sigstore: verifyArtifact func to verify arbitrary artifact

Signed-off-by: CrazyMax <[email protected]>

Author: crazy-max

src/buildx/install.ts

@@ -14,15 +14,11 @@
  * limitations under the License.
  */
 
-import {X509Certificate} from 'crypto';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as core from '@actions/core';
 import * as tc from '@actions/tool-cache';
-import {bundleFromJSON, SerializedBundle} from '@sigstore/bundle';
-import * as tuf from '@sigstore/tuf';
-import {toSignedEntity, toTrustMaterial, Verifier} from '@sigstore/verify';
 import * as semver from 'semver';
 import * as util from 'util';
 
@@ -33,10 +29,12 @@ import {Exec} from '../exec';
 import {Docker} from '../docker/docker';
 import {Git} from '../git';
 import {GitHub} from '../github';
+import {Sigstore} from '../sigstore/sigstore';
 import {Util} from '../util';
 
 import {DownloadVersion} from '../types/buildx/buildx';
 import {GitHubRelease} from '../types/github';
+import {SEARCH_URL} from '../types/sigstore/sigstore';
 
 export interface DownloadOpts {
   version: string;
@@ -48,15 +46,18 @@ export interface DownloadOpts {
 export interface InstallOpts {
   standalone?: boolean;
   githubToken?: string;
+  sigstore?: Sigstore;
 }
 
 export class Install {
   private readonly standalone: boolean | undefined;
   private readonly githubToken: string | undefined;
+  private readonly sigstore: Sigstore;
 
   constructor(opts?: InstallOpts) {
     this.standalone = opts?.standalone;
     this.githubToken = opts?.githubToken || process.env.GITHUB_TOKEN;
+    this.sigstore = opts?.sigstore || new Sigstore();
   }
 
   /*
@@ -234,32 +235,12 @@ export class Install {
     const bundlePath = await tc.downloadTool(bundleURL, undefined, this.githubToken);
     core.debug(`Install.verifySignature bundlePath: ${bundlePath}`);
 
-    core.info(`Verifying keyless verification bundle signature`);
-    const parsedBundle = JSON.parse(fs.readFileSync(bundlePath, 'utf-8')) as SerializedBundle;
-    const bundle = bundleFromJSON(parsedBundle);
-
-    core.info(`Fetching Sigstore TUF trusted root metadata`);
-    const trustedRoot = await tuf.getTrustedRoot();
-    const trustMaterial = toTrustMaterial(trustedRoot);
+    const verifyResult = await this.sigstore.verifyArtifact(binPath, bundlePath, {
+      subjectAlternativeName: /^https:\/\/github\.com\/docker\/(github-builder-experimental|github-builder)\/\.github\/workflows\/bake\.yml.*$/,
+      issuer: 'https://token.actions.githubusercontent.com'
+    });
 
-    try {
-      core.info(`Verifying Buildx binary signature`);
-      const signedEntity = toSignedEntity(bundle, fs.readFileSync(binPath));
-      const signingCert = new X509Certificate(signedEntity.signature.signature);
-      if (!signingCert.subjectAltName?.match(/^https:\/\/github\.com\/docker\/(github-builder-experimental|github-builder)\/\.github\/workflows\/bake\.yml.*$/)) {
-        throw new Error(`Signing certificate subjectAlternativeName "${signingCert.subjectAltName}" does not match expected pattern`);
-      }
-      const verifier = new Verifier(trustMaterial);
-      const signer = verifier.verify(signedEntity, {
-        // FIXME: uncomment when subjectAlternativeName check with regex is supported: https://github.com/docker/actions-toolkit/pull/929#discussion_r2682150413
-        //subjectAlternativeName: /^https:\/\/github\.com\/docker\/(github-builder-experimental|github-builder)\/\.github\/workflows\/bake\.yml.*$/,
-        extensions: {issuer: 'https://token.actions.githubusercontent.com'}
-      });
-      core.debug(`Install.verifySignature signer: ${JSON.stringify(signer)}`);
-      core.info(`Buildx binary signature verified!`);
-    } catch (err) {
-      throw new Error(`Failed to verify Buildx binary signature: ${err}`);
-    }
+    core.info(`Buildx binary signature verified! ${verifyResult.tlogID ? `${SEARCH_URL}?logIndex=${verifyResult.tlogID}` : ''}`);
   }
 
   private filename(version: string): string {

src/cosign/install.ts

@@ -19,9 +19,6 @@ import os from 'os';
 import path from 'path';
 import * as core from '@actions/core';
 import * as tc from '@actions/tool-cache';
-import {bundleFromJSON, SerializedBundle} from '@sigstore/bundle';
-import * as tuf from '@sigstore/tuf';
-import {toSignedEntity, toTrustMaterial, Verifier} from '@sigstore/verify';
 import * as semver from 'semver';
 import * as util from 'util';
 
@@ -31,11 +28,13 @@ import {Context} from '../context';
 import {Exec} from '../exec';
 import {Git} from '../git';
 import {GitHub} from '../github';
+import {Sigstore} from '../sigstore/sigstore';
 import {Util} from '../util';
 
 import {DownloadVersion} from '../types/cosign/cosign';
 import {GitHubRelease} from '../types/github';
 import {dockerfileContent} from './dockerfile';
+import {SEARCH_URL} from '../types/sigstore/sigstore';
 
 export interface DownloadOpts {
   version: string;
@@ -47,15 +46,18 @@ export interface DownloadOpts {
 export interface InstallOpts {
   githubToken?: string;
   buildx?: Buildx;
+  sigstore?: Sigstore;
 }
 
 export class Install {
   private readonly githubToken: string | undefined;
   private readonly buildx: Buildx;
+  private readonly sigstore: Sigstore;
 
   constructor(opts?: InstallOpts) {
     this.githubToken = opts?.githubToken || process.env.GITHUB_TOKEN;
     this.buildx = opts?.buildx || new Buildx();
+    this.sigstore = opts?.sigstore || new Sigstore();
   }
 
   public async download(opts: DownloadOpts): Promise<string> {
@@ -196,27 +198,12 @@ export class Install {
     const bundlePath = await tc.downloadTool(bundleURL, undefined, this.githubToken);
     core.debug(`Install.verifySignature bundlePath: ${bundlePath}`);
 
-    core.info(`Verifying keyless verification bundle signature`);
-    const parsedBundle = JSON.parse(fs.readFileSync(bundlePath, 'utf-8')) as SerializedBundle;
-    const bundle = bundleFromJSON(parsedBundle);
-
-    core.info(`Fetching Sigstore TUF trusted root metadata`);
-    const trustedRoot = await tuf.getTrustedRoot();
-    const trustMaterial = toTrustMaterial(trustedRoot);
-
-    try {
-      core.info(`Verifying cosign binary signature`);
-      const signedEntity = toSignedEntity(bundle, fs.readFileSync(cosignBinPath));
-      const verifier = new Verifier(trustMaterial);
-      const signer = verifier.verify(signedEntity, {
-        subjectAlternativeName: '[email protected]',
-        extensions: {issuer: 'https://accounts.google.com'}
-      });
-      core.debug(`Install.verifySignature signer: ${JSON.stringify(signer)}`);
-      core.info(`Cosign binary signature verified!`);
-    } catch (err) {
-      throw new Error(`Failed to verify cosign binary signature: ${err}`);
-    }
+    const verifyResult = await this.sigstore.verifyArtifact(cosignBinPath, bundlePath, {
+      subjectAlternativeName: '[email protected]',
+      issuer: 'https://accounts.google.com'
+    });
+
+    core.info(`Cosign binary signature verified! ${verifyResult.tlogID ? `${SEARCH_URL}?logIndex=${verifyResult.tlogID}` : ''}`);
   }
 
   private filename(): string {

src/sigstore/sigstore.ts

@@ -19,8 +19,10 @@ import fs from 'fs';
 import path from 'path';
 
 import * as core from '@actions/core';
-import {bundleFromJSON, bundleToJSON} from '@sigstore/bundle';
+import {bundleFromJSON, bundleToJSON, SerializedBundle} from '@sigstore/bundle';
 import {Artifact, Bundle, CIContextProvider, DSSEBundleBuilder, FulcioSigner, RekorWitness, TSAWitness, Witness} from '@sigstore/sign';
+import * as tuf from '@sigstore/tuf';
+import {toSignedEntity, toTrustMaterial, Verifier} from '@sigstore/verify';
 
 import {Cosign} from '../cosign/cosign';
 import {Exec} from '../exec';
@@ -39,6 +41,8 @@ import {
   SignProvenanceBlobsOpts,
   SignProvenanceBlobsResult,
   TSASERVER_URL,
+  VerifyArtifactOpts,
+  VerifyArtifactResult,
   VerifySignedArtifactsOpts,
   VerifySignedArtifactsResult,
   VerifySignedManifestsOpts,
@@ -329,6 +333,48 @@ export class Sigstore {
     return result;
   }
 
+  public async verifyArtifact(artifactPath: string, bundlePath: string, opts?: VerifyArtifactOpts): Promise<VerifyArtifactResult> {
+    core.info(`Verifying keyless verification bundle signature`);
+    const parsedBundle = JSON.parse(fs.readFileSync(bundlePath, 'utf-8')) as SerializedBundle;
+    const bundle = bundleFromJSON(parsedBundle);
+
+    core.info(`Fetching Sigstore TUF trusted root metadata`);
+    const trustedRoot = await tuf.getTrustedRoot();
+    const trustMaterial = toTrustMaterial(trustedRoot);
+
+    try {
+      core.info(`Verifying artifact signature`);
+      const signedEntity = toSignedEntity(bundle, fs.readFileSync(artifactPath));
+      const signingCert = Sigstore.parseCertificate(bundle);
+
+      // collect transparency log ID if available
+      const tlogEntries = bundle.verificationMaterial.tlogEntries;
+      const tlogID = tlogEntries.length > 0 ? tlogEntries[0].logIndex : undefined;
+
+      // TODO: remove when subjectAlternativeName check with regex is supported: https://github.com/sigstore/sigstore-js/pull/1556
+      if (opts?.subjectAlternativeName && opts?.subjectAlternativeName instanceof RegExp) {
+        if (!signingCert.subjectAltName?.match(opts.subjectAlternativeName)) {
+          throw new Error(`Signing certificate subjectAlternativeName "${signingCert.subjectAltName}" does not match expected pattern`);
+        }
+      }
+
+      const verifier = new Verifier(trustMaterial);
+      const signer = verifier.verify(signedEntity, {
+        subjectAlternativeName: opts?.subjectAlternativeName && typeof opts.subjectAlternativeName === 'string' ? opts.subjectAlternativeName : undefined,
+        extensions: opts?.issuer ? {issuer: opts.issuer} : undefined
+      });
+      core.debug(`Sigstore.verifyArtifact signer: ${JSON.stringify(signer)}`);
+
+      return {
+        payload: parsedBundle,
+        certificate: signingCert.toString(),
+        tlogID: tlogID
+      };
+    } catch (err) {
+      throw new Error(`Failed to verify artifact signature: ${err}`);
+    }
+  }
+
   private signingEndpoints(noTransparencyLog?: boolean): Endpoints {
     noTransparencyLog = Sigstore.noTransparencyLog(noTransparencyLog);
     core.info(`Upload to transparency log: ${noTransparencyLog ? 'disabled' : 'enabled'}`);
@@ -410,6 +456,20 @@ export class Sigstore {
   }
 
   private static parseBundle(bundle: Bundle): ParsedBundle {
+    const signingCert = Sigstore.parseCertificate(bundle);
+
+    // collect transparency log ID if available
+    const tlogEntries = bundle.verificationMaterial.tlogEntries;
+    const tlogID = tlogEntries.length > 0 ? tlogEntries[0].logIndex : undefined;
+
+    return {
+      payload: bundleToJSON(bundle),
+      certificate: signingCert.toString(),
+      tlogID: tlogID
+    };
+  }
+
+  private static parseCertificate(bundle: Bundle): X509Certificate {
     let certBytes: Buffer;
     switch (bundle.verificationMaterial.content.$case) {
       case 'x509CertificateChain':
@@ -421,17 +481,6 @@ export class Sigstore {
       default:
         throw new Error('Bundle must contain an x509 certificate');
     }
-
-    const signingCert = new X509Certificate(certBytes);
-
-    // collect transparency log ID if available
-    const tlogEntries = bundle.verificationMaterial.tlogEntries;
-    const tlogID = tlogEntries.length > 0 ? tlogEntries[0].logIndex : undefined;
-
-    return {
-      payload: bundleToJSON(bundle),
-      certificate: signingCert.toString(),
-      tlogID: tlogID
-    };
+    return new X509Certificate(certBytes);
   }
 }

src/types/sigstore/sigstore.ts

@@ -78,3 +78,14 @@ export interface VerifySignedArtifactsResult {
   bundlePath: string;
   cosignArgs: Array<string>;
 }
+
+export interface VerifyArtifactOpts {
+  subjectAlternativeName: string | RegExp;
+  issuer?: string;
+}
+
+export interface VerifyArtifactResult {
+  payload: SerializedBundle;
+  certificate: string;
+  tlogID?: string;
+}