Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add '--cert-identity' flag to support subject alternate names for ver… #2278

Merged
merged 8 commits into from
Oct 11, 2022
Merged

Add '--cert-identity' flag to support subject alternate names for ver… #2278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b89ba96
Add '--cert-identity' flag to support subject alternate names for ver…
kpk47 Sep 23, 2022
e3cf1a9
Fixing documentation
kpk47 Sep 26, 2022
5eedb3d
fix e2e test
kpk47 Sep 29, 2022
50b4301
Add '--cert-identity' flag to support subject alternate names for ver…
kpk47 Sep 23, 2022
0cff9ae
Fixing documentation
kpk47 Sep 26, 2022
916443e
fix e2e test
kpk47 Sep 29, 2022
21413b0
Merge branch 'verify-identity' of github.com:kpk47/cosign into verify…
kpk47 Oct 3, 2022
3b9ddde
fix unit test
kpk47 Oct 3, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions cmd/cosign/cli/commands.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@ func normalizeCertificateFlags(_ *pflag.FlagSet, name string) pflag.NormalizedNa
name = "certificate-oidc-issuer"
case "output-cert":
name = "output-certificate"
case "cert-identity":
name = "certificate-identity"
}
return pflag.NormalizedName(name)
}
Expand Down
4 changes: 4 additions & 0 deletions cmd/cosign/cli/options/certificate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (
type CertVerifyOptions struct {
Cert string
CertEmail string
CertIdentity string
CertOidcIssuer string
CertGithubWorkflowTrigger string
CertGithubWorkflowSha string
Expand All @@ -43,6 +44,9 @@ func (o *CertVerifyOptions) AddFlags(cmd *cobra.Command) {
cmd.Flags().StringVar(&o.CertEmail, "certificate-email", "",
"the email expected in a valid Fulcio certificate")

cmd.Flags().StringVar(&o.CertIdentity, "certificate-identity", "",
"the identity expected in a valid Fulcio certificate. Valid values include email address, DNS names, IP addresses, and URIs.")

cmd.Flags().StringVar(&o.CertOidcIssuer, "certificate-oidc-issuer", "",
"the OIDC issuer expected in a valid Fulcio certificate, e.g. https://token.actions.githubusercontent.com or https://oauth2.sigstore.dev/auth")

Expand Down
4 changes: 3 additions & 1 deletion cmd/cosign/cli/verify.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@ against the transparency log.`,
KeyRef: o.Key,
CertRef: o.CertVerify.Cert,
CertEmail: o.CertVerify.CertEmail,
CertIdentity: o.CertVerify.CertIdentity,
CertOidcIssuer: o.CertVerify.CertOidcIssuer,
CertGithubWorkflowTrigger: o.CertVerify.CertGithubWorkflowTrigger,
CertGithubWorkflowSha: o.CertVerify.CertGithubWorkflowSha,
Expand Down Expand Up @@ -181,6 +182,7 @@ against the transparency log.`,
CheckClaims: o.CheckClaims,
CertRef: o.CertVerify.Cert,
CertEmail: o.CertVerify.CertEmail,
CertIdentity: o.CertVerify.CertIdentity,
CertOidcIssuer: o.CertVerify.CertOidcIssuer,
CertChain: o.CertVerify.CertChain,
CertGithubWorkflowTrigger: o.CertVerify.CertGithubWorkflowTrigger,
Expand Down Expand Up @@ -264,7 +266,7 @@ The blob may be specified as a path to a file or - for stdin.`,
BundlePath: o.BundlePath,
}
if err := verify.VerifyBlobCmd(cmd.Context(), ko, o.CertVerify.Cert,
o.CertVerify.CertEmail, o.CertVerify.CertOidcIssuer, o.CertVerify.CertChain,
o.CertVerify.CertEmail, o.CertVerify.CertIdentity, o.CertVerify.CertOidcIssuer, o.CertVerify.CertChain,
o.Signature, args[0], o.CertVerify.CertGithubWorkflowTrigger, o.CertVerify.CertGithubWorkflowSha,
o.CertVerify.CertGithubWorkflowName, o.CertVerify.CertGithubWorkflowRepository, o.CertVerify.CertGithubWorkflowRef,
o.CertVerify.EnforceSCT); err != nil {
Expand Down
3 changes: 3 additions & 0 deletions cmd/cosign/cli/verify/verify.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,13 +52,15 @@ type VerifyCommand struct {
KeyRef string
CertRef string
CertEmail string
CertIdentity string
CertOidcIssuer string
CertGithubWorkflowTrigger string
CertGithubWorkflowSha string
CertGithubWorkflowName string
CertGithubWorkflowRepository string
CertGithubWorkflowRef string
CertChain string
CertOidcProvider string
EnforceSCT bool
Sk bool
Slot string
Expand Down Expand Up @@ -100,6 +102,7 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) {
Annotations: c.Annotations.Annotations,
RegistryClientOpts: ociremoteOpts,
CertEmail: c.CertEmail,
CertIdentity: c.CertIdentity,
CertOidcIssuer: c.CertOidcIssuer,
CertGithubWorkflowTrigger: c.CertGithubWorkflowTrigger,
CertGithubWorkflowSha: c.CertGithubWorkflowSha,
Expand Down
2 changes: 2 additions & 0 deletions cmd/cosign/cli/verify/verify_attestation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ type VerifyAttestationCommand struct {
KeyRef string
CertRef string
CertEmail string
CertIdentity string
CertOidcIssuer string
CertGithubWorkflowTrigger string
CertGithubWorkflowSha string
Expand Down Expand Up @@ -80,6 +81,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e
co := &cosign.CheckOpts{
RegistryClientOpts: ociremoteOpts,
CertEmail: c.CertEmail,
CertIdentity: c.CertIdentity,
CertOidcIssuer: c.CertOidcIssuer,
CertGithubWorkflowTrigger: c.CertGithubWorkflowTrigger,
CertGithubWorkflowSha: c.CertGithubWorkflowSha,
Expand Down
3 changes: 2 additions & 1 deletion cmd/cosign/cli/verify/verify_blob.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ func isb64(data []byte) bool {
}

// nolint
func VerifyBlobCmd(ctx context.Context, ko options.KeyOpts, certRef, certEmail,
func VerifyBlobCmd(ctx context.Context, ko options.KeyOpts, certRef, certEmail, certIdentity,
certOidcIssuer, certChain, sigRef, blobRef, certGithubWorkflowTrigger, certGithubWorkflowSha,
certGithubWorkflowName,
certGithubWorkflowRepository,
Expand All @@ -90,6 +90,7 @@ func VerifyBlobCmd(ctx context.Context, ko options.KeyOpts, certRef, certEmail,

co := &cosign.CheckOpts{
CertEmail: certEmail,
CertIdentity: certIdentity,
CertOidcIssuer: certOidcIssuer,
CertGithubWorkflowTrigger: certGithubWorkflowTrigger,
CertGithubWorkflowSha: certGithubWorkflowSha,
Expand Down
14 changes: 13 additions & 1 deletion cmd/cosign/cli/verify/verify_blob_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -721,6 +721,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/ // Cert is fetched from bundle
identity, /*certEmail*/
"", /*certIdentity*/
issuer, /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -765,6 +766,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/ // Cert is fetched from bundle
"", /*certEmail*/
"", /*certIdentity*/
"", /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -803,6 +805,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/ // Cert is fetched from bundle
"", /*certEmail*/
"", /*certIdentity*/
"", /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -841,6 +844,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/ // Cert is fetched from bundle
"", /*certEmail*/
"", /*certIdentity*/
"", /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -879,6 +883,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/ // Cert is fetched from bundle
"", /*certEmail*/
"", /*certIdentity*/
"", /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -917,6 +922,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/ // Cert is fetched from bundle
"[email protected]", /*certEmail*/
"", /*certIdentity*/
issuer, /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand All @@ -925,7 +931,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
"", "", "", "", "",
// GitHub identity flags end
false /*enforceSCT*/)
if err == nil || !strings.Contains(err.Error(), "expected email not found in certificate") {
if err == nil || !strings.Contains(err.Error(), "expected identity not found in certificate") {
t.Fatalf("expected error with mismatched identity, got %v", err)
}
})
Expand Down Expand Up @@ -955,6 +961,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/ // Cert is fetched from bundle
identity, /*certEmail*/
"", /*certIdentity*/
"invalid", /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -994,6 +1001,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
certPath, /*certRef*/
identity, /*certEmail*/
"", /*certIdentity*/
issuer, /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -1032,6 +1040,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/
identity, /*certEmail*/
"", /*certIdentity*/
issuer, /*certOidcIssuer*/
os.Getenv("SIGSTORE_ROOT_FILE"), /*certChain*/
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -1081,6 +1090,7 @@ func TestVerifyBlobCmdWithBundle(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/
identity, /*certEmail*/
"", /*certIdentity*/
issuer, /*certOidcIssuer*/
tmpChainFile.Name(), /*certChain*/
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -1126,6 +1136,7 @@ func TestVerifyBlobCmdInvalidRootCA(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
certPath, /*certRef*/
identity, /*certEmail*/
"", /*certIdentity*/
issuer, /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down Expand Up @@ -1164,6 +1175,7 @@ func TestVerifyBlobCmdInvalidRootCA(t *testing.T) {
options.KeyOpts{BundlePath: bundlePath},
"", /*certRef*/ // Fetched from bundle
identity, /*certEmail*/
"", /*certIdentity*/
issuer, /*certOidcIssuer*/
"", /*certChain*/ // Chain is fetched from TUF/SIGSTORE_ROOT_FILE
"", /*sigRef*/ // Sig is fetched from bundle
Expand Down
1 change: 1 addition & 0 deletions doc/cosign_dockerfile_verify.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions doc/cosign_manifest_verify.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions doc/cosign_verify-attestation.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions doc/cosign_verify-blob.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions doc/cosign_verify.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading