Skip to content

Commit 2b26389

Browse files
author
zaihaoyin
committed
refactor:support new signer interface
Signed-off-by: zaihaoyin <[email protected]>
1 parent edc1978 commit 2b26389

17 files changed

+412
-134
lines changed

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.18
44

55
require (
66
github.com/go-ldap/ldap/v3 v3.4.4
7-
github.com/notaryproject/notation-core-go v0.0.0-20220907034926-8cdaf86b4d7c
7+
github.com/notaryproject/notation-core-go v0.1.0-alpha.3.0.20220921042126-b9264de6f2c9
88
github.com/opencontainers/go-digest v1.0.0
99
github.com/opencontainers/image-spec v1.0.2
1010
github.com/oras-project/artifacts-spec v1.0.0-rc.2

‎go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs
1010
github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
1111
github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
1212
github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
13-
github.com/notaryproject/notation-core-go v0.0.0-20220907034926-8cdaf86b4d7c h1:myIrd0sic/mu8PRt9/jvtkMmC/eVPsB2ufBGhbAM1hg=
14-
github.com/notaryproject/notation-core-go v0.0.0-20220907034926-8cdaf86b4d7c/go.mod h1:cebNvAIpFQXqBGGJa8c13FS1ln47c5qd8E6WjeQDkAA=
13+
github.com/notaryproject/notation-core-go v0.1.0-alpha.3.0.20220921042126-b9264de6f2c9 h1:XX6d8zEwuW+TLzxU1bGJ16fS2w8SWf5udR8Lt6n7+fQ=
14+
github.com/notaryproject/notation-core-go v0.1.0-alpha.3.0.20220921042126-b9264de6f2c9/go.mod h1:mM4M9wPdu0CGgh8f3wOcu0XMiXwEKWQurjBG4nmqQ4g=
1515
github.com/opencontainers/distribution-spec/specs-go v0.0.0-20220620172159-4ab4752c3b86 h1:Oumw+lPnO8qNLTY2mrqPJZMoGExLi/0h/DdikoLTXVU=
1616
github.com/opencontainers/distribution-spec/specs-go v0.0.0-20220620172159-4ab4752c3b86/go.mod h1:aA4vdXRS8E1TG7pLZOz85InHi3BiPdErh8IpJN6E0x4=
1717
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=

‎internal/mock/mocks.go

+3-5
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
package mock
22

33
import (
4+
"context"
45
_ "embed"
5-
nsigner "github.com/notaryproject/notation-core-go/signer"
6-
)
76

8-
import (
9-
"context"
7+
"github.com/notaryproject/notation-core-go/signature"
108
"github.com/notaryproject/notation-go"
119
"github.com/notaryproject/notation-go/plugin"
1210
"github.com/notaryproject/notation-go/plugin/manager"
@@ -54,7 +52,7 @@ var (
5452
Size: 100,
5553
Annotations: Annotations,
5654
}
57-
PluginExtendedCriticalAttribute = nsigner.Attribute{
55+
PluginExtendedCriticalAttribute = signature.Attribute{
5856
Key: "SomeKey",
5957
Critical: true,
6058
Value: "SomeValue",

‎notation.go

+7-2
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,13 @@ import (
99
"github.com/opencontainers/go-digest"
1010
)
1111

12-
// SigningAgent is the unprotected header field used by signature
13-
const SigningAgent = "Notation/1.0.0"
12+
const (
13+
// SigningAgent is the unprotected header field used by signature.
14+
SigningAgent = "Notation/1.0.0"
15+
16+
// MediaTypePayloadV1 is the supported content type for signature's payload.
17+
MediaTypePayloadV1 = "application/vnd.cncf.notary.payload.v1+json"
18+
)
1419

1520
// Descriptor describes the artifact that needs to be signed.
1621
type Descriptor struct {

‎signature/envelope.go

+10-9
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,20 @@ import (
44
"errors"
55

66
"github.com/notaryproject/notation-core-go/signature"
7-
"github.com/notaryproject/notation-core-go/signature/cose"
7+
// "github.com/notaryproject/notation-core-go/signature/cose"
8+
89
"github.com/notaryproject/notation-core-go/signature/jws"
9-
gcose "github.com/veraison/go-cose"
1010
)
1111

12-
// GuessSignatureEnvelopeFormat guesses envelope format by looping all builtin envelope format.
12+
// SpeculateSignatureEnvelopeFormat guesses envelope format by looping all builtin envelope format.
1313
//
14-
// TODO: need a better way to inspect the type of envelope.
15-
func GuessSignatureEnvelopeFormat(raw []byte) (string, error) {
16-
var msg gcose.Sign1Message
17-
if err := msg.UnmarshalCBOR(raw); err == nil {
18-
return cose.MediaTypeEnvelope, nil
19-
}
14+
// TODO: find a better way to inspect the type of envelope.
15+
// TODO: support inspecting cose format
16+
func SpeculateSignatureEnvelopeFormat(raw []byte) (string, error) {
17+
// var msg gcose.Sign1Message
18+
// if err := msg.UnmarshalCBOR(raw); err == nil {
19+
// return cose.MediaTypeEnvelope, nil
20+
// }
2021
if len(raw) == 0 || raw[0] != '{' {
2122
// very certain
2223
return "", errors.New("unsupported signature format")

‎signature/envelope_test.go

+14-15
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import (
55
"errors"
66
"testing"
77

8-
"github.com/notaryproject/notation-core-go/signature/cose"
98
"github.com/notaryproject/notation-core-go/signature/jws"
109
gcose "github.com/veraison/go-cose"
1110
)
@@ -37,7 +36,7 @@ func checkErrorEqual(expected, got error) bool {
3736
return false
3837
}
3938

40-
func TestGuessSignatureEnvelopeFormat(t *testing.T) {
39+
func TestSpeculateSignatureEnvelopeFormat(t *testing.T) {
4140
tests := []struct {
4241
name string
4342
raw []byte
@@ -50,12 +49,12 @@ func TestGuessSignatureEnvelopeFormat(t *testing.T) {
5049
expectedType: jws.MediaTypeEnvelope,
5150
expectedErr: nil,
5251
},
53-
{
54-
name: "cose signature media type",
55-
raw: validCoseSignatureEnvelope,
56-
expectedType: cose.MediaTypeEnvelope,
57-
expectedErr: nil,
58-
},
52+
// {
53+
// name: "cose signature media type",
54+
// raw: validCoseSignatureEnvelope,
55+
// expectedType: cose.MediaTypeEnvelope,
56+
// expectedErr: nil,
57+
// },
5958
{
6059
name: "invalid signature media type",
6160
raw: invalidSignatureEnvelope,
@@ -65,9 +64,9 @@ func TestGuessSignatureEnvelopeFormat(t *testing.T) {
6564
}
6665
for _, tt := range tests {
6766
t.Run(tt.name, func(t *testing.T) {
68-
eType, err := GuessSignatureEnvelopeFormat(tt.raw)
67+
eType, err := SpeculateSignatureEnvelopeFormat(tt.raw)
6968
if !checkErrorEqual(tt.expectedErr, err) {
70-
t.Fatalf("expected guess signature envelope format err: %v, got: %v", tt.expectedErr, err)
69+
t.Fatalf("expected speculate signature envelope format err: %v, got: %v", tt.expectedErr, err)
7170
}
7271
if eType != tt.expectedType {
7372
t.Fatalf("expected signature envelopeType: %v, got: %v", tt.expectedType, eType)
@@ -87,11 +86,11 @@ func TestValidateEnvelopeMediaType(t *testing.T) {
8786
mediaType: jws.MediaTypeEnvelope,
8887
expectedErr: nil,
8988
},
90-
{
91-
name: "cose signature media type",
92-
mediaType: cose.MediaTypeEnvelope,
93-
expectedErr: nil,
94-
},
89+
// {
90+
// name: "cose signature media type",
91+
// mediaType: cose.MediaTypeEnvelope,
92+
// expectedErr: nil,
93+
// },
9594
{
9695
name: "invalid media type",
9796
mediaType: invalidMediaType,

‎signature/plugin.go

+12-6
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func NewSignerPlugin(runner plugin.Runner, keyID string, pluginConfig map[string
4343
}, nil
4444
}
4545

46-
// Sign signs the artifact described by its descriptor and returns the marshalled envelope
46+
// Sign signs the artifact described by its descriptor and returns the marshalled envelope.
4747
func (s *pluginSigner) Sign(ctx context.Context, desc notation.Descriptor, opts notation.SignOptions) ([]byte, error) {
4848
metadata, err := s.getMetadata(ctx)
4949
if err != nil {
@@ -119,7 +119,7 @@ func (s *pluginSigner) generateSignature(ctx context.Context, desc notation.Desc
119119
s.sigProvider.SetConfig(config)
120120
signReq := &signature.SignRequest{
121121
Payload: signature.Payload{
122-
ContentType: signature.MediaTypePayloadV1,
122+
ContentType: notation.MediaTypePayloadV1,
123123
Content: payloadBytes,
124124
},
125125
Signer: s.sigProvider,
@@ -144,10 +144,13 @@ func (s *pluginSigner) generateSignature(ctx context.Context, desc notation.Desc
144144
return nil, err
145145
}
146146

147-
_, _, verErr := sigEnv.Verify()
147+
envContent, verErr := sigEnv.Verify()
148148
if verErr != nil {
149149
return nil, fmt.Errorf("signature returned by generateSignature cannot be verified: %v", verErr)
150150
}
151+
if err := ValidatePayloadContentType(&envContent.Payload); err != nil {
152+
return nil, err
153+
}
151154

152155
// TODO: re-enable timestamping https://github.com/notaryproject/notation-go/issues/78
153156
return sig, nil
@@ -178,7 +181,7 @@ func (s *pluginSigner) generateSignatureEnvelope(ctx context.Context, desc notat
178181
KeyID: s.keyID,
179182
Payload: payloadBytes,
180183
SignatureEnvelopeType: s.envelopeMediaType,
181-
PayloadType: signature.MediaTypePayloadV1,
184+
PayloadType: notation.MediaTypePayloadV1,
182185
PluginConfig: s.mergeConfig(opts.PluginConfig),
183186
}
184187
out, err := s.sigProvider.Run(ctx, req)
@@ -203,13 +206,16 @@ func (s *pluginSigner) generateSignatureEnvelope(ctx context.Context, desc notat
203206
return nil, err
204207
}
205208

206-
sigPayload, _, err := sigEnv.Verify()
209+
envContent, err := sigEnv.Verify()
207210
if err != nil {
208211
return nil, err
209212
}
213+
if err := ValidatePayloadContentType(&envContent.Payload); err != nil {
214+
return nil, err
215+
}
210216

211217
var signedPayload notation.Payload
212-
if err = json.Unmarshal(sigPayload.Content, &signedPayload); err != nil {
218+
if err = json.Unmarshal(envContent.Payload.Content, &signedPayload); err != nil {
213219
return nil, fmt.Errorf("signed envelope payload can't be unmarshaled: %w", err)
214220
}
215221

‎signature/plugin_test.go

+13-8
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
"time"
1414

1515
"github.com/notaryproject/notation-core-go/signature"
16-
"github.com/notaryproject/notation-core-go/signature/cose"
1716
"github.com/notaryproject/notation-core-go/signature/jws"
1817

1918
"github.com/notaryproject/notation-go"
@@ -35,8 +34,8 @@ var (
3534
invalidJwsEnvelope, _ = json.Marshal(struct{}{})
3635
invalidCoseEnvelope, _ = gcose.NewSign1Message().MarshalCBOR()
3736
envelopeTypeToData = map[string][]byte{
38-
jws.MediaTypeEnvelope: invalidJwsEnvelope,
39-
cose.MediaTypeEnvelope: invalidCoseEnvelope,
37+
jws.MediaTypeEnvelope: invalidJwsEnvelope,
38+
// cose.MediaTypeEnvelope: invalidCoseEnvelope,
4039
}
4140
)
4241

@@ -488,12 +487,18 @@ func basicSignTest(t *testing.T, pluginSigner *pluginSigner) {
488487
if err != nil {
489488
t.Fatal(err)
490489
}
491-
payload, signerInfo, err := env.Verify()
490+
envContent, err := env.Verify()
492491
if err != nil {
493492
t.Fatal(err)
494493
}
495-
if payload.ContentType != signature.MediaTypePayloadV1 {
496-
t.Fatalf("Signer.Sign() Payload content type changed, expect: %v, got: %v", payload.ContentType, signature.MediaTypePayloadV1)
494+
495+
if err := ValidatePayloadContentType(&envContent.Payload); err != nil {
496+
t.Fatalf("verification failed. error = %v", err)
497+
}
498+
499+
payload, signerInfo := envContent.Payload, envContent.SignerInfo
500+
if payload.ContentType != notation.MediaTypePayloadV1 {
501+
t.Fatalf("Signer.Sign() Payload content type changed, expect: %v, got: %v", payload.ContentType, notation.MediaTypePayloadV1)
497502
}
498503
var gotPayload notation.Payload
499504
if err := json.Unmarshal(payload.Content, &gotPayload); err != nil {
@@ -503,7 +508,7 @@ func basicSignTest(t *testing.T, pluginSigner *pluginSigner) {
503508
TargetArtifact: validSignDescriptor,
504509
}
505510
if !reflect.DeepEqual(expectedPayload, gotPayload) {
506-
t.Fatalf("Signer.Sign() descriptor subject changed, expect: %v, got: %v", expectedPayload, *payload)
511+
t.Fatalf("Signer.Sign() descriptor subject changed, expect: %v, got: %v", expectedPayload, payload)
507512
}
508513
if signerInfo.SignedAttributes.SigningScheme != signature.SigningSchemeX509 {
509514
t.Fatalf("Signer.Sign() signing scheme changed, expect: %v, got: %v", signerInfo.SignedAttributes.SigningScheme, signature.SigningSchemeX509)
@@ -745,7 +750,7 @@ func TestPluginSigner_SignEnvelope_MalFormedEnvelope(t *testing.T) {
745750
sigProvider: p,
746751
envelopeMediaType: envelopeType,
747752
}
748-
var expectedErr *signature.MalformedSignatureError
753+
var expectedErr *signature.InvalidSignatureError
749754
if _, err := signer.Sign(context.Background(), notation.Descriptor{}, notation.SignOptions{}); err == nil || !errors.As(err, &expectedErr) {
750755
t.Fatalf("Signer.Sign() error = %v, want MalformedSignatureError", err)
751756
}

‎signature/signer.go

+57
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,60 @@ func NewSigner(key crypto.PrivateKey, certChain []*x509.Certificate, envelopeMed
6060
}
6161
return signer, nil
6262
}
63+
64+
// called from plugin.go
65+
// func jwsEnvelope(ctx context.Context, opts notation.SignOptions, compact string, certChain [][]byte) ([]byte, error) {
66+
// parts := strings.Split(compact, ".")
67+
// if len(parts) != 3 {
68+
// return nil, errors.New("invalid compact serialization")
69+
// }
70+
// envelope := notation.JWSEnvelope{
71+
// Protected: parts[0],
72+
// Payload: parts[1],
73+
// Signature: parts[2],
74+
// Header: notation.JWSUnprotectedHeader{
75+
// CertChain: certChain,
76+
// },
77+
// }
78+
//
79+
// // timestamp JWT
80+
// if opts.TSA != nil {
81+
// token, err := timestampSignature(ctx, envelope.Signature, opts.TSA, opts.TSAVerifyOptions)
82+
// if err != nil {
83+
// return nil, fmt.Errorf("timestamp failed: %w", err)
84+
// }
85+
// envelope.Header.TimeStampToken = token
86+
// }
87+
//
88+
// // encode in flatten JWS JSON serialization
89+
// return json.Marshal(envelope)
90+
// }
91+
92+
// local
93+
// timestampSignature sends a request to the TSA for timestamping the signature.
94+
// func timestampSignature(ctx context.Context, sig string, tsa timestamp.Timestamper, opts x509.VerifyOptions) ([]byte, error) {
95+
// // timestamp the signature
96+
// decodedSig, err := base64.RawURLEncoding.DecodeString(sig)
97+
// if err != nil {
98+
// return nil, err
99+
// }
100+
// req, err := timestamp.NewRequestFromBytes(decodedSig)
101+
// if err != nil {
102+
// return nil, err
103+
// }
104+
// resp, err := tsa.Timestamp(ctx, req)
105+
// if err != nil {
106+
// return nil, err
107+
// }
108+
// if status := resp.Status; status.Status != pki.StatusGranted {
109+
// return nil, fmt.Errorf("tsa: %d: %v", status.Status, status.StatusString)
110+
// }
111+
// tokenBytes := resp.TokenBytes()
112+
//
113+
// // verify the timestamp signature
114+
// if _, err := verifyTimestamp(decodedSig, tokenBytes, opts.Roots); err != nil {
115+
// return nil, err
116+
// }
117+
//
118+
// return tokenBytes, nil
119+
// }

‎signature/signer_test.go

+6-3
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ var keyCertPairCollections []*keyCertPair
3333

3434
const testKeyID = "testKeyID"
3535

36-
// setUpKeyCertPairCollections setups all combinations of private key and certificates
36+
// setUpKeyCertPairCollections setups all combinations of private key and certificates.
3737
func setUpKeyCertPairCollections() []*keyCertPair {
3838
// rsa
3939
var keyCertPairs []*keyCertPair
@@ -321,12 +321,15 @@ func basicVerification(t *testing.T, sig []byte, envelopeType string, trust *x50
321321
t.Fatalf("verification failed. error = %v", err)
322322
}
323323

324-
_, sigInfo, vErr := sigEnv.Verify()
324+
envContent, vErr := sigEnv.Verify()
325325
if vErr != nil {
326326
t.Fatalf("verification failed. error = %v", err)
327327
}
328+
if err := ValidatePayloadContentType(&envContent.Payload); err != nil {
329+
t.Fatalf("verification failed. error = %v", err)
330+
}
328331

329-
trustedCert, err := signature.VerifyAuthenticity(sigInfo, []*x509.Certificate{trust})
332+
trustedCert, err := signature.VerifyAuthenticity(&envContent.SignerInfo, []*x509.Certificate{trust})
330333

331334
if err != nil || !trustedCert.Equal(trust) {
332335
t.Fatalf("VerifyAuthenticity failed. error = %v", err)

0 commit comments

Comments
 (0)