Skip to content

Commit c8076cb

Browse files
ret2libcret2libc
committed
Added --signing-algorithm flag to verify/verify-blob commands
Signed-off-by: Riccardo Schirone <[email protected]>
1 parent 0cfa089 commit c8076cb

File tree

4 files changed

+67
-17
lines changed

4 files changed

+67
-17
lines changed

‎cmd/cosign/cli/options/verify.go‎

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,15 @@
1616
package options
1717

1818
import (
19+
"fmt"
20+
"strings"
21+
1922
"github.com/spf13/cobra"
2023

2124
"github.com/sigstore/cosign/v2/internal/pkg/cosign"
25+
cosign_v2 "github.com/sigstore/cosign/v2/pkg/cosign"
26+
v1 "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1"
27+
"github.com/sigstore/sigstore/pkg/signature"
2228
)
2329

2430
type CommonVerifyOptions struct {
@@ -56,13 +62,14 @@ func (o *CommonVerifyOptions) AddFlags(cmd *cobra.Command) {
5662

5763
// VerifyOptions is the top level wrapper for the `verify` command.
5864
type VerifyOptions struct {
59-
Key string
60-
CheckClaims bool
61-
Attachment string
62-
Output string
63-
SignatureRef string
64-
PayloadRef string
65-
LocalImage bool
65+
Key string
66+
SigningAlgorithm string
67+
CheckClaims bool
68+
Attachment string
69+
Output string
70+
SignatureRef string
71+
PayloadRef string
72+
LocalImage bool
6673

6774
CommonVerifyOptions CommonVerifyOptions
6875
SecurityKey SecurityKeyOptions
@@ -90,6 +97,11 @@ func (o *VerifyOptions) AddFlags(cmd *cobra.Command) {
9097
"path to the public key file, KMS URI or Kubernetes Secret")
9198
_ = cmd.Flags().SetAnnotation("key", cobra.BashCompFilenameExt, []string{})
9299

100+
keyAlgorithmTypes := cosign_v2.GetSupportedAlgorithms()
101+
keyAlgorithmHelp := fmt.Sprintf("accepted signing algorithm to use for verifying the signature (allowed %s)", strings.Join(keyAlgorithmTypes, ", "))
102+
defaultKeyFlag, _ := signature.FormatSignatureAlgorithmFlag(v1.KnownSignatureAlgorithm_ECDSA_SHA2_256_NISTP256)
103+
cmd.Flags().StringVar(&o.SigningAlgorithm, "signing-algorithm", defaultKeyFlag, keyAlgorithmHelp)
104+
93105
cmd.Flags().BoolVar(&o.CheckClaims, "check-claims", true,
94106
"whether to check the claims found")
95107

@@ -154,9 +166,10 @@ func (o *VerifyAttestationOptions) AddFlags(cmd *cobra.Command) {
154166

155167
// VerifyBlobOptions is the top level wrapper for the `verify blob` command.
156168
type VerifyBlobOptions struct {
157-
Key string
158-
Signature string
159-
BundlePath string
169+
Key string
170+
SigningAlgorithm string
171+
Signature string
172+
BundlePath string
160173

161174
SecurityKey SecurityKeyOptions
162175
CertVerify CertVerifyOptions
@@ -178,6 +191,11 @@ func (o *VerifyBlobOptions) AddFlags(cmd *cobra.Command) {
178191
cmd.Flags().StringVar(&o.Key, "key", "",
179192
"path to the public key file, KMS URI or Kubernetes Secret")
180193

194+
keyAlgorithmTypes := cosign_v2.GetSupportedAlgorithms()
195+
keyAlgorithmHelp := fmt.Sprintf("accepted signing algorithm to use for verifying the signature (allowed %s)", strings.Join(keyAlgorithmTypes, ", "))
196+
defaultKeyFlag, _ := signature.FormatSignatureAlgorithmFlag(v1.KnownSignatureAlgorithm_ECDSA_SHA2_256_NISTP256)
197+
cmd.Flags().StringVar(&o.SigningAlgorithm, "signing-algorithm", defaultKeyFlag, keyAlgorithmHelp)
198+
181199
cmd.Flags().StringVar(&o.Signature, "signature", "",
182200
"signature content or path or remote URL")
183201

‎cmd/cosign/cli/verify.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ against the transparency log.`,
125125
Attachment: o.Attachment,
126126
Annotations: annotations,
127127
HashAlgorithm: hashAlgorithm,
128+
SigningAlgorithm: o.SigningAlgorithm,
128129
SignatureRef: o.SignatureRef,
129130
PayloadRef: o.PayloadRef,
130131
LocalImage: o.LocalImage,
@@ -315,6 +316,7 @@ The blob may be specified as a path to a file or - for stdin.`,
315316

316317
ko := options.KeyOpts{
317318
KeyRef: o.Key,
319+
SigningAlgorithm: o.SigningAlgorithm,
318320
Sk: o.SecurityKey.Use,
319321
Slot: o.SecurityKey.Slot,
320322
RekorURL: o.Rekor.URL,

‎cmd/cosign/cli/verify/verify.go‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ import (
4242
"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
4343
"github.com/sigstore/cosign/v2/pkg/oci"
4444
sigs "github.com/sigstore/cosign/v2/pkg/signature"
45+
pb_go_v1 "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1"
4546
"github.com/sigstore/sigstore/pkg/cryptoutils"
4647
"github.com/sigstore/sigstore/pkg/signature"
4748
signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
@@ -74,6 +75,7 @@ type VerifyCommand struct {
7475
SignatureRef string
7576
PayloadRef string
7677
HashAlgorithm crypto.Hash
78+
SigningAlgorithm string
7779
LocalImage bool
7880
NameOptions []name.Option
7981
Offline bool
@@ -215,9 +217,23 @@ func (c *VerifyCommand) Exec(ctx context.Context, images []string) (err error) {
215217
}
216218
}
217219

218-
svOpts := []signature.LoadOption{
219-
signatureoptions.WithHash(crypto.SHA256),
220-
signatureoptions.WithED25519ph(),
220+
var svOpts []signature.LoadOption
221+
signingAlgorithm, err := signature.ParseSignatureAlgorithmFlag(c.SigningAlgorithm)
222+
if err != nil {
223+
// Default to ECDSA_SHA2_256_NISTP256 if no algorithm is specified
224+
signingAlgorithm = pb_go_v1.KnownSignatureAlgorithm_ECDSA_SHA2_256_NISTP256
225+
}
226+
227+
algorithmDetails, err := signature.GetAlgorithmDetails(signingAlgorithm)
228+
if err != nil {
229+
return err
230+
}
231+
hashAlgorithm := algorithmDetails.GetHashType()
232+
svOpts = []signature.LoadOption{
233+
signatureoptions.WithHash(hashAlgorithm),
234+
}
235+
if algorithmDetails.GetSignatureAlgorithm() == pb_go_v1.KnownSignatureAlgorithm_ED25519_PH {
236+
svOpts = append(svOpts, signatureoptions.WithED25519ph())
221237
}
222238

223239
// Keys are optional!

‎cmd/cosign/cli/verify/verify_blob.go‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ package verify
1717

1818
import (
1919
"context"
20-
"crypto"
2120
"crypto/x509"
2221
"encoding/base64"
2322
"encoding/json"
@@ -39,6 +38,7 @@ import (
3938
"github.com/sigstore/cosign/v2/pkg/cosign/pkcs11key"
4039
"github.com/sigstore/cosign/v2/pkg/oci/static"
4140
sigs "github.com/sigstore/cosign/v2/pkg/signature"
41+
pb_go_v1 "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1"
4242

4343
"github.com/sigstore/sigstore/pkg/cryptoutils"
4444
"github.com/sigstore/sigstore/pkg/signature"
@@ -172,9 +172,23 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
172172
}
173173
}
174174

175-
svOpts := []signature.LoadOption{
176-
signatureoptions.WithHash(crypto.SHA256),
177-
signatureoptions.WithED25519ph(),
175+
var svOpts []signature.LoadOption
176+
signingAlgorithm, err := signature.ParseSignatureAlgorithmFlag(c.KeyOpts.SigningAlgorithm)
177+
if err != nil {
178+
// Default to ECDSA_SHA2_256_NISTP256 if no algorithm is specified
179+
signingAlgorithm = pb_go_v1.KnownSignatureAlgorithm_ECDSA_SHA2_256_NISTP256
180+
}
181+
182+
algorithmDetails, err := signature.GetAlgorithmDetails(signingAlgorithm)
183+
if err != nil {
184+
return err
185+
}
186+
hashAlgorithm := algorithmDetails.GetHashType()
187+
svOpts = []signature.LoadOption{
188+
signatureoptions.WithHash(hashAlgorithm),
189+
}
190+
if algorithmDetails.GetSignatureAlgorithm() == pb_go_v1.KnownSignatureAlgorithm_ED25519_PH {
191+
svOpts = append(svOpts, signatureoptions.WithED25519ph())
178192
}
179193

180194
// Keys are optional!

0 commit comments

Comments
 (0)