Skip to content

Commit

Permalink
expose rekor option to choose 'intoto' or 'dsse' (#820)
Browse files Browse the repository at this point in the history 
Signed-off-by: Brian DeHamer <[email protected]>
  • Loading branch information
@bdehamer
bdehamer authored Oct 20, 2023
1 parent 8fe010c commit c0a43d5
Show file tree
Hide file tree
Showing 4 changed files with 149 additions and 65 deletions.
5 changes: 5 additions & 0 deletions .changeset/cyan-impalas-look.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@sigstore/sign': minor
---

Expose `entryType` option on `RekorWitness` constructor
12 changes: 6 additions & 6 deletions package-lock.json
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

189 changes: 132 additions & 57 deletions packages/sign/src/__tests__/witness/tlog/index.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -158,65 +158,140 @@ describe('RekorWitness', () => {
},
};

it('returns the tlog entry', async () => {
const vm = await subject.testify(sigBundle, publicKey);
describe('when the Rekor entry type is "intoto"', () => {
const subject = new RekorWitness({
rekorBaseURL,
entryType: 'intoto',
});

expect(vm).toBeDefined();
assert(vm.tlogEntries);
expect(vm.tlogEntries).toHaveLength(1);
it('returns the tlog entry', async () => {
const vm = await subject.testify(sigBundle, publicKey);

const tlogEntry = vm.tlogEntries[0];
expect(tlogEntry).toBeDefined();
expect(tlogEntry.logIndex).toEqual(
rekorEntry[uuid].logIndex.toString()
);
expect(tlogEntry.logId?.keyId).toEqual(
Buffer.from(rekorEntry[uuid].logID, 'hex')
);
expect(tlogEntry.kindVersion?.kind).toEqual(proposedEntry.kind);
expect(tlogEntry.kindVersion?.version).toEqual(
proposedEntry.apiVersion
);
expect(tlogEntry.integratedTime).toEqual(
rekorEntry[uuid].integratedTime.toString()
);
expect(tlogEntry.inclusionPromise?.signedEntryTimestamp).toEqual(
Buffer.from(
rekorEntry[uuid].verification.signedEntryTimestamp,
'base64'
)
);
expect(tlogEntry.inclusionProof?.checkpoint?.envelope).toEqual(
rekorEntry[uuid].verification.inclusionProof.checkpoint
);
expect(tlogEntry.inclusionProof?.hashes).toHaveLength(2);
expect(tlogEntry.inclusionProof?.hashes[0]).toEqual(
Buffer.from(
rekorEntry[uuid].verification.inclusionProof.hashes[0],
'hex'
)
);
expect(tlogEntry.inclusionProof?.hashes[1]).toEqual(
Buffer.from(
rekorEntry[uuid].verification.inclusionProof.hashes[1],
'hex'
)
);
expect(tlogEntry.inclusionProof?.logIndex).toEqual(
rekorEntry[uuid].verification.inclusionProof.logIndex.toString()
);
expect(tlogEntry.inclusionProof?.rootHash).toEqual(
Buffer.from(
rekorEntry[uuid].verification.inclusionProof.rootHash,
'hex'
)
);
expect(tlogEntry.inclusionProof?.treeSize).toEqual(
rekorEntry[uuid].verification.inclusionProof.treeSize.toString()
);
expect(tlogEntry.canonicalizedBody).toEqual(
Buffer.from(rekorEntry[uuid].body, 'base64')
);
expect(vm).toBeDefined();
assert(vm.tlogEntries);
expect(vm.tlogEntries).toHaveLength(1);

const tlogEntry = vm.tlogEntries[0];
expect(tlogEntry).toBeDefined();
expect(tlogEntry.logIndex).toEqual(
rekorEntry[uuid].logIndex.toString()
);
expect(tlogEntry.logId?.keyId).toEqual(
Buffer.from(rekorEntry[uuid].logID, 'hex')
);
expect(tlogEntry.kindVersion?.kind).toEqual(proposedEntry.kind);
expect(tlogEntry.kindVersion?.version).toEqual(
proposedEntry.apiVersion
);
expect(tlogEntry.integratedTime).toEqual(
rekorEntry[uuid].integratedTime.toString()
);
expect(tlogEntry.inclusionPromise?.signedEntryTimestamp).toEqual(
Buffer.from(
rekorEntry[uuid].verification.signedEntryTimestamp,
'base64'
)
);
expect(tlogEntry.inclusionProof?.checkpoint?.envelope).toEqual(
rekorEntry[uuid].verification.inclusionProof.checkpoint
);
expect(tlogEntry.inclusionProof?.hashes).toHaveLength(2);
expect(tlogEntry.inclusionProof?.hashes[0]).toEqual(
Buffer.from(
rekorEntry[uuid].verification.inclusionProof.hashes[0],
'hex'
)
);
expect(tlogEntry.inclusionProof?.hashes[1]).toEqual(
Buffer.from(
rekorEntry[uuid].verification.inclusionProof.hashes[1],
'hex'
)
);
expect(tlogEntry.inclusionProof?.logIndex).toEqual(
rekorEntry[uuid].verification.inclusionProof.logIndex.toString()
);
expect(tlogEntry.inclusionProof?.rootHash).toEqual(
Buffer.from(
rekorEntry[uuid].verification.inclusionProof.rootHash,
'hex'
)
);
expect(tlogEntry.inclusionProof?.treeSize).toEqual(
rekorEntry[uuid].verification.inclusionProof.treeSize.toString()
);
expect(tlogEntry.canonicalizedBody).toEqual(
Buffer.from(rekorEntry[uuid].body, 'base64')
);
});
});

describe('when the Rekor entry type is "dsse"', () => {
const subject = new RekorWitness({
rekorBaseURL,
entryType: 'dsse',
});

it('returns the tlog entry', async () => {
const vm = await subject.testify(sigBundle, publicKey);

expect(vm).toBeDefined();
assert(vm.tlogEntries);
expect(vm.tlogEntries).toHaveLength(1);

const tlogEntry = vm.tlogEntries[0];
expect(tlogEntry).toBeDefined();
expect(tlogEntry.logIndex).toEqual(
rekorEntry[uuid].logIndex.toString()
);
expect(tlogEntry.logId?.keyId).toEqual(
Buffer.from(rekorEntry[uuid].logID, 'hex')
);
expect(tlogEntry.kindVersion?.kind).toEqual(proposedEntry.kind);
expect(tlogEntry.kindVersion?.version).toEqual(
proposedEntry.apiVersion
);
expect(tlogEntry.integratedTime).toEqual(
rekorEntry[uuid].integratedTime.toString()
);
expect(tlogEntry.inclusionPromise?.signedEntryTimestamp).toEqual(
Buffer.from(
rekorEntry[uuid].verification.signedEntryTimestamp,
'base64'
)
);
expect(tlogEntry.inclusionProof?.checkpoint?.envelope).toEqual(
rekorEntry[uuid].verification.inclusionProof.checkpoint
);
expect(tlogEntry.inclusionProof?.hashes).toHaveLength(2);
expect(tlogEntry.inclusionProof?.hashes[0]).toEqual(
Buffer.from(
rekorEntry[uuid].verification.inclusionProof.hashes[0],
'hex'
)
);
expect(tlogEntry.inclusionProof?.hashes[1]).toEqual(
Buffer.from(
rekorEntry[uuid].verification.inclusionProof.hashes[1],
'hex'
)
);
expect(tlogEntry.inclusionProof?.logIndex).toEqual(
rekorEntry[uuid].verification.inclusionProof.logIndex.toString()
);
expect(tlogEntry.inclusionProof?.rootHash).toEqual(
Buffer.from(
rekorEntry[uuid].verification.inclusionProof.rootHash,
'hex'
)
);
expect(tlogEntry.inclusionProof?.treeSize).toEqual(
rekorEntry[uuid].verification.inclusionProof.treeSize.toString()
);
expect(tlogEntry.canonicalizedBody).toEqual(
Buffer.from(rekorEntry[uuid].body, 'base64')
);
});
});
});
});
Expand Down
8 changes: 6 additions & 2 deletions packages/sign/src/witness/tlog/index.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,16 @@ export const DEFAULT_REKOR_URL = 'https://rekor.sigstore.dev';

type TransparencyLogEntries = { tlogEntries: TransparencyLogEntry[] };

export type RekorWitnessOptions = Partial<TLogClientOptions>;
export type RekorWitnessOptions = Partial<TLogClientOptions> & {
entryType?: 'dsse' | 'intoto';
};

export class RekorWitness implements Witness {
private tlog: TLog;
private entryType?: 'dsse' | 'intoto';

constructor(options: RekorWitnessOptions) {
this.entryType = options.entryType;
this.tlog = new TLogClient({
...options,
rekorBaseURL:
Expand All @@ -47,7 +51,7 @@ export class RekorWitness implements Witness {
content: SignatureBundle,
publicKey: string
): Promise<TransparencyLogEntries> {
const proposedEntry = toProposedEntry(content, publicKey);
const proposedEntry = toProposedEntry(content, publicKey, this.entryType);
const entry = await this.tlog.createEntry(proposedEntry);
return toTransparencyLogEntry(entry);
}
Expand Down

0 comments on commit c0a43d5

Please sign in to comment.