Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 58c2b27

Browse files
Hector Fernandezpull[bot]
Hector Fernandez
authored and
pull[bot]
committedNov 11, 2022
cosigned: read the public key from the kms authority (sigstore#1706)
* cosigned: handle KMS keys Signed-off-by: hectorj2f <hectorf@vmware.com> * cosigned: use latest sigstore Signed-off-by: hectorj2f <hectorf@vmware.com>
1 parent 52ce2fd commit 58c2b27

File tree

5 files changed

+428
-331
lines changed

5 files changed

+428
-331
lines changed
 

‎go.mod

+3-3
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ require (
3838
github.com/secure-systems-lab/go-securesystemslib v0.3.1
3939
github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7
4040
github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3
41-
github.com/sigstore/sigstore v1.2.1-0.20220330193110-d7475aecf1db
41+
github.com/sigstore/sigstore v1.2.1-0.20220401110139-0e610e39782f
4242
github.com/spf13/cobra v1.4.0
4343
github.com/spf13/viper v1.10.1
4444
github.com/spiffe/go-spiffe/v2 v2.0.0
@@ -115,7 +115,7 @@ require (
115115
contrib.go.opencensus.io/exporter/prometheus v0.4.0 // indirect
116116
github.com/Azure/azure-sdk-for-go v63.0.0+incompatible // indirect
117117
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
118-
github.com/Azure/go-autorest/autorest v0.11.24 // indirect
118+
github.com/Azure/go-autorest/autorest v0.11.25 // indirect
119119
github.com/Azure/go-autorest/autorest/adal v0.9.18 // indirect
120120
github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
121121
github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
@@ -131,7 +131,7 @@ require (
131131
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
132132
github.com/ReneKroon/ttlcache/v2 v2.11.0 // indirect
133133
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
134-
github.com/aws/aws-sdk-go v1.43.28 // indirect
134+
github.com/aws/aws-sdk-go v1.43.30 // indirect
135135
github.com/aws/aws-sdk-go-v2 v1.14.0 // indirect
136136
github.com/aws/aws-sdk-go-v2/config v1.14.0 // indirect
137137
github.com/aws/aws-sdk-go-v2/credentials v1.9.0 // indirect

‎go.sum

+8-8
Original file line numberDiff line numberDiff line change
@@ -151,8 +151,9 @@ github.com/Azure/go-autorest/autorest v0.11.8/go.mod h1:V6p3pKZx1KKkJubbxnDWrzNh
151151
github.com/Azure/go-autorest/autorest v0.11.18/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
152152
github.com/Azure/go-autorest/autorest v0.11.19/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
153153
github.com/Azure/go-autorest/autorest v0.11.22/go.mod h1:BAWYUWGPEtKPzjVkp0Q6an0MJcJDsoh5Z1BFAEFs4Xs=
154-
github.com/Azure/go-autorest/autorest v0.11.24 h1:1fIGgHKqVm54KIPT+q8Zmd1QlVsmHqeUGso5qm2BqqE=
155154
github.com/Azure/go-autorest/autorest v0.11.24/go.mod h1:G6kyRlFnTuSbEYkQGawPfsCswgme4iYf6rfSKUDzbCc=
155+
github.com/Azure/go-autorest/autorest v0.11.25 h1:yp+V8DGur2aIUE87ebP8twPLz6k68jtJTlg61mEoByA=
156+
github.com/Azure/go-autorest/autorest v0.11.25/go.mod h1:7l8ybrIdUmGqZMTD0sRtAr8NvbHjfofbf8RSP2q7w7U=
156157
github.com/Azure/go-autorest/autorest/adal v0.9.0/go.mod h1:/c022QCutn2P7uY+/oQWWNcK9YU+MH96NgK+jErpbcg=
157158
github.com/Azure/go-autorest/autorest/adal v0.9.4/go.mod h1:/3SMAM86bP6wC9Ev35peQDUeqFZBMH07vvUOmg4z/fE=
158159
github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
@@ -173,8 +174,9 @@ github.com/Azure/go-autorest/autorest/azure/cli v0.4.5/go.mod h1:ADQAXrkgm7acgWV
173174
github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
174175
github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
175176
github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
176-
github.com/Azure/go-autorest/autorest/mocks v0.4.1 h1:K0laFcLE6VLTOwNgSxaGbUcLPuGXlNkbVvq4cW4nIHk=
177177
github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
178+
github.com/Azure/go-autorest/autorest/mocks v0.4.2 h1:PGN4EDXnuQbojHbU0UWoNvmu9AGVwYHG9/fkDYhtAfw=
179+
github.com/Azure/go-autorest/autorest/mocks v0.4.2/go.mod h1:Vy7OitM9Kei0i1Oj+LvyAWMXJHeKH1MVlzFugfVrmyU=
178180
github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=
179181
github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=
180182
github.com/Azure/go-autorest/autorest/validation v0.3.1 h1:AgyqjAd94fwNAoTjl/WQXg4VvFeRFpO+UhNyRXqF1ac=
@@ -321,8 +323,8 @@ github.com/aws/aws-sdk-go v1.37.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zK
321323
github.com/aws/aws-sdk-go v1.42.8/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
322324
github.com/aws/aws-sdk-go v1.42.22/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm+LY1U59Q=
323325
github.com/aws/aws-sdk-go v1.42.25/go.mod h1:gyRszuZ/icHmHAVE4gc/r+cfCmhA1AD+vqfWbgI+eHs=
324-
github.com/aws/aws-sdk-go v1.43.28 h1:HrBUf2pYEMRB3GDkSa/bZ2lkZIe8gSUOz/IEupG1Te0=
325-
github.com/aws/aws-sdk-go v1.43.28/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
326+
github.com/aws/aws-sdk-go v1.43.30 h1:Q3lgrX/tz/MkEiPVVQnOQThBAK2QC2SCTCKTD1mwGFA=
327+
github.com/aws/aws-sdk-go v1.43.30/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
326328
github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
327329
github.com/aws/aws-sdk-go-v2 v1.7.1/go.mod h1:L5LuPC1ZgDr2xQS7AmIec/Jlc7O/Y1u2KxJyNVab250=
328330
github.com/aws/aws-sdk-go-v2 v1.11.0/go.mod h1:SQfA+m2ltnu1cA0soUkj4dRSsmITiVQUJvBIZjzfPyQ=
@@ -1552,7 +1554,6 @@ github.com/leodido/go-urn v1.1.0/go.mod h1:+cyI34gQWZcE1eQU7NVgKkkzdXDQHr1dBMtdA
15521554
github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
15531555
github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
15541556
github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
1555-
github.com/letsencrypt/boulder v0.0.0-20220322173223-dd8be8d7b02c/go.mod h1:7nZQ5CFpTKy5lJeAPeWlKcXHXnYqknvYQPuNte1aK/0=
15561557
github.com/letsencrypt/boulder v0.0.0-20220331220046-b23ab962616e h1:1aV3EJ4ZMsc63MFU4rB+ccSEhZvvVD71T9RA4Rqd3hI=
15571558
github.com/letsencrypt/boulder v0.0.0-20220331220046-b23ab962616e/go.mod h1:Bl3mfF2LHYepsU2XfzMceIglyByfPe1IFAXtO+p37Qk=
15581559
github.com/letsencrypt/challtestsrv v1.2.1/go.mod h1:Ur4e4FvELUXLGhkMztHOsPIsvGxD/kzSJninOrkM+zc=
@@ -2021,8 +2022,8 @@ github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3 h1:mbqXrm8YZXN/cJ
20212022
github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3/go.mod h1:u9clLqaVjqV9pExVL1XkM37dGyMCOX/LMocS9nsnWDY=
20222023
github.com/sigstore/sigstore v1.0.2-0.20211210190220-04746d994282/go.mod h1:SuM+QIHtnnR9eGsURRLv5JfxM6KeaU0XKA1O7FmLs4Q=
20232024
github.com/sigstore/sigstore v1.1.0/go.mod h1:gDpcHw4VwpoL5C6N1Ud1YtBsc+ikRDwDelDlWRyYoE8=
2024-
github.com/sigstore/sigstore v1.2.1-0.20220330193110-d7475aecf1db h1:zMVE6f4kV6Ee6GFhmZ60BaG4uY09xOQvzk/K2gGsQm8=
2025-
github.com/sigstore/sigstore v1.2.1-0.20220330193110-d7475aecf1db/go.mod h1:dzF7JvyOyg6kcwz7UxS05jGdqXxVg17JUQaQ36nvwZg=
2025+
github.com/sigstore/sigstore v1.2.1-0.20220401110139-0e610e39782f h1:JPD9q1718mub78ILVcTqOZ/q4ECKCQ7JQfUX/q+nEJ4=
2026+
github.com/sigstore/sigstore v1.2.1-0.20220401110139-0e610e39782f/go.mod h1:9wYagRiKz/8KgK/YFPM6FA8WrNjv3Y6rQUQWBLqJXs0=
20262027
github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
20272028
github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
20282029
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
@@ -2210,7 +2211,6 @@ github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+
22102211
github.com/vmihailenco/tagparser v0.1.1 h1:quXMXlA39OCbd2wAdTsGDlK9RkOk6Wuw+x37wVyIuWY=
22112212
github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
22122213
github.com/weppos/publicsuffix-go v0.15.1-0.20210807195340-dc689ff0bb59/go.mod h1:HYux0V0Zi04bHNwOHy4cXJVz/TQjYonnF6aoYhj+3QE=
2213-
github.com/weppos/publicsuffix-go v0.15.1-0.20211029155132-7594db4f858a/go.mod h1:HYux0V0Zi04bHNwOHy4cXJVz/TQjYonnF6aoYhj+3QE=
22142214
github.com/weppos/publicsuffix-go v0.15.1-0.20220329081811-9a40b608a236/go.mod h1:HYux0V0Zi04bHNwOHy4cXJVz/TQjYonnF6aoYhj+3QE=
22152215
github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
22162216
github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=

‎pkg/reconciler/clusterimagepolicy/clusterimagepolicy.go

+42-4
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@ package clusterimagepolicy
1616

1717
import (
1818
"context"
19+
"crypto"
1920
"fmt"
21+
"strings"
2022

2123
"github.com/sigstore/cosign/pkg/apis/config"
2224
"github.com/sigstore/cosign/pkg/apis/cosigned/v1alpha1"
@@ -33,6 +35,17 @@ import (
3335
"knative.dev/pkg/reconciler"
3436
"knative.dev/pkg/system"
3537
"knative.dev/pkg/tracker"
38+
39+
sigs "github.com/sigstore/cosign/pkg/signature"
40+
"github.com/sigstore/sigstore/pkg/signature/kms"
41+
signatureoptions "github.com/sigstore/sigstore/pkg/signature/options"
42+
43+
// Register the provider-specific plugins
44+
_ "github.com/sigstore/sigstore/pkg/signature/kms/aws"
45+
_ "github.com/sigstore/sigstore/pkg/signature/kms/azure"
46+
_ "github.com/sigstore/sigstore/pkg/signature/kms/fake"
47+
_ "github.com/sigstore/sigstore/pkg/signature/kms/gcp"
48+
_ "github.com/sigstore/sigstore/pkg/signature/kms/hashivault"
3649
)
3750

3851
// Reconciler implements clusterimagepolicyreconciler.Interface for
@@ -54,7 +67,7 @@ var _ clusterimagepolicyreconciler.Finalizer = (*Reconciler)(nil)
5467

5568
// ReconcileKind implements Interface.ReconcileKind.
5669
func (r *Reconciler) ReconcileKind(ctx context.Context, cip *v1alpha1.ClusterImagePolicy) reconciler.Event {
57-
cipCopy, cipErr := r.inlineSecrets(ctx, cip)
70+
cipCopy, cipErr := r.inlinePublicKeys(ctx, cip)
5871
if cipErr != nil {
5972
// The CIP is invalid, try to remove it from the configmap.
6073
existing, err := r.configmaplister.ConfigMaps(system.Namespace()).Get(config.ImagePoliciesConfigName)
@@ -122,10 +135,10 @@ func (r *Reconciler) FinalizeKind(ctx context.Context, cip *v1alpha1.ClusterImag
122135
return r.removeCIPEntry(ctx, existing, cip)
123136
}
124137

125-
// inlineSecrets will go through the CIP and try to read the referenced
126-
// secrets and convert them into inlined data. Makes a copy of the CIP
138+
// inlinePublicKeys will go through the CIP and try to read the referenced
139+
// secrets, KMS keys and convert them into inlined data. Makes a copy of the CIP
127140
// before modifying it and returns the copy.
128-
func (r *Reconciler) inlineSecrets(ctx context.Context, cip *v1alpha1.ClusterImagePolicy) (*v1alpha1.ClusterImagePolicy, error) {
141+
func (r *Reconciler) inlinePublicKeys(ctx context.Context, cip *v1alpha1.ClusterImagePolicy) (*v1alpha1.ClusterImagePolicy, error) {
129142
ret := cip.DeepCopy()
130143
for _, authority := range ret.Spec.Authorities {
131144
if authority.Key != nil && authority.Key.SecretRef != nil {
@@ -141,10 +154,35 @@ func (r *Reconciler) inlineSecrets(ctx context.Context, cip *v1alpha1.ClusterIma
141154
return nil, err
142155
}
143156
}
157+
if authority.Key != nil && authority.Key.KMS != "" {
158+
if strings.Contains(authority.Key.KMS, "://") {
159+
pubKeyString, err := getKMSPublicKey(ctx, authority.Key.KMS)
160+
if err != nil {
161+
return nil, err
162+
}
163+
164+
authority.Key.Data = pubKeyString
165+
authority.Key.KMS = ""
166+
}
167+
}
144168
}
145169
return ret, nil
146170
}
147171

172+
// getKMSPublicKey returns the public key as a string from the configured KMS service using the key ID
173+
func getKMSPublicKey(ctx context.Context, keyID string) (string, error) {
174+
kmsSigner, err := kms.Get(ctx, keyID, crypto.SHA256)
175+
if err != nil {
176+
logging.FromContext(ctx).Errorf("Failed to read KMS key ID %q: %v", keyID, err)
177+
return "", err
178+
}
179+
pemBytes, err := sigs.PublicKeyPem(kmsSigner, signatureoptions.WithContext(ctx))
180+
if err != nil {
181+
return "", err
182+
}
183+
return string(pemBytes), nil
184+
}
185+
148186
// inlineSecret will take in a KeyRef and tries to read the Secret, finding the
149187
// first key from it and will inline it in place of Data and then clear out
150188
// the SecretRef and return it.

‎pkg/reconciler/clusterimagepolicy/clusterimagepolicy_test.go

+368-315
Large diffs are not rendered by default.

‎pkg/reconciler/testing/v1alpha1/factory.go

+7-1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ package testing
1616

1717
import (
1818
"context"
19+
"crypto/ecdsa"
1920
"encoding/json"
2021
"testing"
2122

@@ -41,6 +42,8 @@ import (
4142

4243
"knative.dev/pkg/reconciler"
4344
reconcilertesting "knative.dev/pkg/reconciler/testing"
45+
46+
fakekms "github.com/sigstore/sigstore/pkg/signature/kms/fake"
4447
)
4548

4649
const (
@@ -53,7 +56,7 @@ const (
5356
type Ctor func(context.Context, *Listers, configmap.Watcher) controller.Reconciler
5457

5558
// MakeFactory creates a reconciler factory with fake clients and controller created by `ctor`.
56-
func MakeFactory(ctor Ctor, unstructured bool, logger *zap.SugaredLogger) reconcilertesting.Factory {
59+
func MakeFactory(ctor Ctor, unstructured bool, logger *zap.SugaredLogger, privKMSKey *ecdsa.PrivateKey) reconcilertesting.Factory {
5760
return func(t *testing.T, r *reconcilertesting.TableRow) (controller.Reconciler, reconcilertesting.ActionRecorderList, reconcilertesting.EventList) {
5861
ls := NewListers(r.Objects)
5962

@@ -65,6 +68,9 @@ func MakeFactory(ctor Ctor, unstructured bool, logger *zap.SugaredLogger) reconc
6568
}
6669
ctx = logging.WithLogger(ctx, logger)
6770

71+
// Add private key for KMS testing
72+
ctx = context.WithValue(ctx, fakekms.KmsCtxKey{}, privKMSKey)
73+
6874
ctx, kubeClient := fakekubeclient.With(ctx, ls.GetKubeObjects()...)
6975
ctx, client := fakecosignclient.With(ctx, ls.GetCosignObjects()...)
7076
ctx, dynamicClient := fakedynamicclient.With(ctx,

0 commit comments

Comments
 (0)
Please sign in to comment.