Skip to content

Commit

Permalink
Add Fulcio v1 root to the cosign (#1112)
Browse files Browse the repository at this point in the history 
* add fulcio v1 root

Signed-off-by: Asra Ali <[email protected]>

* remove unneeded todo

Signed-off-by: Asra Ali <[email protected]>
  • Loading branch information
@asraa
asraa committed Nov 30, 2021
1 parent 304c2b2 commit 2294fd4
Show file tree
Hide file tree
Showing 11 changed files with 479 additions and 100 deletions.
20 changes: 11 additions & 9 deletions cmd/cosign/cli/fulcio/fulcioroots/fulcioroots.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@ import (
"crypto/x509"
"fmt"
"os"
"strings"
"sync"

"github.com/pkg/errors"
Expand All @@ -36,6 +35,9 @@ var (
// This is the root in the fulcio project.
var fulcioTargetStr = `fulcio.crt.pem`

// This is the v1 migrated root.
var fulcioV1TargetStr = `fulcio_v1.crt.pem`

const (
altRoot = "SIGSTORE_ROOT_FILE"
)
Expand All @@ -62,14 +64,14 @@ func initRoots() *x509.CertPool {
// Retrieve from the embedded or cached TUF root. If expired, a network
// call is made to update the root.
ctx := context.Background() // TODO: pass in context?
buf := tuf.ByteDestination{Buffer: &bytes.Buffer{}}
if err := tuf.GetTarget(ctx, fulcioTargetStr, &buf); err != nil {
panic(errors.Wrap(err, "creating root cert pool"))
}
// TODO: Remove the string replace when SigStore root is updated.
replaced := strings.ReplaceAll(buf.String(), "\n ", "\n")
if !cp.AppendCertsFromPEM([]byte(replaced)) {
panic("error creating root cert pool")
for _, fulcioTarget := range []string{fulcioTargetStr, fulcioV1TargetStr} {
buf := tuf.ByteDestination{Buffer: &bytes.Buffer{}}
if err := tuf.GetTarget(ctx, fulcioTarget, &buf); err != nil {
panic(errors.Wrap(err, "creating root cert pool"))
}
if !cp.AppendCertsFromPEM(buf.Bytes()) {
panic("error creating root cert pool")
}
}
}
return cp
Expand Down
130 changes: 130 additions & 0 deletions pkg/cosign/tuf/repository/1.root.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,130 @@
{
"signatures": [
{
"keyid": "2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97",
"sig": "30450221008a35d51da0f845301a5eac98ad0df00a934f59b709c1eaf81c86be734d9356f80220742942325599749800f52675f6efe124345980a2a636c0dc76f9caf9fc3123b0"
},
{
"keyid": "bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62",
"sig": "3045022100ef9157ece2a09baec1eab80adfc00b04da20b1f9a0d1b47c5dabc4506719ef2c022074f72acd57398e4ddc8c2a5040df902961e9615dca48f3fbe38cbb506e500066"
},
{
"keyid": "eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b",
"sig": "30450220420fdc9a09cd069b8b15fd8db9cedf7d0dee75871bd1cfee77c926d4120a770002210097553b5ad0d6b4a13902ed37509638bb63a9009f78230cd56c802909ffbfead7"
},
{
"keyid": "f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb",
"sig": "304502202aaf32e66f90752f658672b085ecfe45cc1ad31ee6cf5c9ad05f3267685f8d88022100b5df02acdaa371123db9d7a42219553fe079b230b168833e951be7ee56ded347"
},
{
"keyid": "f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209",
"sig": "304402205d420c7d05c58980c1c9f7d221f53b5334aae27a447d2a91c2ceddd685269749022039ec83e51f8e1779d7f0142dfa4a5bbecfe327fc0b91b7416090fea2416fd53a"
}
],
"signed": {
"_type": "root",
"consistent_snapshot": false,
"expires": "2021-12-18T13:28:12.99008-06:00",
"keys": {
"2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "04cbc5cab2684160323c25cd06c3307178a6b1d1c9b949328453ae473c5ba7527e35b13f298b41633382241f3fd8526c262d43b45adee5c618fa0642c82b8a9803"
},
"scheme": "ecdsa-sha2-nistp256"
},
"bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "04a71aacd835dc170ba6db3fa33a1a33dee751d4f8b0217b805b9bd3242921ee93672fdcfd840576c5bb0dc0ed815edf394c1ee48c2b5e02485e59bfc512f3adc7"
},
"scheme": "ecdsa-sha2-nistp256"
},
"eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "04117b33dd265715bf23315e368faa499728db8d1f0a377070a1c7b1aba2cc21be6ab1628e42f2cdd7a35479f2dce07b303a8ba646c55569a8d2a504ba7e86e447"
},
"scheme": "ecdsa-sha2-nistp256"
},
"f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "04cc1cd53a61c23e88cc54b488dfae168a257c34fac3e88811c55962b24cffbfecb724447999c54670e365883716302e49da57c79a33cd3e16f81fbc66f0bcdf48"
},
"scheme": "ecdsa-sha2-nistp256"
},
"f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "048a78a44ac01099890d787e5e62afc29c8ccb69a70ec6549a6b04033b0a8acbfb42ab1ab9c713d225cdb52b858886cf46c8e90a7f3b9e6371882f370c259e1c5b"
},
"scheme": "ecdsa-sha2-nistp256"
}
},
"roles": {
"root": {
"keyids": [
"2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97",
"bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62",
"eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b",
"f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb",
"f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209"
],
"threshold": 3
},
"snapshot": {
"keyids": [
"2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97",
"bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62",
"eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b",
"f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb",
"f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209"
],
"threshold": 3
},
"targets": {
"keyids": [
"2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97",
"bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62",
"eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b",
"f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb",
"f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209"
],
"threshold": 3
},
"timestamp": {
"keyids": [
"2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97",
"bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62",
"eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b",
"f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb",
"f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209"
],
"threshold": 3
}
},
"spec_version": "1.0",
"version": 1
}
}
144 changes: 144 additions & 0 deletions pkg/cosign/tuf/repository/2.root.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,144 @@
{
"signatures": [
{
"keyid": "2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97",
"sig": "3046022100d3ea59490b253beae0926c6fa63f54336dea1ed700555be9f27ff55cd347639c0221009157d1ba012cead81948a4ab777d355451d57f5c4a2d333fc68d2e3f358093c2"
},
{
"keyid": "bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62",
"sig": "304502206eaef40564403ce572c6d062e0c9b0aab5e0223576133e081e1b495e8deb9efd02210080fd6f3464d759601b4afec596bbd5952f3a224cd06ed1cdfc3c399118752ba2"
},
{
"keyid": "eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b",
"sig": "304502207baace02f56d8e6069f10b6ff098a26e7f53a7f9324ad62cffa0557bdeb9036c022100fb3032baaa090d0040c3f2fd872571c84479309b773208601d65948df87a9720"
},
{
"keyid": "f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb",
"sig": "304402205180c01905505dd88acd7a2dad979dd75c979b3722513a7bdedac88c6ae8dbeb022056d1ddf7a192f0b1c2c90ff487de2fb3ec9f0c03f66ea937c78d3b6a493504ca"
},
{
"keyid": "f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209",
"sig": "3046022100c8806d4647c514d80fd8f707d3369444c4fd1d0812a2d25f828e564c99790e3f022100bb51f12e862ef17a7d3da2ac103bebc5c7e792237006c4cafacd76267b249c2f"
}
],
"signed": {
"_type": "root",
"consistent_snapshot": false,
"expires": "2022-05-11T19:09:02.663975009Z",
"keys": {
"2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "04cbc5cab2684160323c25cd06c3307178a6b1d1c9b949328453ae473c5ba7527e35b13f298b41633382241f3fd8526c262d43b45adee5c618fa0642c82b8a9803"
},
"scheme": "ecdsa-sha2-nistp256"
},
"b6710623a30c010738e64c5209d367df1c0a18cf90e6ab5292fb01680f83453d": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "04fa1a3e42f2300cd3c5487a61509348feb1e936920fef2f83b7cd5dbe7ba045f538725ab8f18a666e6233edb7e0db8766c8dc336633449c5e1bbe0c182b02df0b"
},
"scheme": "ecdsa-sha2-nistp256"
},
"bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "04a71aacd835dc170ba6db3fa33a1a33dee751d4f8b0217b805b9bd3242921ee93672fdcfd840576c5bb0dc0ed815edf394c1ee48c2b5e02485e59bfc512f3adc7"
},
"scheme": "ecdsa-sha2-nistp256"
},
"eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "04117b33dd265715bf23315e368faa499728db8d1f0a377070a1c7b1aba2cc21be6ab1628e42f2cdd7a35479f2dce07b303a8ba646c55569a8d2a504ba7e86e447"
},
"scheme": "ecdsa-sha2-nistp256"
},
"f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "04cc1cd53a61c23e88cc54b488dfae168a257c34fac3e88811c55962b24cffbfecb724447999c54670e365883716302e49da57c79a33cd3e16f81fbc66f0bcdf48"
},
"scheme": "ecdsa-sha2-nistp256"
},
"f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "048a78a44ac01099890d787e5e62afc29c8ccb69a70ec6549a6b04033b0a8acbfb42ab1ab9c713d225cdb52b858886cf46c8e90a7f3b9e6371882f370c259e1c5b"
},
"scheme": "ecdsa-sha2-nistp256"
},
"fc61191ba8a516fe386c7d6c97d918e1d241e1589729add09b122725b8c32451": {
"keyid_hash_algorithms": [
"sha256",
"sha512"
],
"keytype": "ecdsa-sha2-nistp256",
"keyval": {
"public": "044c7793ab74b9ddd713054e587b8d9c75c5f6025633d0fef7ca855ed5b8d5a474b23598fe33eb4a63630d526f74d4bdaec8adcb51993ed65652d651d7c49203eb"
},
"scheme": "ecdsa-sha2-nistp256"
}
},
"roles": {
"root": {
"keyids": [
"2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97",
"bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62",
"eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b",
"f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb",
"f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209"
],
"threshold": 3
},
"snapshot": {
"keyids": [
"fc61191ba8a516fe386c7d6c97d918e1d241e1589729add09b122725b8c32451"
],
"threshold": 1
},
"targets": {
"keyids": [
"2f64fb5eac0cf94dd39bb45308b98920055e9a0d8e012a7220787834c60aef97",
"bdde902f5ec668179ff5ca0dabf7657109287d690bf97e230c21d65f99155c62",
"eaf22372f417dd618a46f6c627dbc276e9fd30a004fc94f9be946e73f8bd090b",
"f40f32044071a9365505da3d1e3be6561f6f22d0e60cf51df783999f6c3429cb",
"f505595165a177a41750a8e864ed1719b1edfccd5a426fd2c0ffda33ce7ff209"
],
"threshold": 3
},
"timestamp": {
"keyids": [
"b6710623a30c010738e64c5209d367df1c0a18cf90e6ab5292fb01680f83453d"
],
"threshold": 1
}
},
"spec_version": "1.0",
"version": 2
}
}
Loading

0 comments on commit 2294fd4

Please sign in to comment.