Add `keyPaths`, `keyDatas` to `prSigstoreSigned` by mtrmac · Pull Request #2524 · containers/image

mtrmac · 2024-08-16T01:20:07Z

This is #2456 + various cleanups on top.

Huge thanks to @dcermak and @danishprakash for doing almost all the work in #2456.

This is a few preparatory commits + landing the whole feature at once; see https://github.com/mtrmac/image/tree/sigstore-multi-individual-commits for a (tiny bit older) version with individual commits, and showing the relationship to original #2456.

~~Currently not tested end-to-end in practice.~~

mtrmac · 2024-08-17T02:05:41Z

A highlight for reviewers: keyDatas is not standard English. I think the symmetry between keyPath/keyPaths and keyData/keyDatas is compelling, but I’d appreciate an opinion of a native English speaker.

mtrmac · 2024-08-17T02:33:03Z

A highlight for reviewers: keyDatas is not standard English.

… The data is in PEM format, one key per blob.

While we do need …Paths so that we can read from multiple independent external sources, for the embedded …Data we might, instead, consider adding support for loading multiple keys from a single PEM blob.

mtrmac · 2024-08-17T03:40:05Z

Support for multiple Rekor public keys has been split to #2526.

mtrmac · 2024-08-19T14:59:00Z

Now tested by manually writing policy.json, ready for review.

WRT the option of accepting a single keyData with multiple PEM values, it would add more loops and conditions to security-critical code; not a bit deal but I’d rather keep the implementation simple.

rhatdan · 2024-08-19T15:06:56Z

signature/policy_eval_sigstore.go

-		return nil, nil
+		data = d
+	}
+	if src.data != nil {


This is a change in behaviour, Previous behavior ignored src.data when src.path is set? Is this intentional?

AFAICS previously this would have matched

case data != nil && path != "": return nil, fmt.Errorf(`Internal inconsistency: both "%sPath" and "%sData" specified`, prefix, prefix)

and it would have been rejected. Now we also reject that, but at the very end, based on sources > 1.

rhatdan · 2024-08-19T15:36:17Z

LGTM

TomSweeneyRedHat · 2024-08-19T16:56:41Z

@mtrmac look like you need to update/rebase this one.

TomSweeneyRedHat · 2024-08-19T17:12:00Z

signature/policy_eval_signedby.go

 	}
-	if keySources != 1 {
+	if data == nil {
 		return sarRejected, nil, errors.New(`Internal inconsistency: not exactly one of "keyPath", "keyPaths" and "keyData" specified`)


Should "keyDatas" be added here too?

No; for simple signing, we don’t have a keyDatas option (e.g. a few lines above, the datas: field is not set).

[The keyDatas option is not necessary for simple signing, because the input format is a GPG keyring, which already supports multiple keys. (That’s structurally ~similar to the possibility to support multiple PEM-formatted keys in a single blob, discussed above.)]

TomSweeneyRedHat · 2024-08-19T17:22:37Z

One minor nit, otherwise LGTM. @mheon?

mheon · 2024-08-19T17:52:23Z

LGTM on my end

mtrmac · 2024-08-19T18:33:53Z

Rebased.

kolyshkin · 2024-08-19T20:52:13Z

signature/policy_eval_signedby.go

-		keySources++
-		data = [][]byte{pr.KeyData}
+	data, err := loadBytesFromConfigSources(configBytesSources{
+		inconsistencyErrorMessage: `Internal inconsistency: not exactly one of "keyPath", "keyPaths" and "keyData" specified`,


nit: since you use this exact error message twice, maybe place it into a const?

Why not, fixed.

kolyshkin · 2024-08-19T21:03:35Z

signature/policy_eval_sigstore.go

-	if publicKeyPEM != nil {
-		pk, err := cryptoutils.UnmarshalPEMToPublicKey(publicKeyPEM)
+	if publicKeyPEMs != nil {
+		if len(publicKeyPEMs) != 1 { // Coverage: We only provide single-element sources to loadBytesFromConfigSources, and at most one is allowed.


nit: I guess the comment is telling something like "Should never happen", but my tiny brains fail to read it this way.

“Coverage:” is, in this subpackage, a shorthand for “this line is not covered by unit tests because …”.

Added an explicit “this should never happen” to the start of the explanation, hopefully that helps.

kolyshkin · 2024-08-19T21:04:46Z

signature/internal/sigstore_payload.go

 	ValidateSignedDockerManifestDigest func(digest.Digest) error
 }

+// verifySigstorePayloadBlobSignature verifies verifies unverifiedSignature of unverifiedPayload was correctly created


s/ verifies verifies / verifies /

Fixed, thanks!

kolyshkin · 2024-08-19T21:09:32Z

signature/internal/sigstore_payload.go

+//
+// This is an internal implementation detail of VerifySigstorePayload and should have no other callers.
+// It is INSUFFICIENT alone to consider the signature acceptable.
+func verifySigstorePayloadBlobSignature(publicKey crypto.PublicKey, unverifiedPayload []byte, unverifiedSignature []byte) error {


nit:

Suggested change

func verifySigstorePayloadBlobSignature(publicKey crypto.PublicKey, unverifiedPayload []byte, unverifiedSignature []byte) error {

func verifySigstorePayloadBlobSignature(publicKey crypto.PublicKey, unverifiedPayload, unverifiedSignature []byte) error {

kolyshkin · 2024-08-19T21:10:08Z

signature/internal/sigstore_payload.go

-		return err
+func verifySigstorePayloadBlobSignature(publicKeys []crypto.PublicKey, unverifiedPayload []byte, unverifiedSignature []byte) error {
+	if len(publicKeys) == 0 {
+		return fmt.Errorf("Need at least one public key to verify the sigstore payload, but got 0")


nit: s/fmt.Errorf/errors.New/

kolyshkin · 2024-08-19T21:26:41Z

signature/policy_types.go

 	prCommon

-	// KeyPath is a pathname to a local file containing the trusted key. Exactly one of KeyPath, KeyData, Fulcio must be specified.
+	// KeyPath is a pathname to a local file containing the trusted key. Exactly one of KeyPath, KeyPaths, KeyData, KeyDatas or Fulcio must be specified.


In the code above it says "and fulcio" and here it says "or".

I’m not sure there is a difference in meaning, but being consistent is nice. Fixed.

kolyshkin · 2024-08-19T21:27:05Z

signature/policy_types.go

+	// KeyDatas is a set of trusted keys, base64-encoded. Exactly one of KeyPath, KeyPaths, KeyData, KeyDatas or Fulcio must be specified.
+	KeyDatas [][]byte `json:"keyDatas,omitempty"`

 	// Fulcio specifies which Fulcio-generated certificates are accepted. Exactly one of KeyPath, KeyData, Fulcio must be specified.


This comment needs to be amended, too.

Fixed, thanks!

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Use a struct as an input, so that the parameters are named and we minimize risk of inconsistencies, and make it easier to add more sources. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Extend loadBytesFromConfigSources to return multiple values, and to support reading the from files; then share the code. Signed-off-by: Miloslav Trmač <mitr@redhat.com>

because we will want to support multiple public keys, and that's easier to do in a separate function. Should not change behavior except for order of error checks. Signed-off-by: Miloslav Trmač <mitr@redhat.com>

The new fields `KeyPaths` and `KeyDatas` is taken directly from `/etc/containers/policy.json` and allows users to provide multiple signature keys to be used to verify images. Only one of the keys has to verify, thereby this mechanism allows us to have support seamless key rotation on a registry. This fixes containers#2319 Signed-off-by: Dan Čermák <dcermak@suse.com> Co-authored-by: Danish Prakash <danish.prakash@suse.com> Signed-off-by: Miloslav Trmač <mitr@redhat.com>

TomSweeneyRedHat

LGTM

TomSweeneyRedHat · 2024-08-20T14:26:36Z

@mtrmac, this looks good to go now. Can it be merged, and we can move on to #2526?

mtrmac · 2024-08-20T14:56:56Z

@TomSweeneyRedHat I don’t know of any outstanding issues. Care to hit the merge button, then?

TomSweeneyRedHat · 2024-08-20T15:00:10Z

Merged! On to #2526 then.

TomSweeneyRedHat · 2024-08-20T15:00:37Z

/lgtm
just for the record, not sure if needed here.

mtrmac mentioned this pull request Aug 16, 2024

Add field KeyPaths to prSigstoreSigned #2456

Closed

mtrmac force-pushed the sigstore-multi branch from 74ad946 to fc34eb4 Compare August 17, 2024 01:49

mtrmac changed the title ~~WIP: keyPaths, keyDatas, and same for Rekor, in prSigstoreSigned~~ Add keyPaths, keyDatas to prSigstoreSigned Aug 17, 2024

mtrmac force-pushed the sigstore-multi branch from fc34eb4 to 981cf64 Compare August 17, 2024 02:03

mtrmac force-pushed the sigstore-multi branch from 981cf64 to 79d0ed5 Compare August 17, 2024 02:11

mtrmac linked an issue Aug 17, 2024 that may be closed by this pull request

support multiple sigstore keys #2319

Closed

mtrmac added the kind/feature A request for, or a PR adding, new functionality label Aug 17, 2024

mtrmac force-pushed the sigstore-multi branch from 79d0ed5 to a2d451c Compare August 17, 2024 03:23

mtrmac mentioned this pull request Aug 17, 2024

Add support for accepting multiple Rekor public keys #2526

Merged

rhatdan reviewed Aug 19, 2024

View reviewed changes

mtrmac force-pushed the sigstore-multi branch from a2d451c to 71192fa Compare August 19, 2024 15:10

mtrmac marked this pull request as ready for review August 19, 2024 15:10

TomSweeneyRedHat reviewed Aug 19, 2024

View reviewed changes

mtrmac force-pushed the sigstore-multi branch from 71192fa to 092f80a Compare August 19, 2024 18:33

kolyshkin reviewed Aug 19, 2024

View reviewed changes

mtrmac and others added 5 commits August 20, 2024 13:30

Use InvalidPolicyFormatError for invalid sigstore options

4b3806f

Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Turn loadBytesFromDataOrPath into loadBytesFromConfigSources

2157f6b

Use a struct as an input, so that the parameters are named and we minimize risk of inconsistencies, and make it easier to add more sources. Should not change behavior. Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Use loadBytesFromConfigSources in prSignedBy.isSignatureAuthorAccepted

1bc6565

Extend loadBytesFromConfigSources to return multiple values, and to support reading the from files; then share the code. Signed-off-by: Miloslav Trmač <mitr@redhat.com>

Split verifySigstorePayloadBlobSignature from VerifySigstorePayload

ab622de

because we will want to support multiple public keys, and that's easier to do in a separate function. Should not change behavior except for order of error checks. Signed-off-by: Miloslav Trmač <mitr@redhat.com>

mtrmac force-pushed the sigstore-multi branch from 092f80a to 32d9aab Compare August 20, 2024 12:06

TomSweeneyRedHat reviewed Aug 20, 2024

View reviewed changes

TomSweeneyRedHat merged commit e207baa into containers:main Aug 20, 2024

mtrmac deleted the sigstore-multi branch August 20, 2024 15:05

mtrmac mentioned this pull request Aug 20, 2024

Release 5.32.2 #2531

Merged

mtrmac mentioned this pull request Aug 27, 2025

Sigstore technical debt containers/container-libs#235

Open

16 tasks

	func verifySigstorePayloadBlobSignature(publicKey crypto.PublicKey, unverifiedPayload []byte, unverifiedSignature []byte) error {
	func verifySigstorePayloadBlobSignature(publicKey crypto.PublicKey, unverifiedPayload, unverifiedSignature []byte) error {

Conversation

mtrmac commented Aug 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mtrmac commented Aug 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mtrmac commented Aug 17, 2024

Uh oh!

mtrmac commented Aug 17, 2024

Uh oh!

mtrmac commented Aug 19, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rhatdan commented Aug 19, 2024

Uh oh!

TomSweeneyRedHat commented Aug 19, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat commented Aug 19, 2024

Uh oh!

mheon commented Aug 19, 2024

Uh oh!

mtrmac commented Aug 19, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kolyshkin Aug 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kolyshkin Aug 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat left a comment

Choose a reason for hiding this comment

Uh oh!

TomSweeneyRedHat commented Aug 20, 2024

Uh oh!

mtrmac commented Aug 20, 2024

Uh oh!

TomSweeneyRedHat commented Aug 20, 2024

Uh oh!

TomSweeneyRedHat commented Aug 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

mtrmac commented Aug 16, 2024 •

edited

Loading

mtrmac commented Aug 17, 2024 •

edited

Loading

kolyshkin Aug 19, 2024 •

edited

Loading

kolyshkin Aug 19, 2024 •

edited

Loading