-
Notifications
You must be signed in to change notification settings - Fork 29
/
sigstore_rekor.proto
131 lines (122 loc) · 6.96 KB
/
sigstore_rekor.proto
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
// Copyright 2022 The Sigstore Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package dev.sigstore.rekor.v1;
import "google/api/field_behavior.proto";
import "sigstore_common.proto";
option go_package = "github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1";
option java_package = "dev.sigstore.proto.rekor.v1";
option java_multiple_files = true;
option java_outer_classname = "RekorProto";
option ruby_package = "Sigstore::Rekor::V1";
// KindVersion contains the entry's kind and api version.
message KindVersion {
// Kind is the type of entry being stored in the log.
// See here for a list: https://github.com/sigstore/rekor/tree/main/pkg/types
string kind = 1 [(google.api.field_behavior) = REQUIRED];
// The specific api version of the type.
string version = 2 [(google.api.field_behavior) = REQUIRED];
}
// The checkpoint contains a signature of the tree head (root hash),
// size of the tree, the transparency log's unique identifier (log ID),
// hostname and the current time.
// The result is a string, the format is described here
// https://github.com/transparency-dev/formats/blob/main/log/README.md
// The details are here https://github.com/sigstore/rekor/blob/a6e58f72b6b18cc06cefe61808efd562b9726330/pkg/util/signed_note.go#L114
// The signature has the same format as
// InclusionPromise.signed_entry_timestamp. See below for more details.
message Checkpoint {
string envelope = 1 [(google.api.field_behavior) = REQUIRED];
}
// InclusionProof is the proof returned from the transparency log. Can
// be used for offline or online verification against the log.
message InclusionProof {
// The index of the entry in the tree it was written to.
int64 log_index = 1 [(google.api.field_behavior) = REQUIRED];
// The hash digest stored at the root of the merkle tree at the time
// the proof was generated.
bytes root_hash = 2 [(google.api.field_behavior) = REQUIRED];
// The size of the merkle tree at the time the proof was generated.
int64 tree_size = 3 [(google.api.field_behavior) = REQUIRED];
// A list of hashes required to compute the inclusion proof, sorted
// in order from leaf to root.
// Note that leaf and root hashes are not included.
// The root hash is available separately in this message, and the
// leaf hash should be calculated by the client.
repeated bytes hashes = 4 [(google.api.field_behavior) = REQUIRED];
// Signature of the tree head, as of the time of this proof was
// generated. See above info on 'Checkpoint' for more details.
Checkpoint checkpoint = 5 [(google.api.field_behavior) = REQUIRED];
}
// The inclusion promise is calculated by Rekor. It's calculated as a
// signature over a canonical JSON serialization of the persisted entry, the
// log ID, log index and the integration timestamp.
// See https://github.com/sigstore/rekor/blob/a6e58f72b6b18cc06cefe61808efd562b9726330/pkg/api/entries.go#L54
// The format of the signature depends on the transparency log's public key.
// If the signature algorithm requires a hash function and/or a signature
// scheme (e.g. RSA) those has to be retrieved out-of-band from the log's
// operators, together with the public key.
// This is used to verify the integration timestamp's value and that the log
// has promised to include the entry.
message InclusionPromise {
bytes signed_entry_timestamp = 1 [(google.api.field_behavior) = REQUIRED];
}
// TransparencyLogEntry captures all the details required from Rekor to
// reconstruct an entry, given that the payload is provided via other means.
// This type can easily be created from the existing response from Rekor.
// Future iterations could rely on Rekor returning the minimal set of
// attributes (excluding the payload) that are required for verifying the
// inclusion promise. The inclusion promise (called SignedEntryTimestamp in
// the response from Rekor) is similar to a Signed Certificate Timestamp
// as described here https://www.rfc-editor.org/rfc/rfc6962.html#section-3.2.
message TransparencyLogEntry {
// The global index of the entry, used when querying the log by index.
int64 log_index = 1 [(google.api.field_behavior) = REQUIRED];
// The unique identifier of the log.
dev.sigstore.common.v1.LogId log_id = 2 [(google.api.field_behavior) = REQUIRED];
// The kind (type) and version of the object associated with this
// entry. These values are required to construct the entry during
// verification.
KindVersion kind_version = 3 [(google.api.field_behavior) = REQUIRED];
// The UNIX timestamp from the log when the entry was persisted.
int64 integrated_time = 4 [(google.api.field_behavior) = REQUIRED];
// The inclusion promise/signed entry timestamp from the log.
// Required for v0.1 bundles, and MUST be verified.
// Optional for >= v0.2 bundles, and SHOULD be verified when present.
// Also may be used as a signed timestamp.
InclusionPromise inclusion_promise = 5;
// The inclusion proof can be used for offline or online verification
// that the entry was appended to the log, and that the log has not been
// altered.
InclusionProof inclusion_proof = 6 [(google.api.field_behavior) = REQUIRED];
// Optional. The canonicalized transparency log entry, used to
// reconstruct the Signed Entry Timestamp (SET) during verification.
// The contents of this field are the same as the `body` field in
// a Rekor response, meaning that it does **not** include the "full"
// canonicalized form (of log index, ID, etc.) which are
// exposed as separate fields. The verifier is responsible for
// combining the `canonicalized_body`, `log_index`, `log_id`,
// and `integrated_time` into the payload that the SET's signature
// is generated over.
// This field is intended to be used in cases where the SET cannot be
// produced determinisitically (e.g. inconsistent JSON field ordering,
// differing whitespace, etc).
//
// If set, clients MUST verify that the signature referenced in the
// `canonicalized_body` matches the signature provided in the
// `Bundle.content`.
// If not set, clients are responsible for constructing an equivalent
// payload from other sources to verify the signature.
bytes canonicalized_body = 7;
}