Skip to content

Commit d4b1419

Browse files
wlynchwlynch
committed
Add go-git based signer implementation.
Adds a git.Signer implementation + e2e test to demonstrate how signing is done. Verify still WIP upstream, so commit marshalling + verification still done manually for now. Signed-off-by: Billy Lynch <billy@chainguard.dev>
1 parent 57153a0 commit d4b1419

File tree

8 files changed

+255
-18
lines changed

8 files changed

+255
-18
lines changed

‎e2e/sign_test.go

+115
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
// Copyright 2024 The Sigstore Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
//go:build e2e
16+
// +build e2e
17+
18+
package e2e
19+
20+
import (
21+
"context"
22+
"encoding/json"
23+
"os"
24+
"testing"
25+
"time"
26+
27+
"github.com/go-git/go-billy/v5/memfs"
28+
"github.com/go-git/go-git/v5"
29+
"github.com/go-git/go-git/v5/plumbing/object"
30+
"github.com/go-git/go-git/v5/storage/memory"
31+
"github.com/sigstore/cosign/v2/pkg/providers"
32+
"github.com/sigstore/gitsign/internal/git/gittest"
33+
"github.com/sigstore/gitsign/pkg/fulcio"
34+
gsgit "github.com/sigstore/gitsign/pkg/git"
35+
"github.com/sigstore/gitsign/pkg/gitsign"
36+
"github.com/sigstore/gitsign/pkg/rekor"
37+
"github.com/sigstore/sigstore/pkg/oauth"
38+
"github.com/sigstore/sigstore/pkg/oauthflow"
39+
)
40+
41+
func TestSign(t *testing.T) {
42+
ctx := context.Background()
43+
44+
var flow oauthflow.TokenGetter = &oauthflow.InteractiveIDTokenGetter{
45+
HTMLPage: oauth.InteractiveSuccessHTML,
46+
}
47+
if providers.Enabled(ctx) {
48+
// If automatic token provisioning is enabled, use it.
49+
token, err := providers.Provide(ctx, "sigstore")
50+
if err != nil {
51+
t.Fatal(err)
52+
}
53+
flow = &oauthflow.StaticTokenGetter{
54+
RawToken: token,
55+
}
56+
}
57+
fulcio, err := fulcio.NewClient("https://fulcio.sigstore.dev", fulcio.OIDCOptions{
58+
ClientID: "sigstore",
59+
Issuer: "https://oauth2.sigstore.dev/auth",
60+
TokenGetter: flow,
61+
})
62+
if err != nil {
63+
t.Fatal(err)
64+
}
65+
rekor, err := rekor.NewWithOptions(ctx, "https://rekor.sigstore.dev")
66+
if err != nil {
67+
t.Fatal(err)
68+
}
69+
signer, err := gitsign.NewSigner(ctx, fulcio, rekor)
70+
if err != nil {
71+
t.Fatal(err)
72+
}
73+
74+
// Make a commit + sign it
75+
storage := memory.NewStorage()
76+
repo, err := git.Init(storage, memfs.New())
77+
if err != nil {
78+
panic(err)
79+
}
80+
w, err := repo.Worktree()
81+
if err != nil {
82+
panic(err)
83+
}
84+
sha, err := w.Commit("example commit", &git.CommitOptions{
85+
Author: &object.Signature{
86+
Name: "John Doe",
87+
Email: "john@example.com",
88+
When: time.UnixMicro(1234567890).UTC(),
89+
},
90+
Signer: signer,
91+
AllowEmptyCommits: true,
92+
})
93+
if err != nil {
94+
t.Fatal(err)
95+
}
96+
commit, err := repo.CommitObject(sha)
97+
if err != nil {
98+
t.Fatal(err)
99+
}
100+
body := gittest.MarshalCommitBody(t, commit)
101+
sig := []byte(commit.PGPSignature)
102+
103+
// Verify the commit
104+
verifier, err := gsgit.NewDefaultVerifier(ctx)
105+
if err != nil {
106+
t.Fatal(err)
107+
}
108+
summary, err := gsgit.Verify(ctx, verifier, rekor, body, sig, true)
109+
if err != nil {
110+
t.Fatal(err)
111+
}
112+
enc := json.NewEncoder(os.Stdout)
113+
enc.SetIndent("", " ")
114+
enc.Encode(summary.LogEntry)
115+
}

‎go.mod

+6-5
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ require (
99
github.com/coreos/go-systemd/v22 v22.5.0
1010
github.com/github/smimesign v0.2.0
1111
github.com/go-git/go-billy/v5 v5.5.0
12-
github.com/go-git/go-git/v5 v5.11.0
12+
github.com/go-git/go-git/v5 v5.11.1-0.20240221104814-686a0f7a4928
1313
github.com/go-openapi/runtime v0.27.1
1414
github.com/go-openapi/strfmt v0.22.0
1515
github.com/go-openapi/swag v0.22.9
@@ -18,6 +18,7 @@ require (
1818
github.com/jonboulle/clockwork v0.4.0
1919
github.com/mattn/go-tty v0.0.5
2020
github.com/patrickmn/go-cache v2.1.0+incompatible
21+
github.com/psanford/memfs v0.0.0-20230130182539-4dbf7e3e865e
2122
github.com/secure-systems-lab/go-securesystemslib v0.8.0
2223
github.com/sigstore/cosign/v2 v2.2.3
2324
github.com/sigstore/fulcio v1.4.3
@@ -48,7 +49,7 @@ require (
4849
github.com/Azure/go-autorest/logger v0.2.1 // indirect
4950
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
5051
github.com/Microsoft/go-winio v0.6.1 // indirect
51-
github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c // indirect
52+
github.com/ProtonMail/go-crypto v1.0.0 // indirect
5253
github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
5354
github.com/alibabacloud-go/alibabacloud-gateway-spi v0.0.4 // indirect
5455
github.com/alibabacloud-go/cr-20160607 v1.0.1 // indirect
@@ -168,7 +169,7 @@ require (
168169
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
169170
github.com/sassoftware/relic v7.2.1+incompatible // indirect
170171
github.com/segmentio/ksuid v1.0.4 // indirect
171-
github.com/sergi/go-diff v1.3.1 // indirect
172+
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
172173
github.com/shibumi/go-pathspec v1.3.0 // indirect
173174
github.com/sigstore/timestamp-authority v1.2.1 // indirect
174175
github.com/sirupsen/logrus v1.9.3 // indirect
@@ -200,14 +201,14 @@ require (
200201
go.uber.org/multierr v1.11.0 // indirect
201202
go.uber.org/zap v1.26.0 // indirect
202203
golang.org/x/exp v0.0.0-20231108232855-2478ac86f678 // indirect
203-
golang.org/x/mod v0.14.0 // indirect
204+
golang.org/x/mod v0.15.0 // indirect
204205
golang.org/x/net v0.21.0 // indirect
205206
golang.org/x/sync v0.6.0 // indirect
206207
golang.org/x/sys v0.17.0 // indirect
207208
golang.org/x/term v0.17.0 // indirect
208209
golang.org/x/text v0.14.0 // indirect
209210
golang.org/x/time v0.5.0 // indirect
210-
golang.org/x/tools v0.16.1 // indirect
211+
golang.org/x/tools v0.18.0 // indirect
211212
google.golang.org/api v0.159.0 // indirect
212213
google.golang.org/appengine v1.6.8 // indirect
213214
google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac // indirect

‎go.sum

+13-6
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
5757
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
5858
github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
5959
github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
60-
github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c h1:kMFnB0vCcX7IL/m9Y5LO+KQYv+t1CQOiFe6+SV2J7bE=
61-
github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
60+
github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
61+
github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
6262
github.com/ThalesIgnite/crypto11 v1.2.5 h1:1IiIIEqYmBvUYFeMnHqRft4bwf/O36jryEUpY+9ef8E=
6363
github.com/ThalesIgnite/crypto11 v1.2.5/go.mod h1:ILDKtnCKiQ7zRoNxcp36Y1ZR8LBPmR2E23+wTQe/MlE=
6464
github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
@@ -253,8 +253,8 @@ github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+
253253
github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
254254
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
255255
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
256-
github.com/go-git/go-git/v5 v5.11.0 h1:XIZc1p+8YzypNr34itUfSvYJcv+eYdTnTvOZ2vD3cA4=
257-
github.com/go-git/go-git/v5 v5.11.0/go.mod h1:6GFcX2P3NM7FPBfpePbpLd21XxsgdAt+lKqXmCUiUCY=
256+
github.com/go-git/go-git/v5 v5.11.1-0.20240221104814-686a0f7a4928 h1:KhFQZmW7PuR0d4GySsCkCPlLXbAUCBlcKxcnd6e0ATA=
257+
github.com/go-git/go-git/v5 v5.11.1-0.20240221104814-686a0f7a4928/go.mod h1:bjjasRHBEKHquuJUiVxAokJncx14xMhH6v/iguEEPTc=
258258
github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
259259
github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
260260
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -338,6 +338,7 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
338338
github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
339339
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
340340
github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
341+
github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
341342
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
342343
github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
343344
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -534,6 +535,8 @@ github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lne
534535
github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
535536
github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
536537
github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
538+
github.com/psanford/memfs v0.0.0-20230130182539-4dbf7e3e865e h1:51xcRlSMBU5rhM9KahnJGfEsBPVPz3182TgFRowA8yY=
539+
github.com/psanford/memfs v0.0.0-20230130182539-4dbf7e3e865e/go.mod h1:tcaRap0jS3eifrEEllL6ZMd9dg8IlDpi2S1oARrQ+NI=
537540
github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
538541
github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
539542
github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
@@ -552,8 +555,8 @@ github.com/secure-systems-lab/go-securesystemslib v0.8.0 h1:mr5An6X45Kb2nddcFlbm
552555
github.com/secure-systems-lab/go-securesystemslib v0.8.0/go.mod h1:UH2VZVuJfCYR8WgMlCU1uFsOUU+KeyrTWcSS73NBOzU=
553556
github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
554557
github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
555-
github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
556-
github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
558+
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
559+
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
557560
github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
558561
github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
559562
github.com/sigstore/cosign/v2 v2.2.3 h1:WX7yawI+EXu9h7S5bZsfYCbB9XW6Jc43ctKy/NoOSiA=
@@ -716,6 +719,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
716719
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
717720
golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
718721
golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
722+
golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
723+
golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
719724
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
720725
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
721726
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -827,6 +832,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
827832
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
828833
golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
829834
golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
835+
golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
836+
golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
830837
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
831838
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
832839
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎internal/fulcio/identity.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434
"github.com/sigstore/gitsign/internal/config"
3535
"github.com/sigstore/gitsign/internal/fulcio/fulcioroots"
3636
"github.com/sigstore/gitsign/internal/signerverifier"
37+
"github.com/sigstore/gitsign/pkg/fulcio"
3738
"github.com/sigstore/sigstore/pkg/oauth"
3839
"github.com/sigstore/sigstore/pkg/oauthflow"
3940
"github.com/sigstore/sigstore/pkg/signature"
@@ -233,8 +234,8 @@ func (f *IdentityFactory) NewIdentity(ctx context.Context, cfg *config.Config) (
233234
return nil, fmt.Errorf("generating private key: %w", err)
234235
}
235236

236-
client, err := NewClient(cfg.Fulcio,
237-
OIDCOptions{
237+
client, err := fulcio.NewClient(cfg.Fulcio,
238+
fulcio.OIDCOptions{
238239
Issuer: cfg.Issuer,
239240
ClientID: clientID,
240241
RedirectURL: cfg.RedirectURL,

‎internal/fulcio/fulcio.go ‎pkg/fulcio/fulcio.go

+8-4
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,13 @@ import (
2727
"github.com/sigstore/sigstore/pkg/oauthflow"
2828
)
2929

30+
type Client interface {
31+
GetCert(crypto.Signer) (*api.CertificateResponse, error)
32+
}
33+
3034
// Client provides a fulcio client with helpful options for configuring OIDC
3135
// flows.
32-
type Client struct {
36+
type ClientImpl struct {
3337
api.LegacyClient
3438
oidc OIDCOptions
3539
}
@@ -43,20 +47,20 @@ type OIDCOptions struct {
4347
TokenGetter oauthflow.TokenGetter
4448
}
4549

46-
func NewClient(fulcioURL string, opts OIDCOptions) (*Client, error) {
50+
func NewClient(fulcioURL string, opts OIDCOptions) (*ClientImpl, error) {
4751
u, err := url.Parse(fulcioURL)
4852
if err != nil {
4953
return nil, err
5054
}
5155
client := api.NewClient(u, api.WithUserAgent("gitsign"))
52-
return &Client{
56+
return &ClientImpl{
5357
LegacyClient: client,
5458
oidc: opts,
5559
}, nil
5660
}
5761

5862
// GetCert exchanges the given private key for a Fulcio certificate.
59-
func (c *Client) GetCert(priv crypto.Signer) (*api.CertificateResponse, error) {
63+
func (c *ClientImpl) GetCert(priv crypto.Signer) (*api.CertificateResponse, error) {
6064
pubBytes, err := x509.MarshalPKIXPublicKey(priv.Public())
6165
if err != nil {
6266
return nil, err

‎internal/fulcio/fulcio_test.go ‎pkg/fulcio/fulcio_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ func TestGetCert(t *testing.T) {
120120
key, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
121121
email := "foo@example.com"
122122

123-
client := &Client{
123+
client := &ClientImpl{
124124
// fakeFulcio is what will be doing the validation.
125125
LegacyClient: &fakeFulcio{
126126
signer: key,

‎pkg/git/verifier.go

+15
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ import (
2323
"time"
2424

2525
cms "github.com/sigstore/gitsign/internal/fork/ietf-cms"
26+
"github.com/sigstore/gitsign/internal/fulcio/fulcioroots"
27+
"github.com/sigstore/sigstore/pkg/tuf"
2628
)
2729

2830
// Verifier verifies git commit signature data.
@@ -139,3 +141,16 @@ func (v *CertVerifier) Verify(_ context.Context, data, sig []byte, detached bool
139141

140142
return cert, nil
141143
}
144+
145+
// NewDefaultVerifier returns a new CertVerifier with the default Fulcio roots loaded from the local TUF client.
146+
// See https://docs.sigstore.dev/system_config/custom_components/ for how to customize this behavior.
147+
func NewDefaultVerifier(ctx context.Context) (*CertVerifier, error) {
148+
if err := tuf.Initialize(ctx, tuf.DefaultRemoteRoot, nil); err != nil {
149+
return nil, err
150+
}
151+
root, intermediate, err := fulcioroots.New(x509.NewCertPool(), fulcioroots.FromTUF(ctx))
152+
if err != nil {
153+
return nil, err
154+
}
155+
return NewCertVerifier(WithRootPool(root), WithIntermediatePool(intermediate))
156+
}

0 commit comments

Comments
 (0)