-
Notifications
You must be signed in to change notification settings - Fork 43
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactor: refactor pluginSigner to support new signature interface (#131
) ## What Refactor `notation-go` to support multiple envelope types. Background can be checked in notaryproject/notation#278 I wthe whole PR into two PRs to help review, this is the first PR. More unit test cases will be added in the next PR. The whole picture is here #146 ## Major Changes - Use package `github.com/notaryproject/notation-core-go/signature` to sign and verify. - Combine `runner` and `signer` into a `provider` for `pluginSigner` to sign and remove the `pluginSigProvider`. - Add `builtinProvider` to support local signing and `externalProvider` to support signing by plugin. - Move the payload media type and its checks to `signature` package as mentioned in notaryproject/notation-core-go#73 - Support new [keySpec](https://github.com/notaryproject/notaryproject/blob/main/signature-specification.md#algorithm-selection) and plugin contract. - Get verification plugin and version from extended attributes. - Add `SpeculateSignatureEnvelopeFormat` to inspect signature (This function may change later to better inspect a signature) - Add sign/verify from file test cases. Signed-off-by: zaihaoyin <[email protected]> Signed-off-by: zaihaoyin <[email protected]> Co-authored-by: zaihaoyin <[email protected]>
- Loading branch information
Showing
21 changed files
with
1,668 additions
and
647 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,156 @@ | ||
| package plugin | ||
|
|
||
| import ( | ||
| "errors" | ||
|
|
||
| "github.com/notaryproject/notation-core-go/signature" | ||
| ) | ||
|
|
||
| // one of the following supported key spec names. | ||
| // | ||
| // https://github.com/notaryproject/notaryproject/blob/main/signature-specification.md#algorithm-selection | ||
| const ( | ||
| RSA_2048 = "RSA-2048" | ||
| RSA_3072 = "RSA-3072" | ||
| RSA_4096 = "RSA-4096" | ||
| EC_256 = "EC-256" | ||
| EC_384 = "EC-384" | ||
| EC_521 = "EC-521" | ||
| ) | ||
|
|
||
| // one of the following supported hash algorithm names. | ||
| // | ||
| // https://github.com/notaryproject/notaryproject/blob/main/signature-specification.md#algorithm-selection | ||
| const ( | ||
| SHA_256 = "SHA-256" | ||
| SHA_384 = "SHA-384" | ||
| SHA_512 = "SHA-512" | ||
| ) | ||
|
|
||
| // one of the following supported signing algorithm names. | ||
| // | ||
| // https://github.com/notaryproject/notaryproject/blob/main/signature-specification.md#algorithm-selection | ||
| const ( | ||
| ECDSA_SHA_256 = "ECDSA-SHA-256" | ||
| ECDSA_SHA_384 = "ECDSA-SHA-384" | ||
| ECDSA_SHA_512 = "ECDSA-SHA-512" | ||
| RSASSA_PSS_SHA_256 = "RSASSA-PSS-SHA-256" | ||
| RSASSA_PSS_SHA_384 = "RSASSA-PSS-SHA-384" | ||
| RSASSA_PSS_SHA_512 = "RSASSA-PSS-SHA-512" | ||
| ) | ||
|
|
||
| // KeySpecName returns the name of a keySpec according to the spec. | ||
| func KeySpecString(k signature.KeySpec) string { | ||
| switch k.Type { | ||
| case signature.KeyTypeEC: | ||
| switch k.Size { | ||
| case 256: | ||
| return EC_256 | ||
| case 384: | ||
| return EC_384 | ||
| case 521: | ||
| return EC_521 | ||
| } | ||
| case signature.KeyTypeRSA: | ||
| switch k.Size { | ||
| case 2048: | ||
| return RSA_2048 | ||
| case 3072: | ||
| return RSA_3072 | ||
| case 4096: | ||
| return RSA_4096 | ||
| } | ||
| } | ||
| return "" | ||
| } | ||
|
|
||
| // KeySpecHashName returns the name of hash function according to the spec. | ||
| func KeySpecHashString(k signature.KeySpec) string { | ||
| switch k.Type { | ||
| case signature.KeyTypeEC: | ||
| switch k.Size { | ||
| case 256: | ||
| return SHA_256 | ||
| case 384: | ||
| return SHA_384 | ||
| case 521: | ||
| return SHA_512 | ||
| } | ||
| case signature.KeyTypeRSA: | ||
| switch k.Size { | ||
| case 2048: | ||
| return SHA_256 | ||
| case 3072: | ||
| return SHA_384 | ||
| case 4096: | ||
| return SHA_512 | ||
| } | ||
| } | ||
| return "" | ||
| } | ||
|
|
||
| // ParseKeySpecFromName parses keySpec name to a signature.keySpec type. | ||
| func ParseKeySpec(raw string) (keySpec signature.KeySpec, err error) { | ||
| switch raw { | ||
| case RSA_2048: | ||
| keySpec.Size = 2048 | ||
| keySpec.Type = signature.KeyTypeRSA | ||
| case RSA_3072: | ||
| keySpec.Size = 3072 | ||
| keySpec.Type = signature.KeyTypeRSA | ||
| case RSA_4096: | ||
| keySpec.Size = 4096 | ||
| keySpec.Type = signature.KeyTypeRSA | ||
| case EC_256: | ||
| keySpec.Size = 256 | ||
| keySpec.Type = signature.KeyTypeEC | ||
| case EC_384: | ||
| keySpec.Size = 384 | ||
| keySpec.Type = signature.KeyTypeEC | ||
| case EC_521: | ||
| keySpec.Size = 521 | ||
| keySpec.Type = signature.KeyTypeEC | ||
| default: | ||
| keySpec = signature.KeySpec{} | ||
| err = errors.New("unknown key spec") | ||
| } | ||
| return | ||
| } | ||
|
|
||
| // SigningAlgorithmName returns the signing algorithm name of an algorithm according to the spec. | ||
| func SigningAlgorithmString(alg signature.Algorithm) string { | ||
| switch alg { | ||
| case signature.AlgorithmES256: | ||
| return ECDSA_SHA_256 | ||
| case signature.AlgorithmES384: | ||
| return ECDSA_SHA_384 | ||
| case signature.AlgorithmES512: | ||
| return ECDSA_SHA_512 | ||
| case signature.AlgorithmPS256: | ||
| return RSASSA_PSS_SHA_256 | ||
| case signature.AlgorithmPS384: | ||
| return RSASSA_PSS_SHA_384 | ||
| case signature.AlgorithmPS512: | ||
| return RSASSA_PSS_SHA_512 | ||
| } | ||
| return "" | ||
| } | ||
|
|
||
| // ParseSigningAlgorithFromName parses the signing algorithm name from a given string. | ||
| func ParseSigningAlgorithm(raw string) (signature.Algorithm, error) { | ||
| switch raw { | ||
| case ECDSA_SHA_256: | ||
| return signature.AlgorithmES256, nil | ||
| case ECDSA_SHA_384: | ||
| return signature.AlgorithmES384, nil | ||
| case ECDSA_SHA_512: | ||
| return signature.AlgorithmES512, nil | ||
| case RSASSA_PSS_SHA_256: | ||
| return signature.AlgorithmPS256, nil | ||
| case RSASSA_PSS_SHA_384: | ||
| return signature.AlgorithmPS384, nil | ||
| case RSASSA_PSS_SHA_512: | ||
| return signature.AlgorithmPS512, nil | ||
| } | ||
| return 0, errors.New("unknown signing algorithm") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| package signature | ||
|
|
||
| import ( | ||
| "errors" | ||
|
|
||
| "github.com/notaryproject/notation-core-go/signature" | ||
| ) | ||
|
|
||
| // ValidateEnvelopeMediaType validetes envelope media type is supported by notation-core-go. | ||
| func ValidateEnvelopeMediaType(mediaType string) error { | ||
| for _, types := range signature.RegisteredEnvelopeTypes() { | ||
| if mediaType == types { | ||
| return nil | ||
| } | ||
| } | ||
| return errors.New("invalid envelope media type") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| package signature | ||
|
|
||
| import ( | ||
| "errors" | ||
| "testing" | ||
|
|
||
| "github.com/notaryproject/notation-core-go/signature/jws" | ||
| ) | ||
|
|
||
| const invalidMediaType = "invalid" | ||
|
|
||
| func checkErrorEqual(expected, got error) bool { | ||
| if expected == nil && got == nil { | ||
| return true | ||
| } | ||
| if expected != nil && got != nil { | ||
| return expected.Error() == got.Error() | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| func TestValidateEnvelopeMediaType(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| mediaType string | ||
| expectedErr error | ||
| }{ | ||
| { | ||
| name: "jws signature media type", | ||
| mediaType: jws.MediaTypeEnvelope, | ||
| expectedErr: nil, | ||
| }, | ||
| { | ||
| name: "invalid media type", | ||
| mediaType: invalidMediaType, | ||
| expectedErr: errors.New("invalid envelope media type"), | ||
| }, | ||
| } | ||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| if err := ValidateEnvelopeMediaType(tt.mediaType); !checkErrorEqual(tt.expectedErr, err) { | ||
| t.Fatalf("expected validate envelope media type err: %v, got: %v", tt.expectedErr, err) | ||
| } | ||
| }) | ||
| } | ||
| } |
Oops, something went wrong.