Skip to content

Commit 8911168

Browse files
dmitrisdmitris
authored
Add TSA certificate related flags and fields for cosign attest (#4079)
* Add TSA certificate related flags and fields for cosign attest Add the following command-line flags for `cosign attest`: * timestamp-client-cacert * timestamp-client-cert * timestamp-client-key * timestamp-server-name to enable the mTLS connections to the custom TSA server using non-public CA roots. Also add the supporting fields in the AttestOptions struct. All the added fields are optional with empty defaults - not providing them should not make any difference for those who do not need them. The patch is authored by Aditya Mahendrakar (@maditya). Signed-off-by: Dmitry Savintsev <dsavints@gmail.com> * Add TSA certificate flag/fields for cosign attest-blob Signed-off-by: Dmitry Savintsev <dsavints@gmail.com> --------- Signed-off-by: Dmitry Savintsev <dsavints@gmail.com>
1 parent eac84af commit 8911168

File tree

8 files changed

+71
-5
lines changed

8 files changed

+71
-5
lines changed

‎cmd/cosign/cli/attest.go

+4
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@ func Attest() *cobra.Command {
8686
OIDCRedirectURL: o.OIDC.RedirectURL,
8787
OIDCProvider: o.OIDC.Provider,
8888
SkipConfirmation: o.SkipConfirmation,
89+
TSAClientCACert: o.TSAClientCACert,
90+
TSAClientKey: o.TSAClientKey,
91+
TSAClientCert: o.TSAClientCert,
92+
TSAServerName: o.TSAServerName,
8993
TSAServerURL: o.TSAServerURL,
9094
}
9195
attestCommand := attest.AttestCommand{

‎cmd/cosign/cli/attest/attest.go

+10-1
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,16 @@ func (c *AttestCommand) Exec(ctx context.Context, imageRef string) error {
183183
// to send to the timestamp authority based on our output format.
184184
//
185185
// See cmd/cosign/cli/attest/attest_blob.go
186-
responseBytes, err := tsa.GetTimestampedSignature(signedPayload, tsaclient.NewTSAClient(c.KeyOpts.TSAServerURL))
186+
tc := tsaclient.NewTSAClient(c.KeyOpts.TSAServerURL)
187+
if c.KeyOpts.TSAClientCert != "" {
188+
tc = tsaclient.NewTSAClientMTLS(c.KeyOpts.TSAServerURL,
189+
c.KeyOpts.TSAClientCACert,
190+
c.KeyOpts.TSAClientCert,
191+
c.KeyOpts.TSAClientKey,
192+
c.KeyOpts.TSAServerName,
193+
)
194+
}
195+
responseBytes, err := tsa.GetTimestampedSignature(signedPayload, tc)
187196
if err != nil {
188197
return err
189198
}

‎cmd/cosign/cli/attest/attest_blob.go

+13-4
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ import (
4040
"github.com/sigstore/cosign/v2/cmd/cosign/cli/rekor"
4141
"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
4242
"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa"
43-
"github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa/client"
43+
tsaclient "github.com/sigstore/cosign/v2/internal/pkg/cosign/tsa/client"
4444
"github.com/sigstore/cosign/v2/pkg/cosign"
4545
"github.com/sigstore/cosign/v2/pkg/cosign/attestation"
4646
cbundle "github.com/sigstore/cosign/v2/pkg/cosign/bundle"
@@ -165,7 +165,16 @@ func (c *AttestBlobCommand) Exec(ctx context.Context, artifactPath string) error
165165
var timestampBytes []byte
166166
var rekorEntry *models.LogEntryAnon
167167

168-
if c.TSAServerURL != "" {
168+
if c.KeyOpts.TSAServerURL != "" {
169+
tc := tsaclient.NewTSAClient(c.KeyOpts.TSAServerURL)
170+
if c.TSAClientCert != "" {
171+
tc = tsaclient.NewTSAClientMTLS(c.KeyOpts.TSAServerURL,
172+
c.KeyOpts.TSAClientCACert,
173+
c.KeyOpts.TSAClientCert,
174+
c.KeyOpts.TSAClientKey,
175+
c.KeyOpts.TSAServerName,
176+
)
177+
}
169178
// We need to decide what signature to send to the timestamp authority.
170179
//
171180
// Historically, cosign sent `sig`, which is the entire JSON DSSE
@@ -186,12 +195,12 @@ func (c *AttestBlobCommand) Exec(ctx context.Context, artifactPath string) error
186195
return err
187196
}
188197

189-
timestampBytes, err = tsa.GetTimestampedSignature(envelopeSigBytes, client.NewTSAClient(c.TSAServerURL))
198+
timestampBytes, err = tsa.GetTimestampedSignature(envelopeSigBytes, tc)
190199
if err != nil {
191200
return err
192201
}
193202
} else {
194-
timestampBytes, err = tsa.GetTimestampedSignature(sig, client.NewTSAClient(c.TSAServerURL))
203+
timestampBytes, err = tsa.GetTimestampedSignature(sig, tc)
195204
if err != nil {
196205
return err
197206
}

‎cmd/cosign/cli/attest_blob.go

+4
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ func AttestBlob() *cobra.Command {
7070
OIDCRedirectURL: o.OIDC.RedirectURL,
7171
OIDCProvider: o.OIDC.Provider,
7272
SkipConfirmation: o.SkipConfirmation,
73+
TSAClientCACert: o.TSAClientCACert,
74+
TSAClientKey: o.TSAClientKey,
75+
TSAClientCert: o.TSAClientCert,
76+
TSAServerName: o.TSAServerName,
7377
TSAServerURL: o.TSAServerURL,
7478
RFC3161TimestampPath: o.RFC3161TimestampPath,
7579
BundlePath: o.BundlePath,

‎cmd/cosign/cli/options/attest.go

+16
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ type AttestOptions struct {
2929
Replace bool
3030
SkipConfirmation bool
3131
TlogUpload bool
32+
TSAClientCACert string
33+
TSAClientCert string
34+
TSAClientKey string
35+
TSAServerName string
3236
TSAServerURL string
3337
RekorEntryType string
3438
RecordCreationTimestamp bool
@@ -85,6 +89,18 @@ func (o *AttestOptions) AddFlags(cmd *cobra.Command) {
8589
cmd.Flags().StringVar(&o.RekorEntryType, "rekor-entry-type", "dsse",
8690
"specifies the type to be used for a rekor entry upload. Options are intoto or dsse (default). ")
8791

92+
cmd.Flags().StringVar(&o.TSAClientCACert, "timestamp-client-cacert", "",
93+
"path to the X.509 CA certificate file in PEM format to be used for the connection to the TSA Server")
94+
95+
cmd.Flags().StringVar(&o.TSAClientCert, "timestamp-client-cert", "",
96+
"path to the X.509 certificate file in PEM format to be used for the connection to the TSA Server")
97+
98+
cmd.Flags().StringVar(&o.TSAClientKey, "timestamp-client-key", "",
99+
"path to the X.509 private key file in PEM format to be used, together with the 'timestamp-client-cert' value, for the connection to the TSA Server")
100+
101+
cmd.Flags().StringVar(&o.TSAServerName, "timestamp-server-name", "",
102+
"SAN name to use as the 'ServerName' tls.Config field to verify the mTLS connection to the TSA Server")
103+
88104
cmd.Flags().StringVar(&o.TSAServerURL, "timestamp-server-url", "",
89105
"url to the Timestamp RFC3161 server, default none. Must be the path to the API to request timestamp responses, e.g. https://freetsa.org/tsr")
90106

‎cmd/cosign/cli/options/attest_blob.go

+16
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ type AttestBlobOptions struct {
2626

2727
SkipConfirmation bool
2828
TlogUpload bool
29+
TSAClientCACert string
30+
TSAClientCert string
31+
TSAClientKey string
32+
TSAServerName string
2933
TSAServerURL string
3034
RFC3161TimestampPath string
3135

@@ -103,6 +107,18 @@ func (o *AttestBlobOptions) AddFlags(cmd *cobra.Command) {
103107
cmd.Flags().StringVar(&o.RekorEntryType, "rekor-entry-type", "dsse",
104108
"specifies the type to be used for a rekor entry upload. Options are intoto or dsse (default). ")
105109

110+
cmd.Flags().StringVar(&o.TSAClientCACert, "timestamp-client-cacert", "",
111+
"path to the X.509 CA certificate file in PEM format to be used for the connection to the TSA Server")
112+
113+
cmd.Flags().StringVar(&o.TSAClientCert, "timestamp-client-cert", "",
114+
"path to the X.509 certificate file in PEM format to be used for the connection to the TSA Server")
115+
116+
cmd.Flags().StringVar(&o.TSAClientKey, "timestamp-client-key", "",
117+
"path to the X.509 private key file in PEM format to be used, together with the 'timestamp-client-cert' value, for the connection to the TSA Server")
118+
119+
cmd.Flags().StringVar(&o.TSAServerName, "timestamp-server-name", "",
120+
"SAN name to use as the 'ServerName' tls.Config field to verify the mTLS connection to the TSA Server")
121+
106122
cmd.Flags().StringVar(&o.TSAServerURL, "timestamp-server-url", "",
107123
"url to the Timestamp RFC3161 server, default none. Must be the path to the API to request timestamp responses, e.g. https://freetsa.org/tsr")
108124

‎doc/cosign_attest-blob.md

+4
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎doc/cosign_attest.md

+4
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)