* Allow --local-image with --new-bundle-format for v2 signatures
Remove the mutual exclusivity constraint between --local-image and
--new-bundle-format flags in verify and verify-attestation commands.
This enables verification of v2-signed images saved as local OCI layouts
when using cosign v3.
Add HasLocalBundles() function that auto-detects the signature format
by checking for dev.sigstore.cosign/bundle annotations in the local
OCI layout. If no bundles are found (v2 attached signatures), the
verification falls back to v2 mode automatically.
This mirrors the existing auto-detection pattern used for registry-based
verification via GetBundles().
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
* Add tests for local image format auto-detection
Add unit tests for HasLocalBundles() and HasLocalAttestationBundles()
functions covering v2 signatures, v3 bundles, and edge cases.
Add e2e test TestSaveLoadAutoDetectFormat to verify the auto-detection
works correctly for both v2 attached signatures and v3 bundles.
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
* Enable full local verification of v3 sigstore bundles
Add GetLocalBundles() and verifyLocalImageAttestationsSigstoreBundle()
to support verifying v3 bundles directly from local OCI layouts.
Refactors hasLocalSigstoreBundles() to getLocalBundleDescriptors() for
reuse, and updates VerifyLocalImageAttestations() to use the new v3
verification path when NewBundleFormat is true.
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
* Add tests for local v3 bundle verification
Add unit tests for GetLocalBundles() covering valid layouts, missing
blobs, and error cases. Update e2e test to verify v3 bundles directly
from local OCI layout without registry round-trip.
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
---------
Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
Static CT, like Rekor v2, needs the origin string of the log server to
create a verifier, so include it when generating the trusted root.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Reuse the digest obtained from SignedEntity instead of re-resolving it
in subsequent calls to AttestationTag, SignatureTag, SBOMTag, and
Referrers. This eliminates redundant manifest fetches and improves
performance
Signed-off-by: Bob Callaway <bcallaway@google.com>
When signing offline using a key and opting out of Rekor, contents from
the TUF repo are not fetched because they aren't needed. Similarly with
verification, TUF shouldn't be required when no service roots are
needed, which is true when a) a public key is provided, b) Rekor is
skipped via flag, and c) timestamp verification is skipped via a flag.
Note that this affects the old bundle format verification path,
which allows for services to be skipped via flags. When a new bundle
format is provided, users will not be required to include a trusted root
if the above 3 conditions are satisfied.
Fixes#4550
Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
When a client doesn't want to use a default service like Rekor while
still using the public instance, a client would need to retrieve the
signing configuration or trusted root, remove the tlog sections, and
provide that to the sign/verify command. This first step can now be
skipped by using --with-default-services and --no-<service> to omit it
from the configuration file. This will provide a better user experience
while maintaining the unified configuration interface between clients.
Ref: https://github.com/docker/actions-toolkit/issues/901
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Without this change, if an image is signed with `--certificate` and also
using signing config and the new bundle format (the defaults), the logic
routes to sigstore-go signing which does not natively understand signing
with a cert that is not issued by Fulcio. This means that only the
public key is uploaded to the bundle, so the image cannot be verified
using the certificate. This change ensures the certificate is passed
through to the bundle if it is provided with `sign`, `attest`, and
`attest-blob` . The `sign-blob` command does not support
`--certificate`.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
`SigVerifier` is set on `CheckOpts` no matter whether the verifying
material is a public key or a certificate. The `keyBytes` function used
for comparing the verifier object was incorrectly assuming that
`SigVerifier` being non-nil meant that a local certificate was not
present and was returning the certificate's public key instead of the
certificate. This change fixes the function to check for a certificate
before returning the bytes from the public key.
It is also possible to provide a public key as an argument when a
certificate is in the signature bundle. It does not make sense to try to
provide both, but this has been allowed and asserted in
verify_blob_test.go. In this case, the comparer should ensure that the
certificate and public key are related to each other. The alternative is
to disallow providing a key as a command argument when a certificate is
present in the signature, but this could be considered a breaking
change.
This change only applies to verifying images using the old signature
format. For the new bundle format, the certificate verification goes
through a different path.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Deprecate tlog-upload flag
Clients that don't want to use a transparency log should provide a
signing config without tlog service instances rather than use this flag.
This will also throw an error when a client uses this flag when a
signing config will be used, since Cosign/sigstore-go ignores this flag
and we don't want a user to unexpectedly upload to the public instance.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Refactor TR and SC initialization into common method
The one difference between sign/attest and sign/attest-blob is whether a
bundle output flag is present, so the error message has been adjusted.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Fix e2e test, better error message
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Without this change, when the new bundle format is used, annotations
were not being added to the payload, nor were they being checked during
verification, but were still being reported as verified. This also had a
side effect of the annotations not appearing in the verification output.
This change fixes the issue by passing through the annotations to the
statement builder during signing, and using a different in-toto
`Statement` type to parse annotations from the statement during
verification, as well as actually calling the claims verifier.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Use a common options struct for WriteBundle and
WriteNewBundleWithSigningConfig to reduce the number of arguments in
each function.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Without this change, --upload=false was not respected with the new
bundle format. It also would not have made sense because there was no
way to output the bundle locally. This change adds a flag
--bundle so that the bundle can be created on disk without
attaching it to the image, and also passes through the Upload parameter
to bypass uploading it if desired.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
Also updates the registry tests to use TUF so that they can be re-used
for both the legacy format and protobuf bundle format.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
With this change, cosign sign can be run only once when an image
has multiple pull references.
Closes#4330
Signed-off-by: Emily Zheng <yuzheng@redhat.com>
Remove any mention of the `--out` flag from the `cosign initialize`
command, since it's no longer used.
Signed-off-by: Alex Pyrgiotis <apyrgio@gmail.com>
The offline flag is misleading and is a no-op with the new Cosign v3
defaults. The flag's purpose was to prevent a client from falling back
to verifying an artifact's inclusion in Rekor when a proof failed to
verify. Most users thought offline verification forced the client to not
make any network requests - a very reasonable assumption, but with TUF,
network requests are a part of verification if the local TUF metadata
has expired.
I've updated the README as well, though we need to make a far more
comprehensive pass over the documentation since it's out of date given
our new trusted-root/bundle flags.
Fixes#4454
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Deduplicate key/token handling in sign commands
Move the nearly identical code for parsing key options and creating a
key pair and token out of attest, attest-blob, sign, and sign-blob, and
into a common helper package. Move functions that had been shared out of
sign.go into the helper package too so that other commands do not have
to import the sign command package.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Deduplicate signer-verifier creation
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Deduplicate timestamp retrieval
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Deduplicate rekor upload
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Deduplicate bundle compilation
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Move OCI parsing function to signcommon
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Make flag compatibility checking consistent
Move flag checks when --new-bundle-format is used to a common helper
module and have all four verify commands use it. Remove redundant flag
checker code.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Remove duplicate certs setting
RootCerts and IntermediateCerts are already set on CheckOpts during
loadCertsKeylessVerification.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Move loading key to common
Move the setting of SigVerifier based on the key ref, key slot, or cert
and cert chain, to the common file.
For verifying blobs and blob attestations with a certificate instead of
a key, we return the cert which is used directly in the options list for
verification. For images, the cert and cert chain must be validated and
then unpacked into the SigVerifier, where the cosign Verify* functions
check its validity by extracting it from the verifier.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Deduplicate TUF v1 fetch and rekor client setup
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Deduplicate trusted material setting
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Move common functions to common.go
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
---------
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
When calling cosign initialize, the client will cache the trusted root file
if available. This PR adds support for caching the signing config as
well. The public-good instance's TUF repo includes this file. Private
deployments likely don't use this file, so like with the trusted root,
Cosign will print a warning rather than fail initialization.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
The rekor-tiles package is starting at version 2.0. There are no
interface changes with this version change.
Signed-off-by: Colleen Murphy <colleenmurphy@google.com>
* Implement container image context in verify command
* Use conformance on main for now (waiting for new release)
---------
Signed-off-by: Zach Steindler <steiza@github.com>
A signing config is a source of truth for the service URLs. We will
disallow specifying multiple sources of truth for service URLs if the
default values are overridden.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Recording signatures to Rekor v2 can take up to 10 seconds. We want to
avoid someone killing the process while waiting for a response from
Rekor, otherwise the user will have to re-sign the artifact.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Bump sigstore-go, support alternative hash algorithms with keys
sigstore-go now handles non-ECDSA-P-256 signatures with Rekor v2. To
support verification, we also need a way to provide alternative hash
algorithms to the default SHA-256. cosign verify already had a flag for
this, so I added the flag to all verify commands. In the future, when we
are only processing bundles, we can lookup the default hash algorithm
given the key.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* lint fmt
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Drop support for Fulcio with ed25519ph key
We've chosen to not support this in sigstore-go, so we'll also remove
this from Cosign. This is a niche edge case where a user provides an
ed25519 key or algorithm and requests a cert and logs it to Rekor. We'll
revisit this if there's demand or when we support the prehash variant in
Fulcio.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Co-authored-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Add support for SigningConfig in sign/attest
This will indirectly add support for signing with Rekor v2, since
signing will be handled by sigstore-go rather than Cosign.
This also brings sign/attest up to par with sign-blob/attest-blob with
respect to signing with a key and providing a trusted root when
providing a signing config.
This feature is gated behind one of two signing config flags, which in a
later version of Cosign will be flipped to on by default.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Address review comments
--signing-config and --use-signing-config are now mutually exclusive.
TrustedMaterial and SigningConfig are set in the same line as fetching
the trusted root and signing config.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Support self-managed keys when signing with sigstore-go
This creates a wrapper around the Keypair interface when a
SignerVerifier is provided for signing with KMS or any other provided
keys. This also retains support for --issue-certificate to request a
certificate for a managed key.
Fixes#4327
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Add issue-certificate flags to attest and attest-blob
This is for uniformity with sign/sign-blob.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Refactor SignerFromKeyOpts to split Fulcio signer into its own method
Now, we can generate a SignerVerifier from a provided key without
mandating that we also request a Fulcio certificate when
"issue-certificate" is provided.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Use default options to load key material
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
---------
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
Use sigstore/sigstore signature.LoadSignerVerifierFromPrivateKey to load default verifiers given a private key.
Signed-off-by: Riccardo Schirone <riccardo.schirone@trailofbits.com>
When developing locally, with the e2e build tag set, there's an import
cycle. test/helpers.go imports "cmd/cosign/cli/verify", which imports
"test" in test files in the verify package. This change breaks the
import cycle by moving certificate utilities to an internal test
directory.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
The signing config will now be provided on the sign path to test Rekor
v2, along with the trusted root for verifying bundles on the sign path.
This also adds support for providing a trusted root with
sign-blob/attest-blob. Currently, you can either provide just the CT log
key or we'll fetch the trusted root from the initialized TUF repo. Since
we are providing the trusted root for staging during signing now, this
PR also lets the user provide the trusted root they'll use for verifying
during signing.
Signed-off-by: Hayden <8418760+haydentherapper@users.noreply.github.com>
* Fixes to cosign sign / verify for the new bundle format
Signed-off-by: Zach Steindler <steiza@github.com>
* Update function signature to pass crypto.PublicKey directly
Signed-off-by: Zach Steindler <steiza@github.com>
---------
Signed-off-by: Zach Steindler <steiza@github.com>
Previously, when --check-claims was set to false and a bundle in the new
format was provided, we'd still try to check the in-toto subject digest
and algorithm. These values weren't being set since they were
conditioned on checking claims. Now, we skip digest verification if
check-claims is false with a new bundle.
Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
This introduces a new command `cosign signing-config create` to generate
a SigningConfig message. This will first be used by our testing
infrastructure to create a SigningConfig, and then by users adopting the
bundle format in Cosign v2 and eventually as a requirement for v3 when
signing with private deployments.
Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
This provides the same API as in the new `cosign signing-config create`
command from #4280. To avoid this being a breaking change, the previous
flags will still be supported, but will be removed in Cosign v3.
Fixes#4282
Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
