Require inclusion proof for all bundle versions newer than v0.1 (#146)

Signed-off-by: Cody Soyland <codysoyland@github.com>

cmd/conformance/main.go

@@ -154,7 +154,7 @@ func main() {
  }
 
  pb := protobundle.Bundle{
- MediaType: bundle.SigstoreBundleMediaType01,
+ MediaType: "application/vnd.dev.sigstore.bundle+json;version=0.1",
  VerificationMaterial: &protobundle.VerificationMaterial{
  Content: &protobundle.VerificationMaterial_X509CertificateChain{
  X509CertificateChain: &protocommon.X509CertificateChain{

pkg/bundle/bundle.go

@@ -33,14 +33,8 @@ import (
  "github.com/sigstore/sigstore-go/pkg/verify"
 )
 
-const SigstoreBundleMediaType01 = "application/vnd.dev.sigstore.bundle+json;version=0.1"
-const SigstoreBundleMediaType02 = "application/vnd.dev.sigstore.bundle+json;version=0.2"
-const SigstoreBundleMediaType03Legacy = "application/vnd.dev.sigstore.bundle+json;version=0.3"
-const SigstoreBundleMediaType03 = "application/vnd.dev.sigstore.bundle.v0.3+json"
-const IntotoMediaType = "application/vnd.in-toto+json"
-
 var ErrValidation = errors.New("validation error")
-var ErrIncorrectMediaType = fmt.Errorf("%w: unsupported media type", ErrValidation)
+var ErrUnsupportedMediaType = fmt.Errorf("%w: unsupported media type", ErrValidation)
 var ErrMissingVerificationMaterial = fmt.Errorf("%w: missing verification material", ErrValidation)
 var ErrUnimplemented = errors.New("unimplemented")
 var ErrInvalidAttestation = fmt.Errorf("%w: invalid attestation", ErrValidation)
@@ -74,33 +68,71 @@ func NewProtobufBundle(pbundle *protobundle.Bundle) (*ProtobufBundle, error) {
 }
 
 func (b *ProtobufBundle) validate() error {
+ bundleVersion, err := getBundleVersion(b.Bundle.MediaType)
+ if err != nil {
+ return fmt.Errorf("error getting bundle version: %w", err)
+ }
+
+ // if bundle version is < 0.1, return error
+ if semver.Compare(bundleVersion, "v0.1") < 0 {
+ return fmt.Errorf("%w: bundle version %s is not supported", ErrUnsupportedMediaType, bundleVersion)
+ }
+
+ // fetch tlog entries, as next check needs to check them for inclusion proof/promise
  entries, err := b.TlogEntries()
  if err != nil {
  return err
  }
 
- switch b.Bundle.MediaType {
- case SigstoreBundleMediaType01:
+ // if bundle version == v0.1, require inclusion promise
+ if semver.Compare(bundleVersion, "v0.1") == 0 {
  if len(entries) > 0 && !b.hasInclusionPromise {
  return errors.New("inclusion promises missing in bundle (required for bundle v0.1)")
  }
- case SigstoreBundleMediaType02:
+ } else {
+ // if bundle version >= v0.2, require inclusion proof
  if len(entries) > 0 && !b.hasInclusionProof {
  return errors.New("inclusion proof missing in bundle (required for bundle v0.2)")
  }
- case SigstoreBundleMediaType03, SigstoreBundleMediaType03Legacy:
+ }
+
+ // if bundle version >= v0.3, require verification material to not be X.509 certificate chain (only single certificate is allowed)
+ if semver.Compare(bundleVersion, "v0.3") >= 0 {
  certs := b.Bundle.VerificationMaterial.GetX509CertificateChain()
 
  if certs != nil {
  return errors.New("verification material cannot be X.509 certificate chain (for bundle v0.3)")
  }
- default:
- return ErrIncorrectMediaType
+ }
+
+ // if bundle version is newer than v0.3, return error as this version is not supported
+ if semver.Compare(bundleVersion, "v0.3") > 0 {
+ return fmt.Errorf("%w: bundle version %s is not yet supported", ErrUnsupportedMediaType, bundleVersion)
  }
 
  return nil
 }
 
+func getBundleVersion(mediaType string) (string, error) {
+ switch mediaType {
+ case "application/vnd.dev.sigstore.bundle+json;version=0.1":
+ return "v0.1", nil
+ case "application/vnd.dev.sigstore.bundle+json;version=0.2":
+ return "v0.2", nil
+ case "application/vnd.dev.sigstore.bundle+json;version=0.3":
+ return "v0.3", nil
+ }
+ if strings.HasPrefix(mediaType, "application/vnd.dev.sigstore.bundle.v") && strings.HasSuffix(mediaType, "+json") {
+ version := strings.TrimPrefix(mediaType, "application/vnd.dev.sigstore.bundle.")
+ version = strings.TrimSuffix(version, "+json")
+ if semver.IsValid(version) {
+ return version, nil
+ }
+ return "", fmt.Errorf("%w: invalid bundle version: %s", ErrUnsupportedMediaType, version)
+ }
+ return "", fmt.Errorf("%w: %s", ErrUnsupportedMediaType, mediaType)
+}
+
 func LoadJSONFromPath(path string) (*ProtobufBundle, error) {
  var bundle ProtobufBundle
  bundle.Bundle = new(protobundle.Bundle)

pkg/bundle/bundle_test.go

@@ -0,0 +1,96 @@
+// Copyright 2023 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package bundle
+
+import (
+ "fmt"
+ "testing"
+)
+
+func Test_getBundleVersion(t *testing.T) {
+ tests := []struct {
+ mediaType string
+ want string
+ wantErr bool
+ }{
+ {
+ mediaType: "application/vnd.dev.sigstore.bundle+json;version=0.1",
+ want: "v0.1",
+ wantErr: false,
+ },
+ {
+ mediaType: "application/vnd.dev.sigstore.bundle+json;version=0.2",
+ want: "v0.2",
+ wantErr: false,
+ },
+ {
+ mediaType: "application/vnd.dev.sigstore.bundle+json;version=0.3",
+ want: "v0.3",
+ wantErr: false,
+ },
+ {
+ mediaType: "application/vnd.dev.sigstore.bundle.v0.3+json",
+ want: "v0.3",
+ wantErr: false,
+ },
+ {
+ mediaType: "application/vnd.dev.sigstore.bundle.v0.3.1+json",
+ want: "v0.3.1",
+ wantErr: false,
+ },
+ {
+ mediaType: "application/vnd.dev.sigstore.bundle.v0.4+json",
+ want: "v0.4",
+ wantErr: false,
+ },
+ {
+ mediaType: "application/vnd.dev.sigstore.bundle+json",
+ want: "",
+ wantErr: true,
+ },
+ {
+ mediaType: "garbage",
+ want: "",
+ wantErr: true,
+ },
+ {
+ mediaType: "application/vnd.dev.sigstore.bundle.vgarbage+json",
+ want: "",
+ wantErr: true,
+ },
+ {
+ mediaType: "application/vnd.dev.sigstore.bundle.v0.3.1.1.1.1+json",
+ want: "",
+ wantErr: true,
+ },
+ {
+ mediaType: "",
+ want: "",
+ wantErr: true,
+ },
+ }
+ for _, tt := range tests {
+ t.Run(fmt.Sprintf("mediatype:%s", tt.mediaType), func(t *testing.T) {
+ got, err := getBundleVersion(tt.mediaType)
+ if (err != nil) != tt.wantErr {
+ t.Errorf("getBundleVersion() error = %v, wantErr %v", err, tt.wantErr)
+ return
+ }
+ if got != tt.want {
+ t.Errorf("getBundleVersion() = %v, want %v", got, tt.want)
+ }
+ })
+ }
+}

pkg/bundle/signature_content.go

@@ -23,6 +23,8 @@ import (
  "github.com/sigstore/sigstore-go/pkg/verify"
 )
 
+const IntotoMediaType = "application/vnd.in-toto+json"
+
 type MessageSignature struct {
  digest []byte
  digestAlgorithm string
@@ -51,7 +53,7 @@ type Envelope struct {
 
 func (e *Envelope) Statement() (*in_toto.Statement, error) {
  if e.PayloadType != IntotoMediaType {
- return nil, ErrIncorrectMediaType
+ return nil, ErrUnsupportedMediaType
  }
 
  var statement *in_toto.Statement