Skip to content

Commit 5a75aab

Browse files
hackeramitkumarhackeramitkumar
committed
added keyless
1 parent ed7ddbb commit 5a75aab

File tree

4 files changed

+176
-99
lines changed

4 files changed

+176
-99
lines changed

‎cosign‎

819 Bytes
Binary file not shown.

‎cosign.go‎

Lines changed: 140 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ package main
33
import (
44
"context"
55
"crypto"
6+
"crypto/x509"
7+
"encoding/base64"
68
"encoding/json"
79
"fmt"
810
"io/ioutil"
@@ -15,21 +17,6 @@ import (
1517
"github.com/sigstore/sigstore/pkg/signature"
1618
)
1719

18-
/*
19-
// Will be used for fetching extra information
20-
func extractPayload(verified []oci.Signature) ([]payload.SimpleContainerImage, error) {
21-
var sigPayloads []payload.SimpleContainerImage
22-
for _, sig := range verified {
23-
if sig != nil {
24-
fmt.Println(sig)
25-
sci := payload.SimpleContainerImage{}
26-
sigPayloads = append(sigPayloads, sci)
27-
}
28-
}
29-
return sigPayloads, nil
30-
}
31-
*/
32-
3320
func decodePEM(raw []byte, signatureAlgorithm crypto.Hash) (signature.Verifier, error) {
3421
// PEM encoded file.
3522
pubKey, err := cryptoutils.UnmarshalPEMToPublicKey(raw)
@@ -71,95 +58,25 @@ func fetchArtifacts(ref name.Reference) error {
7158
return nil
7259
}
7360

74-
func cosign2() {
75-
// regstry := os.Getenv("REGISTRY")
76-
// repo := os.Getenv("REPOSITORY")
77-
// identity := os.Getenv("DIGEST")
78-
// image := regstry + "/" + repo + "@" + identity
79-
// image := os.Getenv("IMAGE_URI")
80-
// fmt.Println(image)
81-
image := "ghcr.io/hackeramitkumar/kubeji2:latest"
82-
ref, err := name.ParseReference(image)
83-
if err != nil {
84-
panic(err)
85-
}
86-
87-
fmt.Println("-------------------------------- Image refrence information : ------------------------------")
88-
fmt.Println("Registry : ", ref.Context().RegistryStr())
89-
fmt.Println("Repository : ", ref.Context().RepositoryStr())
90-
fmt.Println("Identifier : ", ref.Identifier())
91-
92-
fmt.Println("")
93-
fmt.Println("")
94-
fmt.Println("------------------------------------------Artifacts--------------------------------------------")
95-
fetchArtifacts(ref)
96-
fmt.Println()
97-
98-
fmt.Print("----------------- Fetching the signedPayload for : ", image)
99-
fmt.Println("-------------------")
100-
fmt.Println("")
101-
fmt.Println("")
102-
103-
ctx := context.Background()
104-
signedPayloads, err := cosign.FetchSignaturesForReference(ctx, ref)
61+
func loadCert(pem []byte) (*x509.Certificate, error) {
62+
var out []byte
63+
out, err := base64.StdEncoding.DecodeString(string(pem))
10564
if err != nil {
106-
fmt.Println("Error During signedPayloads Fetcheing ")
107-
panic(err)
108-
}
109-
110-
fmt.Println("------------------------------------ Fetched all the signedPayloads ----------------------------")
111-
fmt.Println()
112-
113-
for _, Payload := range signedPayloads {
114-
fmt.Println("------------------------------------- Signed Payload Content --------------------------------")
115-
fmt.Println("")
116-
fmt.Println("--------------------------------------Signed Payload Bundle ----------------------------------")
117-
118-
byteStream, err := json.Marshal(Payload.Bundle)
119-
if err != nil {
120-
fmt.Println("Error marshaling JSON:", err)
121-
return
122-
}
123-
jsonString := string(byteStream)
124-
fmt.Println(jsonString)
125-
fmt.Println("")
126-
127-
fmt.Println("--------------------------------------Signature for Payload -----------------------------------")
128-
fmt.Println(Payload.Base64Signature)
129-
fmt.Println("")
130-
131-
fmt.Println("-----------------------------------Certificate for the Payload---------------------------------")
132-
byteStream2, err := json.Marshal(Payload.Cert)
133-
134-
if err != nil {
135-
fmt.Println("Error marshaling JSON:", err)
136-
return
137-
}
138-
jsonString2 := string(byteStream2)
139-
fmt.Println(jsonString2)
65+
// not a base64
66+
out = pem
14067
}
14168

142-
fmt.Println("")
143-
fmt.Println("")
144-
fmt.Println("-------------------------------------Signature verification --------------------------------------")
145-
fmt.Println("")
146-
147-
verified_signatures, err := verifyImageSignatures_util(ctx, ref)
69+
certs, err := cryptoutils.UnmarshalCertificatesFromPEM(out)
14870
if err != nil {
149-
panic(err)
71+
return nil, fmt.Errorf("failed to unmarshal certificate from PEM format: %w", err)
15072
}
151-
fmt.Println("")
152-
fmt.Println("--------------------------------List of the verified signatures ----------------------------------")
153-
for _, sig := range verified_signatures {
154-
fmt.Println(sig.Base64Signature())
73+
if len(certs) == 0 {
74+
return nil, fmt.Errorf("no certs found in pem file")
15575
}
76+
return certs[0], nil
15677
}
15778

158-
func main() {
159-
cosign2()
160-
}
161-
162-
func verifyImageSignatures_util(ctx context.Context, ref name.Reference) ([]oci.Signature, error) {
79+
func keyed_signatureVerification(ctx context.Context, ref name.Reference) ([]oci.Signature, error) {
16380
filePath := "cosign.pub"
16481
data, err := ioutil.ReadFile(filePath)
16582
if err != nil {
@@ -224,12 +141,34 @@ func keyless_sigantureVerification(ctx context.Context, ref name.Reference) ([]o
224141
}
225142
fmt.Println("Rekor keys are : ", trustedTransparencyLogPubKeys.Keys)
226143

144+
filePath := "demo.txt"
145+
data, err := ioutil.ReadFile(filePath)
146+
if err != nil {
147+
fmt.Println("Error reading file:", err)
148+
panic(err)
149+
}
150+
151+
// Convert the data to a byte slice ([]byte)
152+
byteData := []byte(data)
153+
cert, err := loadCert(byteData)
154+
if err != nil {
155+
fmt.Println(err)
156+
}
157+
fmt.Println(string(byteData))
158+
159+
verifier2, err := signature.LoadVerifier(cert.PublicKey, crypto.SHA256)
160+
if err != nil {
161+
return nil, fmt.Errorf("failed to load signature from certificate: %w", err)
162+
}
163+
227164
cosignVeriOptions := cosign.CheckOpts{
228-
Identities: identities,
229-
// RekorClient: rekor_client,
165+
Identities: identities,
230166
RekorPubKeys: trustedTransparencyLogPubKeys,
167+
SigVerifier: verifier2,
231168
}
232169

170+
fmt.Println("Started the verification")
171+
233172
verified_signatures, isVerified, err := cosign.VerifyImageSignatures(ctx, ref, &cosignVeriOptions)
234173
fmt.Println("-----------------------------Signature verification in Progress -------------------------------")
235174
if err != nil {
@@ -239,9 +178,111 @@ func keyless_sigantureVerification(ctx context.Context, ref name.Reference) ([]o
239178
if !isVerified {
240179
fmt.Println("---------------------------------Verification failed ----------------------------------------")
241180
}
242-
fmt.Println("")
243181

182+
fmt.Println("")
244183
fmt.Println("---------------------------- Signature verification completed ----------------------------------")
245184
return verified_signatures, err
246185

247186
}
187+
188+
func cosign2() {
189+
// regstry := os.Getenv("REGISTRY")
190+
// repo := os.Getenv("REPOSITORY")
191+
// identity := os.Getenv("DIGEST")
192+
// image := regstry + "/" + repo + "@" + identity
193+
// image := os.Getenv("IMAGE_URI")
194+
// fmt.Println(image)
195+
image := "ghcr.io/hackeramitkumar/client:unverified"
196+
ref, err := name.ParseReference(image)
197+
if err != nil {
198+
panic(err)
199+
}
200+
201+
fmt.Println("-------------------------------- Image refrence information : ------------------------------")
202+
fmt.Println("Registry : ", ref.Context().RegistryStr())
203+
fmt.Println("Repository : ", ref.Context().RepositoryStr())
204+
fmt.Println("Identifier : ", ref.Identifier())
205+
206+
fmt.Println("")
207+
fmt.Println("")
208+
fmt.Println("------------------------------------------Artifacts--------------------------------------------")
209+
fetchArtifacts(ref)
210+
fmt.Println()
211+
212+
fmt.Print("----------------- Fetching the signedPayload for : ", image)
213+
fmt.Println("-------------------")
214+
fmt.Println("")
215+
fmt.Println("")
216+
217+
ctx := context.Background()
218+
signedPayloads, err := cosign.FetchSignaturesForReference(ctx, ref)
219+
if err != nil {
220+
fmt.Println("Error During signedPayloads Fetcheing ")
221+
panic(err)
222+
}
223+
224+
fmt.Println("------------------------------------ Fetched all the signedPayloads ----------------------------")
225+
fmt.Println()
226+
227+
for _, Payload := range signedPayloads {
228+
fmt.Println("------------------------------------- Signed Payload Content --------------------------------")
229+
fmt.Println("")
230+
fmt.Println("--------------------------------------Signed Payload Bundle ----------------------------------")
231+
232+
byteStream, err := json.Marshal(Payload.Bundle)
233+
if err != nil {
234+
fmt.Println("Error marshaling JSON:", err)
235+
return
236+
}
237+
jsonString := string(byteStream)
238+
fmt.Println(jsonString)
239+
fmt.Println("")
240+
241+
fmt.Println("--------------------------------------Signature for Payload -----------------------------------")
242+
fmt.Println(Payload.Base64Signature)
243+
fmt.Println("")
244+
245+
fmt.Println("-----------------------------------Certificate for the Payload---------------------------------")
246+
byteStream2, err := json.Marshal(Payload.Cert)
247+
248+
if err != nil {
249+
fmt.Println("Error marshaling JSON:", err)
250+
return
251+
}
252+
jsonString2 := string(byteStream2)
253+
fmt.Println(jsonString2)
254+
}
255+
256+
fmt.Println("")
257+
fmt.Println("")
258+
fmt.Println("-------------------------------------Keyed Signature verification --------------------------------------")
259+
fmt.Println("")
260+
261+
keyed_verified_signatures, err := keyed_signatureVerification(ctx, ref)
262+
if err != nil {
263+
fmt.Println("no signature matched:")
264+
}
265+
fmt.Println("")
266+
fmt.Println("--------------------------------List of the verified signatures ----------------------------------")
267+
for _, sig := range keyed_verified_signatures {
268+
fmt.Println(sig.Base64Signature())
269+
}
270+
271+
fmt.Println("-------------------------------------Keyless Signature verification --------------------------------------")
272+
fmt.Println("")
273+
274+
keyless_verified_signatures, err := keyless_sigantureVerification(ctx, ref)
275+
if err != nil {
276+
fmt.Println("no signature matched...")
277+
}
278+
279+
fmt.Println("")
280+
fmt.Println("--------------------------------List of the verified signatures ----------------------------------")
281+
for _, sig := range keyless_verified_signatures {
282+
fmt.Println(sig.Base64Signature())
283+
}
284+
}
285+
286+
func main() {
287+
cosign2()
288+
}

‎demo.txt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIC0jCCAligAwIBAgIUYcde+9uiVxa8DtmQJUzet2xB+uswCgYIKoZIzj0EAwMw
3+
NzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl
4+
cm1lZGlhdGUwHhcNMjMwNjE3MTAzNDM0WhcNMjMwNjE3MTA0NDM0WjAAMFkwEwYH
5+
KoZIzj0CAQYIKoZIzj0DAQcDQgAEVVGQL8mdMH6P/UZ/X1AqiPp+DEki79YMMaa8
6+
c6lh3/BFSt46Y4uffbbjYrphhhEt6DwGAnEAxNSLBCH0e8k8PKOCAXcwggFzMA4G
7+
A1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUOI2H
8+
atfhqN5wTdUbdPE/NmwAwtQwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4Y
9+
ZD8wJgYDVR0RAQH/BBwwGoEYYW1pdDkxMTYyNjAxOTJAZ21haWwuY29tMCkGCisG
10+
AQQBg78wAQEEG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTArBgorBgEEAYO/
11+
MAEIBB0MG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTCBiwYKKwYBBAHWeQIE
12+
AgR9BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABiMjr
13+
xFsAAAQDAEgwRgIhAKLJUlXry9VyTnjTTPzsTCqvSQ3i/35RnN4PmxcFgYwAAiEA
14+
1eUBczXVO72rDz0kv9jWPv+G+3JTT+rMWTaxlO+n3fYwCgYIKoZIzj0EAwMDaAAw
15+
ZQIwRx/tftmBaASRRA0LsdRTPeBd3N4vvAoy6rka+I/uLRz26kYCLv6ynaVwFDrX
16+
GCrBAjEAzt+aQPv0fcHvPWV/vKWCBYpMfAHVbuSvsVEEOAkwkD0KlRlPCraXdjaB
17+
HFom7xGY
18+
-----END CERTIFICATE-----

‎demo2.crt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIICzzCCAlagAwIBAgIUUTU8hk4lfKJwOG0XFhxpyLMfwhMwCgYIKoZIzj0EAwMw
3+
NzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl
4+
cm1lZGlhdGUwHhcNMjMwNjE3MTEzMDAyWhcNMjMwNjE3MTE0MDAyWjAAMFkwEwYH
5+
KoZIzj0CAQYIKoZIzj0DAQcDQgAE08YM8/NKB5BslMC06fq01O6IWTW541w1TYxJ
6+
lsQ7WQu+oPJ9YTlKeBCoOn3KcEaLlf5NZroBG2XX4dBSrOkd4qOCAXUwggFxMA4G
7+
A1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUH7tG
8+
pTHPAqgYs1bG8e9Tcsgv7xkwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4Y
9+
ZD8wJgYDVR0RAQH/BBwwGoEYYW1pdDkxMTYyNjAxOTJAZ21haWwuY29tMCkGCisG
10+
AQQBg78wAQEEG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTArBgorBgEEAYO/
11+
MAEIBB0MG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTCBiQYKKwYBBAHWeQIE
12+
AgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABiMke
13+
iyQAAAQDAEYwRAIgFCnil/mF85ZR6tYu1CAsFM//4966pzbBCOjTWZKen+sCIHL4
14+
Rbn0E+tLp0IxrvQYUR4uR35MmtS7lWihGvfra+8BMAoGCCqGSM49BAMDA2cAMGQC
15+
MAyAqcswsyukLVvZG7wZJrBN4SoN0CcEe6STG/xYpHMaN0q/U77IpbtM/8zi86Oc
16+
zgIwHu0cA3b3hPY3NxKypm6r4zNeRf/8/LqD8fHFzYuE01cLVzvuu5DAXzyhKAan
17+
uE2n
18+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)