added getRekorPubKey options

Author: hackeramitkumar

cosign

@@ -5,23 +5,17 @@ import (
 	"crypto"
 	"encoding/json"
 	"fmt"
+	"io/ioutil"
 
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/sigstore/cosign/v2/pkg/cosign"
 	"github.com/sigstore/cosign/v2/pkg/oci"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"
-	"github.com/sigstore/sigstore/pkg/signature/payload"
-)
-
-var (
-	pub_key = `-----BEGIN PUBLIC KEY-----
-	MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjUlDDji3rnrJpceDaw/fRo5ZGhbJ
-	ehPAoLSiNJSNRU7AZV+srW6k+1ITu0NVMmwUqL/83Ug0etoSaCiW71b9Hg==
-	-----END PUBLIC KEY-----`
 )
 
+/*
 // Will be used for fetching extra information
 func extractPayload(verified []oci.Signature) ([]payload.SimpleContainerImage, error) {
 	var sigPayloads []payload.SimpleContainerImage
@@ -34,6 +28,7 @@ func extractPayload(verified []oci.Signature) ([]payload.SimpleContainerImage, e
 	}
 	return sigPayloads, nil
 }
+*/
 
 func decodePEM(raw []byte, signatureAlgorithm crypto.Hash) (signature.Verifier, error) {
 	// PEM encoded file.
@@ -45,64 +40,107 @@ func decodePEM(raw []byte, signatureAlgorithm crypto.Hash) (signature.Verifier,
 }
 
 func verifyImageSignatures_util(ctx context.Context, ref name.Reference) ([]oci.Signature, error) {
+	filePath := "cosign.pub"
+	data, err := ioutil.ReadFile(filePath)
+	if err != nil {
+		fmt.Println("Error reading file:", err)
+		panic(err)
+	}
 
-	verifier, err := decodePEM([]byte(pub_key), crypto.SHA256)
+	// Convert the data to a byte slice ([]byte)
+	byteData := []byte(data)
+	verifier, err := decodePEM(byteData, crypto.SHA256)
 	if err != nil {
 		fmt.Println("Error occured during the fetching of verifier;")
 		panic(err)
 	}
 
+	trustedTransparencyLogPubKeys, err := cosign.GetRekorPubs(ctx)
+	if err != nil {
+		fmt.Println("Error occured during the getting rekor pubs keys...")
+	}
+	fmt.Println("Rekor keys are : ", trustedTransparencyLogPubKeys.Keys)
+	// rekor_client := cosign.Get(ctx)
 	cosignVeriOptions := cosign.CheckOpts{
 		SigVerifier: verifier,
+		// RekorClient: rekor_client,
+		RekorPubKeys: trustedTransparencyLogPubKeys,
 	}
 
-	fmt.Println("Public Key", verifier.PublicKey)
-	fmt.Println("Verify signature : ", verifier.VerifySignature)
-	fmt.Println("Sig.Verifier", verifier)
+	/*
+		fmt.Println("Public Key", verifier.PublicKey)
+		fmt.Println("Verify signature : ", verifier.VerifySignature)
+		fmt.Println("Sig.Verifier", verifier)
+	*/
 
 	verified_signatures, isVerified, err := cosign.VerifyImageSignatures(ctx, ref, &cosignVeriOptions)
-	fmt.Println("-------------------------Signature verification in Progress ---------------------------")
+	fmt.Println("-----------------------------Signature verification in Progress -------------------------------")
 	if err != nil {
 		fmt.Println("No signature matched : ")
-		panic(err)
 	}
 
 	if !isVerified {
-		panic("-------------Verification failed --------------------")
+		fmt.Println("---------------------------------Verification failed ----------------------------------------")
 	}
+	fmt.Println("")
 
-	fmt.Println("------------------------- Signature verification completed  ---------------------------")
+	fmt.Println("---------------------------- Signature verification completed  ----------------------------------")
 	return verified_signatures, err
 
 }
 
 func fetchArtifacts(ref name.Reference) error {
 	desc, err := remote.Get(ref)
 	if err != nil {
-		fmt.Errorf("Got some error", err)
-		return err
+		panic(err)
 	}
 
 	byteStream, err := json.Marshal(desc.Descriptor)
+	if err != nil {
+		fmt.Println("error during the marshaling of descriptor")
+		panic(err)
+	}
 	jsonString := string(byteStream)
 	fmt.Println(jsonString)
+
+	img, err := remote.Image(ref)
+	if err != nil {
+		panic(err)
+	}
+	manifest, err := img.Manifest()
+	if err != nil {
+		panic(err)
+	}
+	byteStream3, err := json.Marshal(manifest)
+	if err != nil {
+		panic(err)
+	}
+	jsonString3 := string(byteStream3)
+	fmt.Println("manifest :", jsonString3)
+
 	return nil
 }
 
 func cosign2() {
-	image := "ghcr.io/hackeramitkumar/kubeji2:latest"
+	image := "ghcr.io/hackeramitkumar/tetsing_cosign/kubeji:latest"
 	ref, err := name.ParseReference(image)
 	if err != nil {
 		panic(err)
 	}
 
-	fmt.Println("--------------------------------Image refrence information : ----------------------------------")
+	fmt.Println("--------------------------------  Image refrence information : ------------------------------")
 	fmt.Println("Registry : ", ref.Context().RegistryStr())
 	fmt.Println("Repository : ", ref.Context().RepositoryStr())
 	fmt.Println("Identifier : ", ref.Identifier())
 
-	fmt.Printf("------------------------Fetching the signedPayload for : ", image)
-	fmt.Println("---------------------------------------------")
+	fmt.Println("\n")
+	fmt.Println("------------------------------------------Artifacts--------------------------------------------")
+	fetchArtifacts(ref)
+	fmt.Println()
+
+	fmt.Print("-----------------  Fetching the signedPayload for : ", image)
+	fmt.Println("-------------------")
+	fmt.Println("\n")
 
 	ctx := context.Background()
 	signedPayloads, err := cosign.FetchSignaturesForReference(ctx, ref)
@@ -111,12 +149,13 @@ func cosign2() {
 		panic(err)
 	}
 
-	fmt.Println("------------------------------------- Fetched all the signedPayloads --------------------------------------")
+	fmt.Println("------------------------------------  Fetched all the signedPayloads ----------------------------")
 	fmt.Println()
 
 	for _, Payload := range signedPayloads {
-		fmt.Println("------------------------------------- Signed Payload  ------------------------------------------")
-		fmt.Println("\n \n----------------------------------- Signed Payload Bundle  ---------------------------------")
+		fmt.Println("------------------------------------- Signed Payload Content --------------------------------")
+		fmt.Println("")
+		fmt.Println("--------------------------------------Signed Payload Bundle  ----------------------------------")
 
 		byteStream, err := json.Marshal(Payload.Bundle)
 		if err != nil {
@@ -125,46 +164,41 @@ func cosign2() {
 		}
 		jsonString := string(byteStream)
 		fmt.Println(jsonString)
-		fmt.Printf("---------------------------------  Signature for Payload :  --------------------------------------:\n ")
+		fmt.Println("")
+
+		fmt.Println("--------------------------------------Signature for Payload -----------------------------------")
 		fmt.Println(Payload.Base64Signature)
-		fmt.Printf("--------------------------------- Certificate for the Payload : -----------------------------------------: \n")
+		fmt.Println("")
+
+		fmt.Println("-----------------------------------Certificate for the Payload---------------------------------")
 		byteStream2, err := json.Marshal(Payload.Cert)
-		// sigVer, err := cosign.ValidateAndUnpackCert(Payload.Cert)
 
 		if err != nil {
 			fmt.Println("Error marshaling JSON:", err)
 			return
 		}
 		jsonString2 := string(byteStream2)
 		fmt.Println(jsonString2)
-
-		// verification by using the certificate
-
 	}
 
-	fmt.Println("----------------------Artifacts----------------------------------")
-	fetchArtifacts(ref)
-
-	img, err := remote.Image(ref)
-	manifest, err := img.Manifest()
-	byteStream3, err := json.Marshal(manifest)
-	jsonString3 := string(byteStream3)
-	fmt.Println("manifest :", jsonString3)
-
-	fmt.Println("------------------------------------Signature verification --------------------------------------------")
-
-	buffer_key := []byte(pub_key)
-	fmt.Println()
-
-	stringstr4 := string(buffer_key)
-	fmt.Println("The public key is : ", stringstr4)
+	fmt.Println("\n")
+	fmt.Println("-------------------------------------Signature verification --------------------------------------")
+	fmt.Println("")
 
 	verified_signatures, err := verifyImageSignatures_util(ctx, ref)
-	fmt.Println("List of the verified signatures ----------------::::::")
+	if err != nil {
+		panic(err)
+	}
+	fmt.Println("")
+	fmt.Println("--------------------------------List of the verified signatures ----------------------------------")
 	for _, sig := range verified_signatures {
-		fmt.Println(sig.Base64Signature)
+		// temp, err := json.Marshal()
+		// if err != nil {
+		// 	fmt.Println("Error occured during the conversion : ", err)
+		// }
+		// tempstr := string(temp)
+		fmt.Println(sig.Base64Signature())
 	}
-
 }
 
 func main() {

cosign.go

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjUlDDji3rnrJpceDaw/fRo5ZGhbJ
+ehPAoLSiNJSNRU7AZV+srW6k+1ITu0NVMmwUqL/83Ug0etoSaCiW71b9Hg==
+-----END PUBLIC KEY-----

cosign.pub

@@ -1,9 +1,9 @@
 package main
 
-// import (
-// 	"testing"
-// )
+import (
+	"testing"
+)
 
-// func Test_Cosign2(t *testing.T) {
-// 	cosign2()
-// }
+func Test_Cosign2(t *testing.T) {
+	cosign2()
+}