Add privacy statement for PII storage (#1909)

This statement has been added just before the OIDC code/normal flow, since only in this flow we expect a user to be present. For the device flow or when a token is provided, it's likely that Cosign is being run in an automated environment. This requires the user either type Y or provide a global flag for confirmation. This should not break any existing flows in automated environments because it's only the flow when a browser is needed, not for the device flow or when a token is provided. Signed-off-by: Hayden Blauzvern <[email protected]>
sigstore · May 25, 2022 · 5f09c42 · 5f09c42
1 parent b73da70
commit 5f09c42
Show file tree

Hide file tree

Showing 55 changed files with 108 additions and 6 deletions.
diff --git a/cmd/cosign/cli/clean.go b/cmd/cosign/cli/clean.go
@@ -51,7 +51,7 @@ func Clean() *cobra.Command {
 
 func CleanCmd(ctx context.Context, regOpts options.RegistryOptions, cleanType, imageRef string, force bool) error {
 	if !force {
-		ok, err := cosign.ConfirmPrompt(prompt(cleanType))
+		ok, err := cosign.ConfirmPromptDestructive(prompt(cleanType))
 		if err != nil {
 			return err
 		}

diff --git a/cmd/cosign/cli/commands.go b/cmd/cosign/cli/commands.go
@@ -26,6 +26,7 @@ import (
 
 	cranecmd "github.com/google/go-containerregistry/cmd/crane/cmd"
 	"github.com/sigstore/cosign/cmd/cosign/cli/options"
+	"github.com/sigstore/cosign/pkg/cosign"
 )
 
 var (
@@ -73,6 +74,11 @@ func New() *cobra.Command {
 			if ro.Verbose {
 				logs.Debug.SetOutput(os.Stderr)
 			}
+
+			if ro.SkipConfirmation {
+				cosign.SetSkipConfirmation(ro.SkipConfirmation)
+			}
+
 			return nil
 		},
 		PersistentPostRun: func(cmd *cobra.Command, args []string) {

diff --git a/cmd/cosign/cli/fulcio/fulcio.go b/cmd/cosign/cli/fulcio/fulcio.go
@@ -22,6 +22,7 @@ import (
 	"crypto/rand"
 	"crypto/sha256"
 	"crypto/x509"
+	"errors"
 	"fmt"
 	"net/url"
 	"os"
@@ -41,6 +42,12 @@ const (
 	FlowNormal = "normal"
 	FlowDevice = "device"
 	FlowToken  = "token"
+	// spacing is intentional to have this indented
+	PrivacyStatement = `
+        Note that there may be personally identifiable information associated with this signed artifact.
+        This may include the email address associated with the account with which you authenticate.
+        This information will be used for signing this artifact and will be stored in public transparency logs and cannot be removed later.`
+	PrivacyStatementConfirmation = "        By typing 'y', you attest that you grant (or have permission to grant) and agree to have this information stored permanently in transparency logs."
 )
 
 type oidcConnector interface {
@@ -135,6 +142,8 @@ func NewSigner(ctx context.Context, ko options.KeyOpts) (*Signer, error) {
 	}
 	fmt.Fprintln(os.Stderr, "Retrieving signed certificate...")
 
+	fmt.Fprintln(os.Stderr, PrivacyStatement)
+
 	var flow string
 	switch {
 	case ko.FulcioAuthFlow != "":
@@ -146,6 +155,13 @@ func NewSigner(ctx context.Context, ko options.KeyOpts) (*Signer, error) {
 		fmt.Fprintln(os.Stderr, "Non-interactive mode detected, using device flow.")
 		flow = FlowDevice
 	default:
+		ok, err := cosign.ConfirmPrompt(PrivacyStatementConfirmation)
+		if err != nil {
+			return nil, err
+		}
+		if !ok {
+			return nil, errors.New("no confirmation")
+		}
 		flow = FlowNormal
 	}
 	Resp, err := GetCert(ctx, priv, idToken, flow, ko.OIDCIssuer, ko.OIDCClientID, ko.OIDCClientSecret, ko.OIDCRedirectURL, fClient) // TODO, use the chain.

diff --git a/cmd/cosign/cli/options/root.go b/cmd/cosign/cli/options/root.go
@@ -23,9 +23,10 @@ import (
 
 // RootOptions define flags and options for the root cosign cli.
 type RootOptions struct {
-	OutputFile string
-	Verbose    bool
-	Timeout    time.Duration
+	OutputFile       string
+	Verbose          bool
+	Timeout          time.Duration
+	SkipConfirmation bool
 }
 
 // DefaultTimeout specifies the default timeout for commands.
@@ -43,4 +44,7 @@ func (o *RootOptions) AddFlags(cmd *cobra.Command) {
 
 	cmd.PersistentFlags().DurationVarP(&o.Timeout, "timeout", "t", DefaultTimeout,
 		"timeout for commands")
+
+	cmd.PersistentFlags().BoolVarP(&o.SkipConfirmation, "yes", "y", false,
+		"skip confirmation prompts for non-destructive operations")
 }
diff --git a/doc/cosign.md b/doc/cosign.md
diff --git a/doc/cosign_attach.md b/doc/cosign_attach.md
diff --git a/doc/cosign_attach_attestation.md b/doc/cosign_attach_attestation.md
diff --git a/doc/cosign_attach_sbom.md b/doc/cosign_attach_sbom.md
diff --git a/doc/cosign_attach_signature.md b/doc/cosign_attach_signature.md
diff --git a/doc/cosign_attest.md b/doc/cosign_attest.md
diff --git a/doc/cosign_clean.md b/doc/cosign_clean.md
diff --git a/doc/cosign_completion.md b/doc/cosign_completion.md
diff --git a/doc/cosign_copy.md b/doc/cosign_copy.md
diff --git a/doc/cosign_dockerfile.md b/doc/cosign_dockerfile.md
diff --git a/doc/cosign_dockerfile_verify.md b/doc/cosign_dockerfile_verify.md
diff --git a/doc/cosign_download.md b/doc/cosign_download.md
diff --git a/doc/cosign_download_attestation.md b/doc/cosign_download_attestation.md
diff --git a/doc/cosign_download_sbom.md b/doc/cosign_download_sbom.md
diff --git a/doc/cosign_download_signature.md b/doc/cosign_download_signature.md
diff --git a/doc/cosign_generate-key-pair.md b/doc/cosign_generate-key-pair.md
diff --git a/doc/cosign_generate.md b/doc/cosign_generate.md
diff --git a/doc/cosign_import-key-pair.md b/doc/cosign_import-key-pair.md
diff --git a/doc/cosign_initialize.md b/doc/cosign_initialize.md
diff --git a/doc/cosign_load.md b/doc/cosign_load.md
diff --git a/doc/cosign_login.md b/doc/cosign_login.md
diff --git a/doc/cosign_manifest.md b/doc/cosign_manifest.md
diff --git a/doc/cosign_manifest_verify.md b/doc/cosign_manifest_verify.md
diff --git a/doc/cosign_piv-tool.md b/doc/cosign_piv-tool.md
diff --git a/doc/cosign_piv-tool_attestation.md b/doc/cosign_piv-tool_attestation.md
diff --git a/doc/cosign_piv-tool_generate-key.md b/doc/cosign_piv-tool_generate-key.md
diff --git a/doc/cosign_piv-tool_reset.md b/doc/cosign_piv-tool_reset.md
diff --git a/doc/cosign_piv-tool_set-management-key.md b/doc/cosign_piv-tool_set-management-key.md
diff --git a/doc/cosign_piv-tool_set-pin.md b/doc/cosign_piv-tool_set-pin.md
diff --git a/doc/cosign_piv-tool_set-puk.md b/doc/cosign_piv-tool_set-puk.md
diff --git a/doc/cosign_piv-tool_unblock.md b/doc/cosign_piv-tool_unblock.md
diff --git a/doc/cosign_pkcs11-tool.md b/doc/cosign_pkcs11-tool.md
diff --git a/doc/cosign_pkcs11-tool_list-keys-uris.md b/doc/cosign_pkcs11-tool_list-keys-uris.md
diff --git a/doc/cosign_pkcs11-tool_list-tokens.md b/doc/cosign_pkcs11-tool_list-tokens.md
diff --git a/doc/cosign_policy.md b/doc/cosign_policy.md
diff --git a/doc/cosign_policy_init.md b/doc/cosign_policy_init.md
diff --git a/doc/cosign_policy_sign.md b/doc/cosign_policy_sign.md
diff --git a/doc/cosign_public-key.md b/doc/cosign_public-key.md