Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add buildtags to avoid fulcio and rekor dependencies #2180

Merged
merged 2 commits into from
Dec 1, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,8 @@ the primary downside is that creating new signatures with the Golang-only implem
- `containers_image_ostree`: Import `ostree:` transport in `github.com/containers/image/transports/alltransports`. This builds the library requiring the `libostree` development libraries. Otherwise a stub which reports that the transport is not supported gets used. The `github.com/containers/image/ostree` package is completely disabled
and impossible to import when this build tag is not in use.
- `containers_image_storage_stub`: Don’t import the `containers-storage:` transport in `github.com/containers/image/transports/alltransports`, to decrease the amount of required dependencies. Use a stub which reports that the transport is not supported instead.
- `containers_image_fulcio_stub`: Don't import sigstore/fulcio code, all fulcio operations will return an error code
- `containers_image_rekor_stub`: Don't import sigstore/reckor code, all rekor operations will return an error code

## [Contributing](CONTRIBUTING.md)

Expand Down
3 changes: 3 additions & 0 deletions signature/fulcio_cert.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !containers_image_fulcio_stub
// +build !containers_image_fulcio_stub

package signature

import (
Expand Down
28 changes: 28 additions & 0 deletions signature/fulcio_cert_stub.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
//go:build containers_image_fulcio_stub
// +build containers_image_fulcio_stub

package signature

import (
"crypto"
"crypto/ecdsa"
"crypto/x509"
"errors"
)

type fulcioTrustRoot struct {
caCertificates *x509.CertPool
oidcIssuer string
subjectEmail string
}

func (f *fulcioTrustRoot) validate() error {
return errors.New("fulcio disabled at compile-time")
}

func verifyRekorFulcio(rekorPublicKey *ecdsa.PublicKey, fulcioTrustRoot *fulcioTrustRoot, untrustedRekorSET []byte,
untrustedCertificateBytes []byte, untrustedIntermediateChainBytes []byte, untrustedBase64Signature string,
untrustedPayloadBytes []byte) (crypto.PublicKey, error) {
return nil, errors.New("fulcio diabled at compile-time")

}
3 changes: 3 additions & 0 deletions signature/fulcio_cert_test.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !containers_image_fulcio_stub
// +build !containers_image_fulcio_stub

package signature

import (
Expand Down
3 changes: 3 additions & 0 deletions signature/internal/rekor_set.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !containers_image_rekor_stub
// +build !containers_image_rekor_stub

package internal

import (
Expand Down
15 changes: 15 additions & 0 deletions signature/internal/rekor_set_stub.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
//go:build containers_image_rekor_stub
// +build containers_image_rekor_stub

package internal

import (
"crypto/ecdsa"
"time"
)

// VerifyRekorSET verifies that unverifiedRekorSET is correctly signed by publicKey and matches the rest of the data.
// Returns bundle upload time on success.
func VerifyRekorSET(publicKey *ecdsa.PublicKey, unverifiedRekorSET []byte, unverifiedKeyOrCertBytes []byte, unverifiedBase64Signature string, unverifiedPayloadBytes []byte) (time.Time, error) {
return time.Time{}, NewInvalidSignatureError("rekor disabled at compile-time")
}
3 changes: 3 additions & 0 deletions signature/internal/rekor_set_test.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !containers_image_rekor_stub
// +build !containers_image_rekor_stub

package internal

import (
Expand Down
3 changes: 3 additions & 0 deletions signature/policy_eval_sigstore_test.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !containers_image_fulcio_stub
// +build !containers_image_fulcio_stub

// Policy evaluation for prCosignSigned.

package signature
Expand Down
3 changes: 3 additions & 0 deletions signature/sigstore/fulcio/fulcio.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !containers_image_fulcio_stub
// +build !containers_image_fulcio_stub

package fulcio

import (
Expand Down
45 changes: 45 additions & 0 deletions signature/sigstore/fulcio/fulcio_stub.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
//go:build containers_image_fulcio_stub
// +build containers_image_fulcio_stub

package fulcio

import (
"fmt"
"io"
"net/url"

"github.com/containers/image/v5/signature/sigstore/internal"
)

func WithFulcioAndPreexistingOIDCIDToken(fulcioURL *url.URL, oidcIDToken string) internal.Option {
return func(s *internal.SigstoreSigner) error {
return fmt.Errorf("fulcio disabled at compile time")
}
}

// WithFulcioAndDeviceAuthorizationGrantOIDC sets up signing to use a short-lived key and a Fulcio-issued certificate
// based on an OIDC ID token obtained using a device authorization grant (RFC 8628).
//
// interactiveOutput must be directly accessible to a human user in real time (i.e. not be just a log file).
func WithFulcioAndDeviceAuthorizationGrantOIDC(fulcioURL *url.URL, oidcIssuerURL *url.URL, oidcClientID, oidcClientSecret string,
interactiveOutput io.Writer) internal.Option {
return func(s *internal.SigstoreSigner) error {
return fmt.Errorf("fulcio disabled at compile time")
}
}

// WithFulcioAndInterativeOIDC sets up signing to use a short-lived key and a Fulcio-issued certificate
// based on an interactively-obtained OIDC ID token.
// The token is obtained
// - directly using a browser, listening on localhost, automatically opening a browser to the OIDC issuer,
// to be redirected on localhost. (I.e. the current environment must allow launching a browser that connect back to the current process;
// either or both may be impossible in a container or a remote VM).
// - or by instructing the user to manually open a browser, obtain the OIDC code, and interactively input it as text.
//
// interactiveInput and interactiveOutput must both be directly operable by a human user in real time (i.e. not be just a log file).
func WithFulcioAndInteractiveOIDC(fulcioURL *url.URL, oidcIssuerURL *url.URL, oidcClientID, oidcClientSecret string,
interactiveInput io.Reader, interactiveOutput io.Writer) internal.Option {
return func(s *internal.SigstoreSigner) error {
return fmt.Errorf("fulcio disabled at compile time")
}
}
3 changes: 3 additions & 0 deletions signature/sigstore/rekor/rekor.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
//go:build !containers_image_rekor_stub
// +build !containers_image_rekor_stub

package rekor

import (
Expand Down
17 changes: 17 additions & 0 deletions signature/sigstore/rekor/rekor_stub.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
//go:build containers_image_rekor_stub
// +build containers_image_rekor_stub

package rekor

import (
"fmt"
"net/url"

signerInternal "github.com/containers/image/v5/signature/sigstore/internal"
)

func WithRekor(rekorURL *url.URL) signerInternal.Option {
return func(s *signerInternal.SigstoreSigner) error {
return fmt.Errorf("rekor disabled at build time")
}
}