Skip to content

Commit e3ec47b

Browse files
javanlacerdawoodruffw
javanlacerda
and
woodruffw
authored
Key management improvement (#936)
* refactor: concentrate keys on trusted root refactors and adding trusted_root to Verifier and SigningContext move purpose from rekor client to trusted_root Signed-off-by: Javan lacerda <javanlacerda@google.com> * moving keyring logic to trustroot module Signed-off-by: Javan lacerda <javanlacerda@google.com> * move ct keyring responsibilities to trustedroot Signed-off-by: Javan lacerda <javanlacerda@google.com> * adding args checker for ct keys Signed-off-by: Javan lacerda <javanlacerda@google.com> * removing keys from rekor client Signed-off-by: Javan lacerda <javanlacerda@google.com> * passing args and purpose to trusted root directly Signed-off-by: Javan lacerda <javanlacerda@google.com> * removing certificate_chain and rekor-root-pubkey from CLI Signed-off-by: Javan lacerda <javanlacerda@google.com> * fixing change log Signed-off-by: Javan lacerda <javanlacerda@google.com> * Update CHANGELOG.md Co-authored-by: William Woodruff <william@yossarian.net> Signed-off-by: Javan Lacerda <javanlacerda@google.com> * removing ctfe from CLI Signed-off-by: Javan lacerda <javanlacerda@google.com> * conform readme to helper Signed-off-by: Javan lacerda <javanlacerda@google.com> * removing comment Signed-off-by: Javan lacerda <javanlacerda@google.com> --------- Signed-off-by: Javan lacerda <javanlacerda@google.com> Signed-off-by: Javan Lacerda <javanlacerda@google.com> Co-authored-by: William Woodruff <william@yossarian.net>
1 parent b32ad1b commit e3ec47b

File tree

16 files changed

+289
-422
lines changed

16 files changed

+289
-422
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,10 @@ This is a corrective release for [2.1.1].
363363
replacing the material that was previously baked into `sigstore._store`
364364
([#351](https://github.com/sigstore/sigstore-python/pull/351))
365365

366+
### Removed
367+
* CLI: The `--certificate-chain`, `--rekor-root-pubkey` and `-ctfe` flags have been entirely removed ([#936](https://github.com/sigstore/sigstore-python/pull/936))
368+
369+
366370
<!--Release URLs -->
367371
[Unreleased]: https://github.com/sigstore/sigstore-python/compare/v2.1.2...HEAD
368372
[2.1.2]: https://github.com/sigstore/sigstore-python/compare/v2.1.1...v2.1.2

‎README.md‎

Lines changed: 18 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -96,33 +96,29 @@ Top-level:
9696

9797
<!-- @begin-sigstore-help@ -->
9898
```
99-
usage: sigstore [-h] [-v] [-V] [--staging] [--rekor-url URL]
100-
[--rekor-root-pubkey FILE]
101-
COMMAND ...
99+
usage: sigstore [-h] [-v] [-V] [--staging] [--rekor-url URL] COMMAND ...
102100

103101
a tool for signing and verifying Python package distributions
104102

105103
positional arguments:
106-
COMMAND the operation to perform
107-
sign sign one or more inputs
108-
verify verify one or more inputs
109-
get-identity-token retrieve and return a Sigstore-compatible OpenID
110-
Connect token
104+
COMMAND the operation to perform
105+
sign sign one or more inputs
106+
verify verify one or more inputs
107+
get-identity-token
108+
retrieve and return a Sigstore-compatible OpenID Connect
109+
token
111110

112111
optional arguments:
113-
-h, --help show this help message and exit
114-
-v, --verbose run with additional debug logging; supply multiple
115-
times to increase verbosity
116-
-V, --version show program's version number and exit
112+
-h, --help show this help message and exit
113+
-v, --verbose run with additional debug logging; supply multiple times
114+
to increase verbosity
115+
-V, --version show program's version number and exit
117116

118117
Sigstore instance options:
119-
--staging Use sigstore's staging instances, instead of the
120-
default production instances (default: False)
121-
--rekor-url URL The Rekor instance to use (conflicts with --staging)
122-
(default: https://rekor.sigstore.dev)
123-
--rekor-root-pubkey FILE
124-
A PEM-encoded root public key for Rekor itself
125-
(conflicts with --staging) (default: None)
118+
--staging Use sigstore's staging instances, instead of the default
119+
production instances (default: False)
120+
--rekor-url URL The Rekor instance to use (conflicts with --staging)
121+
(default: https://rekor.sigstore.dev)
126122
```
127123
<!-- @end-sigstore-help@ -->
128124
@@ -137,8 +133,7 @@ usage: sigstore sign [-h] [-v] [--identity-token TOKEN] [--oidc-client-id ID]
137133
[--oauth-force-oob] [--no-default-files]
138134
[--signature FILE] [--certificate FILE] [--bundle FILE]
139135
[--output-directory DIR] [--overwrite] [--staging]
140-
[--rekor-url URL] [--rekor-root-pubkey FILE]
141-
[--fulcio-url URL] [--ctfe FILE]
136+
[--rekor-url URL] [--fulcio-url URL]
142137
FILE [FILE ...]
143138

144139
positional arguments:
@@ -193,15 +188,8 @@ Sigstore instance options:
193188
This option will be deprecated in favor of the global
194189
`--rekor-url` option in a future release. (default:
195190
None)
196-
--rekor-root-pubkey FILE
197-
A PEM-encoded root public key for Rekor itself
198-
(conflicts with --staging). This option will be
199-
deprecated in favor of the global `--rekor-root-
200-
pubkey` option in a future release. (default: None)
201191
--fulcio-url URL The Fulcio instance to use (conflicts with --staging)
202192
(default: https://fulcio.sigstore.dev)
203-
--ctfe FILE A PEM-encoded public key for the CT log (conflicts
204-
with --staging) (default: None)
205193
```
206194
<!-- @end-sigstore-sign-help@ -->
207195
@@ -220,8 +208,7 @@ usage: sigstore verify identity [-h] [-v] [--certificate FILE]
220208
[--signature FILE] [--bundle FILE]
221209
--cert-identity IDENTITY [--offline]
222210
--cert-oidc-issuer URL [--staging]
223-
[--rekor-url URL] [--rekor-root-pubkey FILE]
224-
[--certificate-chain FILE]
211+
[--rekor-url URL]
225212
FILE [FILE ...]
226213

227214
optional arguments:
@@ -258,15 +245,6 @@ Sigstore instance options:
258245
This option will be deprecated in favor of the global
259246
`--rekor-url` option in a future release. (default:
260247
None)
261-
--rekor-root-pubkey FILE
262-
A PEM-encoded root public key for Rekor itself
263-
(conflicts with --staging). This option will be
264-
deprecated in favor of the global `--rekor-root-
265-
pubkey` option in a future release. (default: None)
266-
--certificate-chain FILE
267-
Path to a list of CA certificates in PEM format which
268-
will be needed when building the certificate chain for
269-
the Fulcio signing certificate (default: None)
270248
```
271249
<!-- @end-sigstore-verify-identity-help@ -->
272250
@@ -284,8 +262,7 @@ usage: sigstore verify github [-h] [-v] [--certificate FILE]
284262
--cert-identity IDENTITY [--offline]
285263
[--trigger EVENT] [--sha SHA] [--name NAME]
286264
[--repository REPO] [--ref REF] [--staging]
287-
[--rekor-url URL] [--rekor-root-pubkey FILE]
288-
[--certificate-chain FILE]
265+
[--rekor-url URL]
289266
FILE [FILE ...]
290267

291268
optional arguments:
@@ -329,15 +306,6 @@ Sigstore instance options:
329306
This option will be deprecated in favor of the global
330307
`--rekor-url` option in a future release. (default:
331308
None)
332-
--rekor-root-pubkey FILE
333-
A PEM-encoded root public key for Rekor itself
334-
(conflicts with --staging). This option will be
335-
deprecated in favor of the global `--rekor-root-
336-
pubkey` option in a future release. (default: None)
337-
--certificate-chain FILE
338-
Path to a list of CA certificates in PEM format which
339-
will be needed when building the certificate chain for
340-
the Fulcio signing certificate (default: None)
341309
```
342310
<!-- @end-sigstore-verify-github-help@ -->
343311

‎sigstore/_cli.py‎

Lines changed: 6 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -23,24 +23,20 @@
2323
from textwrap import dedent
2424
from typing import NoReturn, Optional, TextIO, Union, cast
2525

26-
from cryptography.x509 import load_pem_x509_certificates
2726
from rich.logging import RichHandler
2827
from sigstore_protobuf_specs.dev.sigstore.bundle.v1 import Bundle
2928

3029
from sigstore import __version__
31-
from sigstore._internal.ctfe import CTKeyring
3230
from sigstore._internal.fulcio.client import (
3331
DEFAULT_FULCIO_URL,
3432
ExpiredCertificate,
3533
FulcioClient,
3634
)
37-
from sigstore._internal.keyring import Keyring
3835
from sigstore._internal.rekor.client import (
3936
DEFAULT_REKOR_URL,
4037
RekorClient,
41-
RekorKeyring,
4238
)
43-
from sigstore._internal.trustroot import TrustedRoot
39+
from sigstore._internal.trustroot import KeyringPurpose, TrustedRoot
4440
from sigstore._utils import PEMCert, cert_der_to_pem, sha256_digest
4541
from sigstore.errors import Error
4642
from sigstore.oidc import (
@@ -128,18 +124,6 @@ def _add_shared_instance_options(group: argparse._ArgumentGroup) -> None:
128124
"in a future release."
129125
),
130126
)
131-
group.add_argument(
132-
"--rekor-root-pubkey",
133-
dest="__deprecated_rekor_root_pubkey",
134-
metavar="FILE",
135-
type=argparse.FileType("rb"),
136-
default=None,
137-
help=(
138-
"A PEM-encoded root public key for Rekor itself (conflicts with --staging). "
139-
"This option will be deprecated in favor of the global `--rekor-root-pubkey` option "
140-
"in a future release."
141-
),
142-
)
143127

144128

145129
def _add_shared_verify_input_options(group: argparse._ArgumentGroup) -> None:
@@ -270,13 +254,6 @@ def _parser() -> argparse.ArgumentParser:
270254
default=os.getenv("SIGSTORE_REKOR_URL", DEFAULT_REKOR_URL),
271255
help="The Rekor instance to use (conflicts with --staging)",
272256
)
273-
global_instance_options.add_argument(
274-
"--rekor-root-pubkey",
275-
metavar="FILE",
276-
type=argparse.FileType("rb"),
277-
help="A PEM-encoded root public key for Rekor itself (conflicts with --staging)",
278-
default=os.getenv("SIGSTORE_REKOR_ROOT_PUBKEY"),
279-
)
280257

281258
subcommands = parser.add_subparsers(
282259
required=True,
@@ -366,14 +343,6 @@ def _parser() -> argparse.ArgumentParser:
366343
default=os.getenv("SIGSTORE_FULCIO_URL", DEFAULT_FULCIO_URL),
367344
help="The Fulcio instance to use (conflicts with --staging)",
368345
)
369-
instance_options.add_argument(
370-
"--ctfe",
371-
dest="ctfe_pem",
372-
metavar="FILE",
373-
type=argparse.FileType("rb"),
374-
help="A PEM-encoded public key for the CT log (conflicts with --staging)",
375-
default=os.getenv("SIGSTORE_CTFE"),
376-
)
377346

378347
sign.add_argument(
379348
"files",
@@ -420,15 +389,6 @@ def _parser() -> argparse.ArgumentParser:
420389

421390
instance_options = verify_identity.add_argument_group("Sigstore instance options")
422391
_add_shared_instance_options(instance_options)
423-
instance_options.add_argument(
424-
"--certificate-chain",
425-
metavar="FILE",
426-
type=argparse.FileType("rb"),
427-
help=(
428-
"Path to a list of CA certificates in PEM format which will be needed when building "
429-
"the certificate chain for the Fulcio signing certificate"
430-
),
431-
)
432392

433393
# `sigstore verify github`
434394
verify_github = verify_subcommand.add_parser(
@@ -486,15 +446,6 @@ def _parser() -> argparse.ArgumentParser:
486446

487447
instance_options = verify_github.add_argument_group("Sigstore instance options")
488448
_add_shared_instance_options(instance_options)
489-
instance_options.add_argument(
490-
"--certificate-chain",
491-
metavar="FILE",
492-
type=argparse.FileType("rb"),
493-
help=(
494-
"Path to a list of CA certificates in PEM format which will be needed when building "
495-
"the certificate chain for the Fulcio signing certificate"
496-
),
497-
)
498449

499450
# `sigstore get-identity-token`
500451
get_identity_token = subcommands.add_parser(
@@ -536,13 +487,6 @@ def main() -> None:
536487
"Passing `--rekor-url` as a subcommand option will be deprecated in a future release."
537488
)
538489
args.rekor_url = args.__deprecated_rekor_url
539-
if getattr(args, "__deprecated_rekor_root_pubkey", None):
540-
logger.warning(
541-
"`--rekor-root-pubkey` should be used as a global option, rather than a "
542-
"subcommand option. Passing `--rekor-root-pubkey` as a subcommand option will be "
543-
"deprecated in a future release."
544-
)
545-
args.rekor_root_pubkey = args.__deprecated_rekor_root_pubkey
546490

547491
# Stuff the parser back into our namespace, so that we can use it for
548492
# error handling later.
@@ -651,22 +595,12 @@ def _sign(args: argparse.Namespace) -> None:
651595
signing_ctx = SigningContext.production()
652596
else:
653597
# Assume "production" trust root if no keys are given as arguments
654-
trusted_root = TrustedRoot.production()
655-
if args.ctfe_pem is not None:
656-
ctfe_keys = [args.ctfe_pem.read()]
657-
else:
658-
ctfe_keys = trusted_root.get_ctfe_keys()
659-
if args.rekor_root_pubkey is not None:
660-
rekor_keys = [args.rekor_root_pubkey.read()]
661-
else:
662-
rekor_keys = trusted_root.get_rekor_keys()
663-
664-
ct_keyring = CTKeyring(Keyring(ctfe_keys))
665-
rekor_keyring = RekorKeyring(Keyring(rekor_keys))
598+
trusted_root = TrustedRoot.production(purpose=KeyringPurpose.SIGN)
666599

667600
signing_ctx = SigningContext(
668601
fulcio=FulcioClient(args.fulcio_url),
669-
rekor=RekorClient(args.rekor_url, rekor_keyring, ct_keyring),
602+
rekor=RekorClient(args.rekor_url),
603+
trusted_root=trusted_root,
670604
)
671605

672606
# The order of precedence for identities is as follows:
@@ -814,37 +748,18 @@ def _collect_verification_state(
814748
args,
815749
f"Missing verification materials for {(file)}: {', '.join(missing)}",
816750
)
817-
818751
if args.staging:
819752
logger.debug("verify: staging instances requested")
820753
verifier = Verifier.staging()
821754
elif args.rekor_url == DEFAULT_REKOR_URL:
822755
verifier = Verifier.production()
823756
else:
824-
if not args.certificate_chain:
825-
_die(args, "Custom Rekor URL used without specifying --certificate-chain")
826-
827-
try:
828-
certificate_chain = load_pem_x509_certificates(
829-
args.certificate_chain.read()
830-
)
831-
except ValueError as error:
832-
_die(args, f"Invalid certificate chain: {error}")
833-
834-
if args.rekor_root_pubkey is not None:
835-
rekor_keys = [args.rekor_root_pubkey.read()]
836-
else:
837-
trusted_root = TrustedRoot.production()
838-
rekor_keys = trusted_root.get_rekor_keys()
839-
ct_keys = trusted_root.get_ctfe_keys()
840-
757+
trusted_root = TrustedRoot.production(purpose=KeyringPurpose.VERIFY)
841758
verifier = Verifier(
842759
rekor=RekorClient(
843760
url=args.rekor_url,
844-
rekor_keyring=RekorKeyring(Keyring(rekor_keys)),
845-
ct_keyring=CTKeyring(Keyring(ct_keys)),
846761
),
847-
fulcio_certificate_chain=certificate_chain,
762+
trusted_root=trusted_root,
848763
)
849764

850765
all_materials = []

‎sigstore/_internal/ctfe.py‎

Lines changed: 0 additions & 23 deletions
This file was deleted.

0 commit comments

Comments
 (0)