Skip to content

Commit 8f5d387

Browse files
author
zaihaoyin
committed
refactor:refactor pluginSigner to support cose envelope
Signed-off-by: zaihaoyin <[email protected]>
1 parent a9fb055 commit 8f5d387

14 files changed

+1574
-710
lines changed

go.mod

+5-2
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,21 @@ go 1.17
44

55
require (
66
github.com/go-ldap/ldap/v3 v3.4.4
7-
github.com/golang-jwt/jwt/v4 v4.4.2
8-
github.com/notaryproject/notation-core-go v0.1.0-alpha.3
7+
github.com/notaryproject/notation-core-go v0.0.0-20220907034926-8cdaf86b4d7c
98
github.com/opencontainers/go-digest v1.0.0
109
github.com/opencontainers/image-spec v1.0.2
1110
github.com/oras-project/artifacts-spec v1.0.0-rc.2
11+
github.com/veraison/go-cose v1.0.0-rc.1.0.20220824135457-9d2fab636b83
1212
oras.land/oras-go/v2 v2.0.0-rc.2
1313
)
1414

1515
require (
1616
github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e // indirect
17+
github.com/fxamacker/cbor/v2 v2.4.0 // indirect
1718
github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
19+
github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
1820
github.com/opencontainers/distribution-spec/specs-go v0.0.0-20220620172159-4ab4752c3b86 // indirect
21+
github.com/x448/float16 v0.8.4 // indirect
1922
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d // indirect
2023
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
2124
)

go.sum

+8-2
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,16 @@ github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e h1:NeAW1fUYUEWhft
22
github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
33
github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
44
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5+
github.com/fxamacker/cbor/v2 v2.4.0 h1:ri0ArlOR+5XunOP8CRUowT0pSJOwhW098ZCUyskZD88=
6+
github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
57
github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
68
github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
79
github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
810
github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
911
github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
1012
github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
11-
github.com/notaryproject/notation-core-go v0.1.0-alpha.3 h1:gzB+h5TGzuocWiJxuYZgE/FwUIbJyKAHfk2hWSBbCGg=
12-
github.com/notaryproject/notation-core-go v0.1.0-alpha.3/go.mod h1:Wfyh5SrQ718JegKPhTs7y74rXg86tWd5NfOx2uHK1nI=
13+
github.com/notaryproject/notation-core-go v0.0.0-20220907034926-8cdaf86b4d7c h1:myIrd0sic/mu8PRt9/jvtkMmC/eVPsB2ufBGhbAM1hg=
14+
github.com/notaryproject/notation-core-go v0.0.0-20220907034926-8cdaf86b4d7c/go.mod h1:cebNvAIpFQXqBGGJa8c13FS1ln47c5qd8E6WjeQDkAA=
1315
github.com/opencontainers/distribution-spec/specs-go v0.0.0-20220620172159-4ab4752c3b86 h1:Oumw+lPnO8qNLTY2mrqPJZMoGExLi/0h/DdikoLTXVU=
1416
github.com/opencontainers/distribution-spec/specs-go v0.0.0-20220620172159-4ab4752c3b86/go.mod h1:aA4vdXRS8E1TG7pLZOz85InHi3BiPdErh8IpJN6E0x4=
1517
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -23,6 +25,10 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN
2325
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
2426
github.com/stretchr/testify v1.7.2 h1:4jaiDzPyXQvSd7D0EjG45355tLlV3VOECpq10pLC+8s=
2527
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
28+
github.com/veraison/go-cose v1.0.0-rc.1.0.20220824135457-9d2fab636b83 h1:g8vDfnNOPcGzg6mnlBGc0J5t5lAJkaepXqbc9qFRnFs=
29+
github.com/veraison/go-cose v1.0.0-rc.1.0.20220824135457-9d2fab636b83/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4=
30+
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
31+
github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
2632
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d h1:sK3txAijHtOK88l68nt020reeT1ZdKLIYetKl95FzVY=
2733
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
2834
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=

notation.go

+5-3
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ import (
99
"github.com/opencontainers/go-digest"
1010
)
1111

12-
// Media type for Notary payload for OCI artifacts, which contains an artifact descriptor.
13-
const MediaTypePayload = "application/vnd.cncf.notary.payload.v1+json"
12+
// SigningAgent is the unprotected header field used by signature
13+
const SigningAgent = "Notation/1.0.0"
1414

1515
// Descriptor describes the artifact that needs to be signed.
1616
type Descriptor struct {
@@ -65,7 +65,9 @@ type Signer interface {
6565
}
6666

6767
// VerifyOptions contains parameters for Verifier.Verify.
68-
type VerifyOptions struct{}
68+
type VerifyOptions struct {
69+
SignatureMediaType string
70+
}
6971

7072
// Validate does basic validation on VerifyOptions.
7173
func (opts VerifyOptions) Validate() error {

plugin/plugin.go

+11-12
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ package plugin
33
import (
44
"context"
55
"time"
6-
7-
"github.com/notaryproject/notation-core-go/signer"
86
)
97

108
// Prefix is the prefix required on all plugin binary names.
@@ -127,17 +125,18 @@ type DescribeKeyResponse struct {
127125

128126
// One of following supported key types:
129127
// https://github.com/notaryproject/notaryproject/blob/main/signature-specification.md#algorithm-selection
130-
KeySpec signer.KeySpec `json:"keySpec"`
128+
KeySpec string `json:"keySpec"`
131129
}
132130

133131
// GenerateSignatureRequest contains the parameters passed in a generate-signature request.
132+
// do we still need keyspec and hash?
134133
type GenerateSignatureRequest struct {
135-
ContractVersion string `json:"contractVersion"`
136-
KeyID string `json:"keyId"`
137-
KeySpec signer.KeySpec `json:"keySpec"`
138-
Hash signer.HashAlgorithm `json:"hashAlgorithm"`
139-
Payload []byte `json:"payload"`
140-
PluginConfig map[string]string `json:"pluginConfig,omitempty"`
134+
ContractVersion string `json:"contractVersion"`
135+
KeyID string `json:"keyId"`
136+
Payload []byte `json:"payload"`
137+
KeySpec string `json:"keySpec"`
138+
Hash string `json:"hashAlgorithm"`
139+
PluginConfig map[string]string `json:"pluginConfig,omitempty"`
141140
}
142141

143142
func (GenerateSignatureRequest) Command() Command {
@@ -146,9 +145,9 @@ func (GenerateSignatureRequest) Command() Command {
146145

147146
// GenerateSignatureResponse is the response of a generate-signature request.
148147
type GenerateSignatureResponse struct {
149-
KeyID string `json:"keyId"`
150-
Signature []byte `json:"signature"`
151-
SigningAlgorithm signer.SignatureAlgorithm `json:"signingAlgorithm"`
148+
KeyID string `json:"keyId"`
149+
Signature []byte `json:"signature"`
150+
SigningAlgorithm string `json:"signingAlgorithm"`
152151

153152
// Ordered list of certificates starting with leaf certificate
154153
// and ending with root certificate.

signature/algorithm.go

+159
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
package signature
2+
3+
import (
4+
"errors"
5+
6+
"github.com/notaryproject/notation-core-go/signature"
7+
)
8+
9+
// one of the following supported key spec names.
10+
//
11+
// https://github.com/notaryproject/notaryproject/blob/main/signature-specification.md#algorithm-selection
12+
const (
13+
RSA_2048 = "RSA-2048"
14+
RSA_3072 = "RSA-3072"
15+
RSA_4096 = "RSA-4096"
16+
EC_256 = "EC-256"
17+
EC_384 = "EC-384"
18+
EC_521 = "EC-521"
19+
)
20+
21+
// one of the following supported hash algorithm names.
22+
//
23+
// https://github.com/notaryproject/notaryproject/blob/main/signature-specification.md#algorithm-selection
24+
const (
25+
SHA_256 = "SHA-256"
26+
SHA_384 = "SHA-384"
27+
SHA_512 = "SHA-512"
28+
)
29+
30+
// one of the following supported signing algorithm names.
31+
//
32+
// https://github.com/notaryproject/notaryproject/blob/main/signature-specification.md#algorithm-selection
33+
const (
34+
ECDSA_SHA_256 = "ECDSA-SHA-256"
35+
ECDSA_SHA_384 = "ECDSA-SHA-384"
36+
ECDSA_SHA_512 = "ECDSA-SHA-512"
37+
RSASSA_PSS_SHA_256 = "RSASSA-PSS-SHA-256"
38+
RSASSA_PSS_SHA_384 = "RSASSA-PSS-SHA-384"
39+
RSASSA_PSS_SHA_512 = "RSASSA-PSS-SHA-512"
40+
)
41+
42+
// InvalidKeySpec is the invalid value of keySpec.
43+
var InvalidKeySpec = signature.KeySpec{}
44+
45+
// KeySpecName returns the name of a keySpec according to the spec.
46+
func KeySpecName(k signature.KeySpec) string {
47+
switch k.Type {
48+
case signature.KeyTypeEC:
49+
switch k.Size {
50+
case 256:
51+
return EC_256
52+
case 384:
53+
return EC_384
54+
case 521:
55+
return EC_521
56+
}
57+
case signature.KeyTypeRSA:
58+
switch k.Size {
59+
case 2048:
60+
return RSA_2048
61+
case 3072:
62+
return RSA_3072
63+
case 4096:
64+
return RSA_4096
65+
}
66+
}
67+
return ""
68+
}
69+
70+
// KeySpecHashName returns the name of hash function according to the spec.
71+
func KeySpecHashName(k signature.KeySpec) string {
72+
switch k.Type {
73+
case signature.KeyTypeEC:
74+
switch k.Size {
75+
case 256:
76+
return SHA_256
77+
case 384:
78+
return SHA_384
79+
case 521:
80+
return SHA_512
81+
}
82+
case signature.KeyTypeRSA:
83+
switch k.Size {
84+
case 2048:
85+
return SHA_256
86+
case 3072:
87+
return SHA_384
88+
case 4096:
89+
return SHA_512
90+
}
91+
}
92+
return ""
93+
}
94+
95+
// ParseKeySpecFromName parses keySpec name to a signature.keySpec type.
96+
func ParseKeySpecFromName(raw string) (keySpec signature.KeySpec, err error) {
97+
switch raw {
98+
case RSA_2048:
99+
keySpec.Size = 2048
100+
keySpec.Type = signature.KeyTypeRSA
101+
case RSA_3072:
102+
keySpec.Size = 3072
103+
keySpec.Type = signature.KeyTypeRSA
104+
case RSA_4096:
105+
keySpec.Size = 4096
106+
keySpec.Type = signature.KeyTypeRSA
107+
case EC_256:
108+
keySpec.Size = 256
109+
keySpec.Type = signature.KeyTypeEC
110+
case EC_384:
111+
keySpec.Size = 384
112+
keySpec.Type = signature.KeyTypeEC
113+
case EC_521:
114+
keySpec.Size = 521
115+
keySpec.Type = signature.KeyTypeEC
116+
default:
117+
keySpec = InvalidKeySpec
118+
err = errors.New("parse KeySpec error, keySpec not supported")
119+
}
120+
return
121+
}
122+
123+
// SigningAlgorithmName returns the signing algorithm name of an algorithm according to the spec.
124+
func SigningAlgorithmName(alg signature.Algorithm) string {
125+
switch alg {
126+
case signature.AlgorithmES256:
127+
return ECDSA_SHA_256
128+
case signature.AlgorithmES384:
129+
return ECDSA_SHA_384
130+
case signature.AlgorithmES512:
131+
return ECDSA_SHA_512
132+
case signature.AlgorithmPS256:
133+
return RSASSA_PSS_SHA_256
134+
case signature.AlgorithmPS384:
135+
return RSASSA_PSS_SHA_384
136+
case signature.AlgorithmPS512:
137+
return RSASSA_PSS_SHA_512
138+
}
139+
return ""
140+
}
141+
142+
// ParseSigningAlgorithFromName parses the signing algorithm name from a given string.
143+
func ParseSigningAlgorithFromName(raw string) (signature.Algorithm, error) {
144+
switch raw {
145+
case ECDSA_SHA_256:
146+
return signature.AlgorithmES256, nil
147+
case ECDSA_SHA_384:
148+
return signature.AlgorithmES384, nil
149+
case ECDSA_SHA_512:
150+
return signature.AlgorithmES512, nil
151+
case RSASSA_PSS_SHA_256:
152+
return signature.AlgorithmPS256, nil
153+
case RSASSA_PSS_SHA_384:
154+
return signature.AlgorithmPS384, nil
155+
case RSASSA_PSS_SHA_512:
156+
return signature.AlgorithmPS512, nil
157+
}
158+
return 0, errors.New("parse Signing algorithm error, signing algorithm not supported")
159+
}

signature/envelope.go

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
package signature
2+
3+
import (
4+
"errors"
5+
6+
"github.com/notaryproject/notation-core-go/signature"
7+
"github.com/notaryproject/notation-core-go/signature/cose"
8+
"github.com/notaryproject/notation-core-go/signature/jws"
9+
gcose "github.com/veraison/go-cose"
10+
)
11+
12+
// GuessSignatureEnvelopeFormat guesses envelope format by looping all builtin envelope format.
13+
//
14+
// TODO: need a better way to inspect the type of envelope.
15+
func GuessSignatureEnvelopeFormat(raw []byte) (string, error) {
16+
var msg gcose.Sign1Message
17+
if err := msg.UnmarshalCBOR(raw); err == nil {
18+
return cose.MediaTypeEnvelope, nil
19+
}
20+
if len(raw) == 0 || raw[0] != '{' {
21+
// very certain
22+
return "", errors.New("unsupported signature format")
23+
}
24+
return jws.MediaTypeEnvelope, nil
25+
}
26+
27+
// ValidateEnvelopeMediaType validetes envelope media type is supported by notation-core-go.
28+
func ValidateEnvelopeMediaType(mediaType string) error {
29+
for _, types := range signature.RegisteredEnvelopeTypes() {
30+
if mediaType == types {
31+
return nil
32+
}
33+
}
34+
return errors.New("signing mediaTypeEnvelope invalid")
35+
}

0 commit comments

Comments
 (0)