingInstance()
.tufMirror(
new URL(target.stagingWithTufUrlOverride),
RootProvider.fromResource(SigstoreTufClient.STAGING_ROOT_RESOURCE));
signerBuilder =
KeylessSigner.builder()
.sigstoreStagingDefaults()
.trustedRootProvider(TrustedRootProvider.from(tufClientBuilder));
} else {
throw new IllegalStateException("Unable to initialize signer");
}
if (identityToken != null) {
// If we've explicitly provided an identity token, customize the signer to only use the token
// string OIDC client.
Expand Down
57 changes: 51 additions & 6 deletions sigstore-cli/src/main/java/dev/sigstore/cli/Verify.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@

import com.google.common.hash.Hashing;
import dev.sigstore.KeylessVerifier;
import dev.sigstore.TrustedRootProvider;
import dev.sigstore.VerificationOptions;
import dev.sigstore.VerificationOptions.CertificateIdentity;
import dev.sigstore.bundle.Bundle;
Expand All @@ -27,6 +28,9 @@
import dev.sigstore.bundle.ImmutableBundle;
import dev.sigstore.encryption.certificates.Certificates;
import dev.sigstore.rekor.client.RekorEntryFetcher;
import dev.sigstore.tuf.RootProvider;
import dev.sigstore.tuf.SigstoreTufClient;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
Expand Down Expand Up @@ -72,6 +76,18 @@ static class Target {
description = "an alternative to the TUF managed sigstore public good trusted root",
required = false)
Path trustedRoot;

@Option(
names = {"--public-good-with-tuf-url-override"},
description = "use public good with a tuf remote repository override",
required = false)
String publicGoodWithTufUrlOverride;

@Option(
names = {"--staging-with-tuf-url-override"},
description = "use staging with a tuf remote repository override",
required = false)
String stagingWithTufUrlOverride;
}

static class Policy {
Expand Down Expand Up @@ -127,12 +143,41 @@ public Integer call() throws Exception {
}
var verificationOptions = verificationOptionsBuilder.build();

var verifier =
target == null
? new KeylessVerifier.Builder().sigstorePublicDefaults().build()
: target.staging
? new KeylessVerifier.Builder().sigstoreStagingDefaults().build()
: new KeylessVerifier.Builder().fromTrustedRoot(target.trustedRoot).build();
KeylessVerifier verifier;
if (target == null) {
verifier = new KeylessVerifier.Builder().sigstorePublicDefaults().build();
} else if (target.staging) {
verifier = new KeylessVerifier.Builder().sigstoreStagingDefaults().build();
} else if (target.trustedRoot != null) {
verifier =
new KeylessVerifier.Builder()
.trustedRootProvider(TrustedRootProvider.from(target.trustedRoot))
.build();
} else if (target.publicGoodWithTufUrlOverride != null) {
var tufClientBuilder =
SigstoreTufClient.builder()
.usePublicGoodInstance()
.tufMirror(
new URL(target.publicGoodWithTufUrlOverride),
RootProvider.fromResource(SigstoreTufClient.PUBLIC_GOOD_ROOT_RESOURCE));
verifier =
KeylessVerifier.builder()
.trustedRootProvider(TrustedRootProvider.from(tufClientBuilder))
.build();
} else if (target.stagingWithTufUrlOverride != null) {
var tufClientBuilder =
SigstoreTufClient.builder()
.useStagingInstance()
.tufMirror(
new URL(target.stagingWithTufUrlOverride),
RootProvider.fromResource(SigstoreTufClient.STAGING_ROOT_RESOURCE));
verifier =
KeylessVerifier.builder()
.trustedRootProvider(TrustedRootProvider.from(tufClientBuilder))
.build();
} else {
throw new IllegalStateException("Unable to initialize verifier");
}
verifier.verify(artifact, bundle, verificationOptions);
return 0;
}
Expand Down
4 changes: 2 additions & 2 deletions sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -158,8 +158,8 @@ public Builder rekorUrl(URI uri) {
}

@CanIgnoreReturnValue
public Builder trustedRoot(Path trustedRoot) {
trustedRootProvider = TrustedRootProvider.from(trustedRoot);
public Builder trustedRootProvider(TrustedRootProvider trustedRootProvider) {
this.trustedRootProvider = trustedRootProvider;
return this;
}

Expand Down
4 changes: 2 additions & 2 deletions sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,8 @@ public Builder sigstoreStagingDefaults() {
return this;
}

public Builder fromTrustedRoot(Path trustedRoot) {
trustedRootProvider = TrustedRootProvider.from(trustedRoot);
public Builder trustedRootProvider(TrustedRootProvider trustedRootProvider) {
this.trustedRootProvider = trustedRootProvider;
return this;
}
}
Expand Down
8 changes: 6 additions & 2 deletions sigstore-java/src/main/java/dev/sigstore/tuf/SigstoreTufClient.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,10 @@ public class SigstoreTufClient {

@VisibleForTesting static final String TRUST_ROOT_FILENAME = "trusted_root.json";

public static final String PUBLIC_GOOD_ROOT_RESOURCE =
"dev/sigstore/tuf/tuf-root-staging/root.json";
public static final String STAGING_ROOT_RESOURCE = "dev/sigstore/tuf/tuf-root-staging/root.json";

private final Updater updater;
private Instant lastUpdate;
private SigstoreTrustedRoot sigstoreTrustedRoot;
Expand Down Expand Up @@ -72,7 +76,7 @@ public Builder usePublicGoodInstance() {
try {
tufMirror(
new URL("https://tuf-repo-cdn.sigstore.dev"),
RootProvider.fromResource("dev/sigstore/tuf/sigstore-tuf-root/root.json"));
RootProvider.fromResource(PUBLIC_GOOD_ROOT_RESOURCE));
} catch (MalformedURLException e) {
throw new AssertionError(e);
}
Expand All @@ -87,7 +91,7 @@ public Builder useStagingInstance() {
try {
tufMirror(
new URL("https://tuf-repo-cdn.sigstage.dev"),
RootProvider.fromResource("dev/sigstore/tuf/tuf-root-staging/root.json"));
RootProvider.fromResource(STAGING_ROOT_RESOURCE));
} catch (MalformedURLException e) {
throw new AssertionError(e);
}
Expand Down

0 comments on commit e41df29

Please sign in to comment.