feat: Add support for DSSE Rekor type #742

haydentherapper · 2024-02-29T22:57:55Z

This is in preparation for switching over the Rekor entry type in the slsa github generator to be the newer DSSE type. This adds support for searching for both intoto v001 and dsse v001 entries.

This is in preparation for switching over the Rekor entry type in the slsa github generator to be the newer DSSE type. This adds support for searching for both intoto v001 and dsse v001 entries. Signed-off-by: Hayden Blauzvern <[email protected]>

haydentherapper · 2024-02-29T22:58:22Z

@laurentsimon Lemme know if there's anything I'm missing since I don't have full context into this codebase.

The intoto v001 type does not persist signatures of the DSSE envelope, as noted in sigstore/rekor#973. We introduced an intoto v002 type shortly after to fix this, but since then, we've introduced another newer type, DSSE v001, which also does not persist the attestation in Rekor (as we discourage using Rekor as storage). I also updated the verifier in slsa-framework/slsa-verifier#742 to search for both Rekor entry types. Signed-off-by: Hayden Blauzvern <[email protected]>

laurentsimon

thanks @haydentherapper

Can you link to the doc for this new type?

In terms of adding this in slsa-verifier, we need to keep backward compatibility to avoid breaking users who want too verify existing provenance. So I think we need to try the new type and fall back to the old type if we fail. Is my understanding correct?

laurentsimon

Thanks @haydentherapper

laurentsimon · 2024-03-04T15:01:09Z

verifiers/internal/gha/rekor.go

@@ -123,14 +124,19 @@ func extractCert(e *models.LogEntryAnon) (*x509.Certificate, error) {

 	var publicKeyB64 []byte
 	switch e := eimpl.(type) {
-	case *intotod.V001Entry:
+	case *intoto_v001.V001Entry:


ahh, I commented too quickly :) Backward compatibility is done here. So I think this PR should be ready to merge.

Yep, this should be fully backwards compatible, this just adds the additional DSSE Rekor type. We could and should probably make another change to add the intoto v002 type for completeness.

The intoto v001 type does not persist signatures of the DSSE envelope, as noted in sigstore/rekor#973. We introduced an intoto v002 type shortly after to fix this, but since then, we've introduced another newer type, DSSE v001, which also does not persist the attestation in Rekor (as we discourage using Rekor as storage). I also updated the verifier in slsa-framework/slsa-verifier#742 to search for both Rekor entry types. # Summary ... ## Testing Process ... ## Checklist - [ ] Review the contributing [guidelines](./../CONTRIBUTING.md) - [ ] Add a reference to related issues in the PR description. - [ ] Update documentation if applicable. - [ ] Add unit tests if applicable. - [ ] Add changes to the [CHANGELOG](./../CHANGELOG.md) if applicable. --------- Signed-off-by: Hayden Blauzvern <[email protected]> Signed-off-by: Hayden B <[email protected]> Signed-off-by: laurentsimon <[email protected]> Co-authored-by: laurentsimon <[email protected]>

This is in preparation for switching over the Rekor entry type in the slsa github generator to be the newer DSSE type. This adds support for searching for both intoto v001 and dsse v001 entries. Signed-off-by: Hayden Blauzvern <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

feat: Add support for DSSE Rekor type

5fbef05

This is in preparation for switching over the Rekor entry type in the slsa github generator to be the newer DSSE type. This adds support for searching for both intoto v001 and dsse v001 entries. Signed-off-by: Hayden Blauzvern <[email protected]>

haydentherapper requested review from laurentsimon and kpk47 as code owners February 29, 2024 22:57

haydentherapper mentioned this pull request Feb 29, 2024

fix: Switch to newer DSSE rekor type slsa-framework/slsa-github-generator#3299

Merged

5 tasks

laurentsimon reviewed Mar 4, 2024

View reviewed changes

laurentsimon approved these changes Mar 4, 2024

View reviewed changes

laurentsimon merged commit 52c099b into slsa-framework:main Mar 4, 2024
14 checks passed

haydentherapper deleted the dsse-support branch March 4, 2024 23:32

chenrui333 mentioned this pull request Mar 26, 2024

slsa-verifier 2.5.1 Homebrew/homebrew-core#167250

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add support for DSSE Rekor type #742

feat: Add support for DSSE Rekor type #742

haydentherapper commented Feb 29, 2024

haydentherapper commented Feb 29, 2024

laurentsimon left a comment

laurentsimon left a comment

laurentsimon Mar 4, 2024

haydentherapper Mar 4, 2024

feat: Add support for DSSE Rekor type #742

feat: Add support for DSSE Rekor type #742

Conversation

haydentherapper commented Feb 29, 2024

haydentherapper commented Feb 29, 2024

laurentsimon left a comment

Choose a reason for hiding this comment

laurentsimon left a comment

Choose a reason for hiding this comment

laurentsimon Mar 4, 2024

Choose a reason for hiding this comment

haydentherapper Mar 4, 2024

Choose a reason for hiding this comment