verify the SET when getting a log entry #371
Conversation
Signed-off-by: Asra Ali <asraa@google.com>
pkg/cosign/verify.go
Outdated
| @@ -135,6 +135,16 @@ func VerifyTLogEntry(rekorClient *client.Rekor, uuid string) (*models.LogEntryAn | |||
| if err := v.VerifyInclusionProof(*e.Verification.InclusionProof.LogIndex, *e.Verification.InclusionProof.TreeSize, hashes, rootHash, leafHash); err != nil { | |||
| return nil, errors.Wrap(err, "verifying inclusion proof") | |||
| } | |||
|
|
|||
| // Verify rekor's signature over the SET. | |||
| rekorPubKey, err := PemToECDSAKey([]byte(rekorPub)) | |||
There was a problem hiding this comment.
should i just get this from rekorClient instead of using the offline one?
There was a problem hiding this comment.
personally i think this is fine
There was a problem hiding this comment.
agreed! i actually might change it over so we don't have to use the prod instance in the e2e test (which is why it's failing)
Signed-off-by: Asra Ali <asraa@google.com>
pkg/cosign/verify.go
Outdated
| @@ -135,6 +135,16 @@ func VerifyTLogEntry(rekorClient *client.Rekor, uuid string) (*models.LogEntryAn | |||
| if err := v.VerifyInclusionProof(*e.Verification.InclusionProof.LogIndex, *e.Verification.InclusionProof.TreeSize, hashes, rootHash, leafHash); err != nil { | |||
| return nil, errors.Wrap(err, "verifying inclusion proof") | |||
| } | |||
|
|
|||
| // Verify rekor's signature over the SET. | |||
| rekorPubKey, err := PemToECDSAKey([]byte(rekorPub)) | |||
There was a problem hiding this comment.
personally i think this is fine
Signed-off-by: Asra Ali <asraa@google.com>
|
Debugging e2e test. Sees to work fine with a prod rekor instance, but not with the test/local one. Working on it! |
|
OK it fails because rekor doesn't add a signature on on the signed entry timestamp when you get an existing entry. i don't know why we don't maintain the signature? |
|
Depends on the linked PR, will update when ready for review |
|
OK! PR is merged, this is fixed now! |
Signed-off-by: Asra Ali asraa@google.com
I noticed that in non-bundle, we are still using the integratedTime to check expiration without verifying rekor's signature of the signedEntryTimestamp