diff --git a/hack/gentestdata/gentestdata.go b/hack/gentestdata/gentestdata.go index 1797e3aea..6d2400f6c 100644 --- a/hack/gentestdata/gentestdata.go +++ b/hack/gentestdata/gentestdata.go @@ -22,8 +22,10 @@ import ( "crypto/rand" "crypto/x509" "crypto/x509/pkix" + "encoding/hex" "encoding/pem" "flag" + "fmt" "log" "math/big" "os" @@ -215,14 +217,22 @@ func populateLogIDs(sigstoreKeys *config.SigstoreKeys) error { if err != nil { return err } - sigstoreKeys.Tlogs[i].LogId = &config.LogID{KeyId: []byte(logID)} + logIDBytes, err := hex.DecodeString(logID) + if err != nil { + return fmt.Errorf("failed to decode tlog LogID: %w", err) + } + sigstoreKeys.Tlogs[i].LogId = &config.LogID{KeyId: logIDBytes} } for i := range sigstoreKeys.Ctlogs { logID, err := genLogID(sigstoreKeys.Ctlogs[i].PublicKey.RawBytes) if err != nil { return err } - sigstoreKeys.Ctlogs[i].LogId = &config.LogID{KeyId: []byte(logID)} + logIDBytes, err := hex.DecodeString(logID) + if err != nil { + return fmt.Errorf("failed to decode ctlog LogID: %w", err) + } + sigstoreKeys.Ctlogs[i].LogId = &config.LogID{KeyId: logIDBytes} } return nil } diff --git a/pkg/apis/config/sigstore_keys.go b/pkg/apis/config/sigstore_keys.go index af8cdc351..98db05d6e 100644 --- a/pkg/apis/config/sigstore_keys.go +++ b/pkg/apis/config/sigstore_keys.go @@ -21,6 +21,7 @@ import ( "crypto/ecdsa" "crypto/elliptic" "crypto/rsa" + "encoding/hex" "encoding/pem" "fmt" @@ -166,13 +167,17 @@ func ConvertTransparencyLogInstance(source v1alpha1.TransparencyLogInstance) (*p if err != nil { return nil, err } + logIDBytes, err := hex.DecodeString(logID) + if err != nil { + return nil, fmt.Errorf("failed to decode LogID: %w", err) + } return &pbtrustroot.TransparencyLogInstance{ BaseUrl: source.BaseURL.String(), HashAlgorithm: HashStringToHashAlgorithm(source.HashAlgorithm), PublicKey: pbpk, LogId: &pbcommon.LogId{ - KeyId: []byte(logID), + KeyId: logIDBytes, }, }, nil } diff --git a/pkg/reconciler/trustroot/testdata/ctfeLogID.txt b/pkg/reconciler/trustroot/testdata/ctfeLogID.txt index 79da6ea1a..0790f7678 100644 --- a/pkg/reconciler/trustroot/testdata/ctfeLogID.txt +++ b/pkg/reconciler/trustroot/testdata/ctfeLogID.txt @@ -1 +1 @@ -acf17f453fd18a03c80421956827a165a8e35745a5b9316cd6653e0e74dd8564 \ No newline at end of file +6535e233e5fdda81457be67eea2c3e38e161504c7e431b1eda5c125a2002301d \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem b/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem index 74c5d61da..8567641b8 100644 --- a/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem +++ b/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem @@ -1,4 +1,4 @@ -----BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAES9xB42oHdFluiw6wANt/niwGlhq0 -laU5Q+KylSiS3I2UZUDp1P/8GdZEeLjryi9WzBdUCGIkeaPwKU5kCAfvCg== +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYNjT4Xc2ppshhLUESZAjwgTG8KPR +TzrHijEZtWBtUHAB2SFWxYply2rymo6gNkbL9Mt6X/mLMDw44b2jYf8R7g== -----END PUBLIC KEY----- diff --git a/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem b/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem index c967edaf0..63532085b 100644 --- a/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem +++ b/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem @@ -1,18 +1,18 @@ -----BEGIN CERTIFICATE----- MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 -MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMG -ByqGSM49AgEGCCqGSM49AwEHA0IABOfGXx7fja6RGX/fdxhqS729rrPLoC3SnOYk -XLsulTveNatUD/aWj+Pm6lmMgu7XmAwJey7X1eDOY82krp1Glq6jMzAxMA4GA1Ud -DwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS+/yTu0t5fZADYyn/09SEqotouYTAKBggq -hkjOPQQDAgNJADBGAiEA3Ilo1dUM0DpSf8gudhY4WE0dyT33XpzDhTpc/rcK/jEC -IQC5y6ZZrXHdhF4SmgMFJV8B/ELPBaSv1IVw63ot9KfTlA== +MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMG +ByqGSM49AgEGCCqGSM49AwEHA0IABN/rCcQAWj40WzyJFJyberUeo0gXkctI/7FO +5U/SxCVwjGPEpGDCcdLAGJ8aFnlRh8P570NkJyLw1aHYXhnOOG6jMzAxMA4GA1Ud +DwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS714qEdqvbbWMxCu5XU8t02VnnPTAKBggq +hkjOPQQDAgNJADBGAiEAjOL+MHpQdYlhim2VTgC2X1F5Sw+H5Y7LpVAAeV+6+nEC +IQDxe4JgvrSU0w6Lw8ZeHj+EsPwZu4sMaWG3itHxf5/GOA== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 -MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcq -hkjOPQIBBggqhkjOPQMBBwNCAAQJAmqunDp6ckWG0Ab/Hv78Rx7z6xSMBrPOHv8M -OswZ71IfzouT4HSZm7BXp/YwLx6zmYzDpA3W34WOtT0SzKpho0IwQDAOBgNVHQ8B -Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvv8k7tLeX2QA2Mp/ -9PUhKqLaLmEwCgYIKoZIzj0EAwIDSAAwRQIhALQkjwjY33JokfG+ncPDepGgFJYa -LrWYxFCRuk0375ecAiAqqB9ACUPxR/1BUo3ipnSSaaUUlK5ksytaKKFp2Ae24g== +MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 +MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcq +hkjOPQIBBggqhkjOPQMBBwNCAAQioOFQ3s+IOprqRpW+KnoaeMhbG4ltedtGebgr +JKjvShgQn3e8O47GrdVEdFuXVGp81KwCXcwDzNQUge7IcIzvo0IwQDAOBgNVHQ8B +Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUu9eKhHar221jMQru +V1PLdNlZ5z0wCgYIKoZIzj0EAwIDSQAwRgIhAOQyIx3t5Ky+bioMbAcRHSL76LVb +r0hLkwxs/o3HwWs3AiEAti3GH0ebqH8PBjy0GNXk0og2ZC4Q4GhLi++otLCqfTU= -----END CERTIFICATE----- diff --git a/pkg/reconciler/trustroot/testdata/marshalledEntry.json b/pkg/reconciler/trustroot/testdata/marshalledEntry.json index b0dd2b5a3..07d3d9d2d 100644 --- a/pkg/reconciler/trustroot/testdata/marshalledEntry.json +++ b/pkg/reconciler/trustroot/testdata/marshalledEntry.json @@ -5,14 +5,14 @@ "baseUrl": "https://rekor.example.com", "hashAlgorithm": "SHA2_256", "publicKey": { - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwrI7C8wbl+f4MLhj+zPh41uV6tGeXYHtaX6AkQ1c11pJzEb1Whj1s7zmarVwulTiEMqsX6qstjWzcA8ocY/mbQ==", + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzmiyjrvz19Hmf+gyQ2RUVjhEzyVICG/TK9Zcf3brcM4VtRMAdmmytIVqjdW31Z9/UejfJq+ZjBU5xv4jwcUBmQ==", "keyDetails": "PKIX_ECDSA_P256_SHA_256", "validFor": { "start": "1970-01-01T00:00:00Z" } }, "logId": { - "keyId": "ZDEyZDVkOWFhNDE5NzRhNTg1OTYxZDE2MTI1MGNkMTVmMTFlNTJhNzdlM2ExY2RmZDFkZTM2MDViZDA0ZGYwNA==" + "keyId": "fADwHyhaM1PO0Hr3PEnTeBapk1tOmZjZeZWcm1Jho3U=" } } ], @@ -26,10 +26,10 @@ "certChain": { "certificates": [ { - "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOfGXx7fja6RGX/fdxhqS729rrPLoC3SnOYkXLsulTveNatUD/aWj+Pm6lmMgu7XmAwJey7X1eDOY82krp1Glq6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS+/yTu0t5fZADYyn/09SEqotouYTAKBggqhkjOPQQDAgNJADBGAiEA3Ilo1dUM0DpSf8gudhY4WE0dyT33XpzDhTpc/rcK/jECIQC5y6ZZrXHdhF4SmgMFJV8B/ELPBaSv1IVw63ot9KfTlA==" + "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABN/rCcQAWj40WzyJFJyberUeo0gXkctI/7FO5U/SxCVwjGPEpGDCcdLAGJ8aFnlRh8P570NkJyLw1aHYXhnOOG6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS714qEdqvbbWMxCu5XU8t02VnnPTAKBggqhkjOPQQDAgNJADBGAiEAjOL+MHpQdYlhim2VTgC2X1F5Sw+H5Y7LpVAAeV+6+nECIQDxe4JgvrSU0w6Lw8ZeHj+EsPwZu4sMaWG3itHxf5/GOA==" }, { - "rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQJAmqunDp6ckWG0Ab/Hv78Rx7z6xSMBrPOHv8MOswZ71IfzouT4HSZm7BXp/YwLx6zmYzDpA3W34WOtT0SzKpho0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvv8k7tLeX2QA2Mp/9PUhKqLaLmEwCgYIKoZIzj0EAwIDSAAwRQIhALQkjwjY33JokfG+ncPDepGgFJYaLrWYxFCRuk0375ecAiAqqB9ACUPxR/1BUo3ipnSSaaUUlK5ksytaKKFp2Ae24g==" + "rawBytes": "MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQioOFQ3s+IOprqRpW+KnoaeMhbG4ltedtGebgrJKjvShgQn3e8O47GrdVEdFuXVGp81KwCXcwDzNQUge7IcIzvo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUu9eKhHar221jMQruV1PLdNlZ5z0wCgYIKoZIzj0EAwIDSQAwRgIhAOQyIx3t5Ky+bioMbAcRHSL76LVbr0hLkwxs/o3HwWs3AiEAti3GH0ebqH8PBjy0GNXk0og2ZC4Q4GhLi++otLCqfTU=" } ] }, @@ -43,14 +43,14 @@ "baseUrl": "https://ctfe.example.com", "hashAlgorithm": "SHA2_256", "publicKey": { - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAES9xB42oHdFluiw6wANt/niwGlhq0laU5Q+KylSiS3I2UZUDp1P/8GdZEeLjryi9WzBdUCGIkeaPwKU5kCAfvCg==", + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYNjT4Xc2ppshhLUESZAjwgTG8KPRTzrHijEZtWBtUHAB2SFWxYply2rymo6gNkbL9Mt6X/mLMDw44b2jYf8R7g==", "keyDetails": "PKIX_ECDSA_P256_SHA_256", "validFor": { "start": "1970-01-01T00:00:00Z" } }, "logId": { - "keyId": "YWNmMTdmNDUzZmQxOGEwM2M4MDQyMTk1NjgyN2ExNjVhOGUzNTc0NWE1YjkzMTZjZDY2NTNlMGU3NGRkODU2NA==" + "keyId": "ZTXiM+X92oFFe+Z+6iw+OOFhUEx+Qxse2lwSWiACMB0=" } } ], @@ -64,10 +64,10 @@ "certChain": { "certificates": [ { - "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCNxMOw1rxPlbqRR1//XWhbUdr3Ss4TLOWwkDrgH6UKBYU2jAkR/vlNk8lsCWdVLRtrX5uk5kx6268+wzEak/m6jMzAxMA4GA1UdDwEB/wQEAwIEEDAfBgNVHSMEGDAWgBSO60qMR9pTnfzXXM73hWw3um6d7DAKBggqhkjOPQQDAgNJADBGAiEAlx+K0sb82V8xiJDyV3CTQVKLyCGvIz9mLqpYHtm68tcCIQDpBXdPLgsBNnuNaAOTsGjIkbF+yih+0u4vMCQDoQ48vA==" + "rawBytes": "MIIBPTCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAOJTgHPothg44K6qtLYX05X6AeHl5SbSu40hs5fgUwxqM/q5dAkyLIFF97/EjFohTMf3TKUkoDKovPIOzOa5O6jMzAxMA4GA1UdDwEB/wQEAwIEEDAfBgNVHSMEGDAWgBTBiZBUV7Q6uzvzkdNs27ayNVqwmTAKBggqhkjOPQQDAgNIADBFAiB57pSBN27X8/xzO4xfELuI1ZNJn+d8qDllAq4aquKqMQIhAN4/ShbJXTbyLrn/PKwBkpnduey7EmXJlaQGEc5iYiWp" }, { - "rawBytes": "MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARnmSPSK4FXomdJHvVDqsVuI53ezlBNODUVK3pddglbjLrHzrWYFWddF7wh7IXYC92NfExAQJCYTHt7p2U7Xwi6o0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUjutKjEfaU53811zO94VsN7punewwCgYIKoZIzj0EAwIDSQAwRgIhAIRRfwvlYsonpB3ta2VwKyl9xgzQT2kangYk/otGQ3aHAiEAlT7E7GIhH+pibEXnZ58YzmEJAcsb+ny3hc7mNjHwCz0=" + "rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT+OCSU0aJP8LtLqbZdIUmoSyXGjaiQ6zqL10phyF0ARu5wwamIbX97E5VozjldlkCWonfSBJgCBuS5g6N4DxjYo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwYmQVFe0Ors785HTbNu2sjVasJkwCgYIKoZIzj0EAwIDSAAwRQIhAJfUleJ643oEBQ9pe8FMZ3EDJ4hNACpr/jjxH8nM7bWiAiAweomZPvBZ9xJsFJZle2JWYAktziLNvvo53ny2bUqjHA==" } ] }, diff --git a/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json b/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json index 2921ce103..17c643968 100644 --- a/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json +++ b/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json @@ -3,14 +3,14 @@ { "hashAlgorithm": "SHA2_256", "publicKey": { - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwrI7C8wbl+f4MLhj+zPh41uV6tGeXYHtaX6AkQ1c11pJzEb1Whj1s7zmarVwulTiEMqsX6qstjWzcA8ocY/mbQ==", + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzmiyjrvz19Hmf+gyQ2RUVjhEzyVICG/TK9Zcf3brcM4VtRMAdmmytIVqjdW31Z9/UejfJq+ZjBU5xv4jwcUBmQ==", "keyDetails": "PKIX_ECDSA_P256_SHA_256", "validFor": { "start": "1970-01-01T00:00:00Z" } }, "logId": { - "keyId": "ZDEyZDVkOWFhNDE5NzRhNTg1OTYxZDE2MTI1MGNkMTVmMTFlNTJhNzdlM2ExY2RmZDFkZTM2MDViZDA0ZGYwNA==" + "keyId": "fADwHyhaM1PO0Hr3PEnTeBapk1tOmZjZeZWcm1Jho3U=" } } ], @@ -19,10 +19,10 @@ "certChain": { "certificates": [ { - "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOfGXx7fja6RGX/fdxhqS729rrPLoC3SnOYkXLsulTveNatUD/aWj+Pm6lmMgu7XmAwJey7X1eDOY82krp1Glq6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS+/yTu0t5fZADYyn/09SEqotouYTAKBggqhkjOPQQDAgNJADBGAiEA3Ilo1dUM0DpSf8gudhY4WE0dyT33XpzDhTpc/rcK/jECIQC5y6ZZrXHdhF4SmgMFJV8B/ELPBaSv1IVw63ot9KfTlA==" + "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABN/rCcQAWj40WzyJFJyberUeo0gXkctI/7FO5U/SxCVwjGPEpGDCcdLAGJ8aFnlRh8P570NkJyLw1aHYXhnOOG6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBS714qEdqvbbWMxCu5XU8t02VnnPTAKBggqhkjOPQQDAgNJADBGAiEAjOL+MHpQdYlhim2VTgC2X1F5Sw+H5Y7LpVAAeV+6+nECIQDxe4JgvrSU0w6Lw8ZeHj+EsPwZu4sMaWG3itHxf5/GOA==" }, { - "rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQJAmqunDp6ckWG0Ab/Hv78Rx7z6xSMBrPOHv8MOswZ71IfzouT4HSZm7BXp/YwLx6zmYzDpA3W34WOtT0SzKpho0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvv8k7tLeX2QA2Mp/9PUhKqLaLmEwCgYIKoZIzj0EAwIDSAAwRQIhALQkjwjY33JokfG+ncPDepGgFJYaLrWYxFCRuk0375ecAiAqqB9ACUPxR/1BUo3ipnSSaaUUlK5ksytaKKFp2Ae24g==" + "rawBytes": "MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQioOFQ3s+IOprqRpW+KnoaeMhbG4ltedtGebgrJKjvShgQn3e8O47GrdVEdFuXVGp81KwCXcwDzNQUge7IcIzvo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUu9eKhHar221jMQruV1PLdNlZ5z0wCgYIKoZIzj0EAwIDSQAwRgIhAOQyIx3t5Ky+bioMbAcRHSL76LVbr0hLkwxs/o3HwWs3AiEAti3GH0ebqH8PBjy0GNXk0og2ZC4Q4GhLi++otLCqfTU=" } ] }, @@ -35,14 +35,14 @@ { "hashAlgorithm": "SHA2_256", "publicKey": { - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAES9xB42oHdFluiw6wANt/niwGlhq0laU5Q+KylSiS3I2UZUDp1P/8GdZEeLjryi9WzBdUCGIkeaPwKU5kCAfvCg==", + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYNjT4Xc2ppshhLUESZAjwgTG8KPRTzrHijEZtWBtUHAB2SFWxYply2rymo6gNkbL9Mt6X/mLMDw44b2jYf8R7g==", "keyDetails": "PKIX_ECDSA_P256_SHA_256", "validFor": { "start": "1970-01-01T00:00:00Z" } }, "logId": { - "keyId": "YWNmMTdmNDUzZmQxOGEwM2M4MDQyMTk1NjgyN2ExNjVhOGUzNTc0NWE1YjkzMTZjZDY2NTNlMGU3NGRkODU2NA==" + "keyId": "ZTXiM+X92oFFe+Z+6iw+OOFhUEx+Qxse2lwSWiACMB0=" } } ] diff --git a/pkg/reconciler/trustroot/testdata/rekorLogID.txt b/pkg/reconciler/trustroot/testdata/rekorLogID.txt index 78b8c7caa..aa0a2ecb4 100644 --- a/pkg/reconciler/trustroot/testdata/rekorLogID.txt +++ b/pkg/reconciler/trustroot/testdata/rekorLogID.txt @@ -1 +1 @@ -d12d5d9aa41974a585961d161250cd15f11e52a77e3a1cdfd1de3605bd04df04 \ No newline at end of file +7c00f01f285a3353ced07af73c49d37816a9935b4e9998d979959c9b5261a375 \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem b/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem index 6ccc71620..44bae7154 100644 --- a/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem +++ b/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem @@ -1,4 +1,4 @@ -----BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwrI7C8wbl+f4MLhj+zPh41uV6tGe -XYHtaX6AkQ1c11pJzEb1Whj1s7zmarVwulTiEMqsX6qstjWzcA8ocY/mbQ== +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzmiyjrvz19Hmf+gyQ2RUVjhEzyVI +CG/TK9Zcf3brcM4VtRMAdmmytIVqjdW31Z9/UejfJq+ZjBU5xv4jwcUBmQ== -----END PUBLIC KEY----- diff --git a/pkg/reconciler/trustroot/testdata/root.json b/pkg/reconciler/trustroot/testdata/root.json index 5cc10dc64..b9e9659fb 100644 --- a/pkg/reconciler/trustroot/testdata/root.json +++ b/pkg/reconciler/trustroot/testdata/root.json @@ -3,9 +3,9 @@ "_type": "root", "spec_version": "1.0", "version": 1, - "expires": "2027-01-20T10:00:47Z", + "expires": "2027-01-27T16:22:46Z", "keys": { - "32ff9c075bc05c7467312d969b8c5115751168e20f8b50d8f7338cf332a235cd": { + "3486ab200c1bba2553214f8fbd354e506eb2cc079260fec8568466d8905b3077": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -13,10 +13,10 @@ "sha512" ], "keyval": { - "public": "635b751227d765c699d45fb5d4486826f4d6cbb28aa633eb96851d3fb9004cb5" + "public": "1b6ad4d55414e0deb19b88ec5cb358e1e86219a91ad920287291392b1a3980c0" } }, - "47461411ef034f8a16f5f4935e02270e34ff4cf123e681a9c6cdb7e5d2adce9b": { + "bfcba7c6106980cbd9d8831845e98f67eb3d744839ec014d4323be3b4beffc8c": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -24,10 +24,10 @@ "sha512" ], "keyval": { - "public": "cfd7d31f503e2610ff2978ba4737116ce924dbc462425ba2113b848e50b6345f" + "public": "6335210a26991d0fc4f8f0d5911c62e4154cd3ab149db420136ac2f3ec6be1d5" } }, - "93e3b9e97fbeea85ec6be4643f7ed267b653cbab185d92b3b1fc746b5a797888": { + "ced8d630f608ae8723e9c8c3c6580734f6bbdbdeda24c253c1dce10b578c5636": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -35,10 +35,10 @@ "sha512" ], "keyval": { - "public": "8c339e1d5c57bd2639e244b579d78af0f138ab02c7f1ff63ee9452e3144b61f3" + "public": "8cde24b7d0e38f32770eb764522906a42d824a953ea7988fb8aad69f14194e0d" } }, - "b2c50ac11772a239ea0be7aaa11a76d459fcd9ff00490fc1447a13651cd45c06": { + "d6b3c07f05ca8d1a97b3cf542c0d6c48c41e87b22042e62d88f3d6b9da3ef978": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -46,32 +46,32 @@ "sha512" ], "keyval": { - "public": "4a77e624e183b6d7e1e2986014c67b972de6c55eca337d1e67c1ad4dc9ae3a2f" + "public": "6ac9b5f37ef054728dde41385171392acdbfd754b1c4473528c3770dfd6a981a" } } }, "roles": { "root": { "keyids": [ - "b2c50ac11772a239ea0be7aaa11a76d459fcd9ff00490fc1447a13651cd45c06" + "bfcba7c6106980cbd9d8831845e98f67eb3d744839ec014d4323be3b4beffc8c" ], "threshold": 1 }, "snapshot": { "keyids": [ - "93e3b9e97fbeea85ec6be4643f7ed267b653cbab185d92b3b1fc746b5a797888" + "d6b3c07f05ca8d1a97b3cf542c0d6c48c41e87b22042e62d88f3d6b9da3ef978" ], "threshold": 1 }, "targets": { "keyids": [ - "32ff9c075bc05c7467312d969b8c5115751168e20f8b50d8f7338cf332a235cd" + "ced8d630f608ae8723e9c8c3c6580734f6bbdbdeda24c253c1dce10b578c5636" ], "threshold": 1 }, "timestamp": { "keyids": [ - "47461411ef034f8a16f5f4935e02270e34ff4cf123e681a9c6cdb7e5d2adce9b" + "3486ab200c1bba2553214f8fbd354e506eb2cc079260fec8568466d8905b3077" ], "threshold": 1 } @@ -80,8 +80,8 @@ }, "signatures": [ { - "keyid": "b2c50ac11772a239ea0be7aaa11a76d459fcd9ff00490fc1447a13651cd45c06", - "sig": "c0f1067da018028debc0d4ea26c3398e4c9e1c5aa3f2854100a18066a074cbd10c35ab474a23d7c90e3ade481065bf066354615a3ccda1ffb5a3c11db4a2aa06" + "keyid": "bfcba7c6106980cbd9d8831845e98f67eb3d744839ec014d4323be3b4beffc8c", + "sig": "80ed319b70c5dbe81db7713cd824eaa8e5c7f24dd468120236de7dc96e42415280a15772d5176649bbcef5b88a40eb547f4990431cbad894a59de4486aef9207" } ] } \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json b/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json index 7514fe143..a9e249127 100644 --- a/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json +++ b/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json @@ -3,9 +3,9 @@ "_type": "root", "spec_version": "1.0", "version": 1, - "expires": "2027-01-20T10:00:47Z", + "expires": "2027-01-27T16:22:46Z", "keys": { - "04fc6b58cae00284eefebf2f278c7ed3212903cb44cf3e132618e8748420dfd4": { + "6cbb77fd4b44c581aedebc095806663b43d81306dc347c8cc57ecd25f1bc23bc": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -13,10 +13,10 @@ "sha512" ], "keyval": { - "public": "e70b7414fa2651b94e7eced11cee63d365a98a302171eca0c5257772f671c0b2" + "public": "6d4ca1eb2bc48b295655e49c53661dec6c0f83a23b6149a6998bdc91c15f8d6c" } }, - "1662d452858d1ecf5666e94eb97377123fbb66fcae917889a0268149f0230145": { + "ae7347357543a790726d65d06bccfb683977d01fe607c5da7f5946eee75a51a0": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -24,10 +24,10 @@ "sha512" ], "keyval": { - "public": "fe50c85e2f8bd8bc41ed5a99a0ccc85646252ccf14038616d0eaa199b0f8a353" + "public": "22ea9ea2ccd6812bf1a2ac4fd4ba474919bc2d6f9fb50eefcda61b77b4eb8536" } }, - "e3e4e4a53b69dd0956b2d7037468b02e8cc6cbb2181db24cebda5c117043ec7a": { + "bc92cabb09028b7b88d79253e8b9c54d7628c2458e31244303438777e07a3a7d": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -35,10 +35,10 @@ "sha512" ], "keyval": { - "public": "26f3ced707d65011b4e63c35007b4f1be79880a9ea9b3abe2b9e5519354bba37" + "public": "a19089ccaaac1acfc72a21144629c246b3e0216c4786e021d9d8ff2308642ace" } }, - "fd3814d159fd3e91d919bd2e1a494675ceffe0702b04795a8c59794c9148b82d": { + "ff1d75d7b76994c46c376b939723cf2611410a3b04d77848d3a6a22c2dcfefde": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -46,32 +46,32 @@ "sha512" ], "keyval": { - "public": "4bd9d98fa64a365e98ef57c3ed5cbf2094620bb3024918d2dcfe7258ab6a6aac" + "public": "b9b23d775c251a82c6b4decd871bb89687efc9abf2a2672f993885c13f1c9a46" } } }, "roles": { "root": { "keyids": [ - "1662d452858d1ecf5666e94eb97377123fbb66fcae917889a0268149f0230145" + "bc92cabb09028b7b88d79253e8b9c54d7628c2458e31244303438777e07a3a7d" ], "threshold": 1 }, "snapshot": { "keyids": [ - "fd3814d159fd3e91d919bd2e1a494675ceffe0702b04795a8c59794c9148b82d" + "ff1d75d7b76994c46c376b939723cf2611410a3b04d77848d3a6a22c2dcfefde" ], "threshold": 1 }, "targets": { "keyids": [ - "e3e4e4a53b69dd0956b2d7037468b02e8cc6cbb2181db24cebda5c117043ec7a" + "6cbb77fd4b44c581aedebc095806663b43d81306dc347c8cc57ecd25f1bc23bc" ], "threshold": 1 }, "timestamp": { "keyids": [ - "04fc6b58cae00284eefebf2f278c7ed3212903cb44cf3e132618e8748420dfd4" + "ae7347357543a790726d65d06bccfb683977d01fe607c5da7f5946eee75a51a0" ], "threshold": 1 } @@ -80,8 +80,8 @@ }, "signatures": [ { - "keyid": "1662d452858d1ecf5666e94eb97377123fbb66fcae917889a0268149f0230145", - "sig": "e8411e53ba4044e9af4ab393ae1a28854a61f53ba8bd7f5c882903bcd30885282289c6111bedcf8fdf0a1e88ff61c324cbc6cbabaaa762cfd947dd07fcb80d0d" + "keyid": "bc92cabb09028b7b88d79253e8b9c54d7628c2458e31244303438777e07a3a7d", + "sig": "45758d40dfd77f2d14a54aa90bdff128d59ed43398e4c941150ae83748dc8da7afee7282a88e291fd44883b8639cd7575f5165e48ed9cb4dda825a633ace250b" } ] } \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json b/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json index 61edb98c0..3998dea3d 100644 --- a/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json +++ b/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json @@ -3,9 +3,9 @@ "_type": "root", "spec_version": "1.0", "version": 1, - "expires": "2027-01-20T10:00:47Z", + "expires": "2027-01-27T16:22:46Z", "keys": { - "1ec208327405d2a40ce80120da8a3de5c3f210dbd696f5269eae681198704c3e": { + "0dc320651b0916d1ab079bfd6d282e263a25608e2a72cc13b9285fa858854427": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -13,10 +13,10 @@ "sha512" ], "keyval": { - "public": "994a1f21d12564ba60dbb9a5942e91c9ce483d0e00d81f96b7d529ad6652fe7b" + "public": "f6b7eeb12ae65b26db850f9c09415380c16179cf98a9acf5f12b038cc823f5db" } }, - "47314e0fea05e38d481b8b7ee1ce9e80282a63b63c5e3df9650096f97af4b0e3": { + "4721176c85019a7e82789a8f64e99073bfb82a44b8566983471763ce2aa3c4d1": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -24,10 +24,10 @@ "sha512" ], "keyval": { - "public": "6399a568409c3710b7ab3d0cffb180f46dd8dfa05d218732d094b296f71476ba" + "public": "e9e81f447c59b5e559844683ebda2a135442caca880c6787eed55109d3f663bf" } }, - "7c08956a4c63174f60883639c141c17b52c7d20f16cc4410b21dbfa9f9a9174e": { + "edeeac4fa12564f682ee4148a64090bbfea0062f2743a7b6a5cd89d4f93f7d99": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -35,10 +35,10 @@ "sha512" ], "keyval": { - "public": "180ede2b3d5e113deceb2dae669082c2a4ffc5fae650b067ac96d745468917e8" + "public": "36f6ce4b5fce16999ecac7b31921fdd98f91d248283c00dbd5f9f8cdb672693a" } }, - "9259f408ffcf1ceffe3ca926ee7c0ed576bd4c7889c18eb9544a90d33112353d": { + "f34904bd3749f8829002bc5a8229c5070dc0f9e849a60fc8a6dd508ef3c1ee4a": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -46,32 +46,32 @@ "sha512" ], "keyval": { - "public": "53fd50a4e6865405b382b3e7684edfb0593f7f401c59a4b8e8d9d22da9c7fcf2" + "public": "4f653b090e3f98e842bbe0b6c9a2a6f0e61ff393a6099d3b4b95456c5496bf79" } } }, "roles": { "root": { "keyids": [ - "1ec208327405d2a40ce80120da8a3de5c3f210dbd696f5269eae681198704c3e" + "edeeac4fa12564f682ee4148a64090bbfea0062f2743a7b6a5cd89d4f93f7d99" ], "threshold": 1 }, "snapshot": { "keyids": [ - "9259f408ffcf1ceffe3ca926ee7c0ed576bd4c7889c18eb9544a90d33112353d" + "4721176c85019a7e82789a8f64e99073bfb82a44b8566983471763ce2aa3c4d1" ], "threshold": 1 }, "targets": { "keyids": [ - "47314e0fea05e38d481b8b7ee1ce9e80282a63b63c5e3df9650096f97af4b0e3" + "0dc320651b0916d1ab079bfd6d282e263a25608e2a72cc13b9285fa858854427" ], "threshold": 1 }, "timestamp": { "keyids": [ - "7c08956a4c63174f60883639c141c17b52c7d20f16cc4410b21dbfa9f9a9174e" + "f34904bd3749f8829002bc5a8229c5070dc0f9e849a60fc8a6dd508ef3c1ee4a" ], "threshold": 1 } @@ -80,8 +80,8 @@ }, "signatures": [ { - "keyid": "1ec208327405d2a40ce80120da8a3de5c3f210dbd696f5269eae681198704c3e", - "sig": "a609d1928bc390df5151b46805f78e48d3e1bc021a7cee791fd6f7bf23644c5ed1cc81229c63bc15827833f99239d755f1e7325a964e082bab1ccf850b7be30a" + "keyid": "edeeac4fa12564f682ee4148a64090bbfea0062f2743a7b6a5cd89d4f93f7d99", + "sig": "84b134fa393a0aa5abad5ef380092731181f25ea3ea70f0493be4e717b5865627b90afa45cc7b9096a00090b8e419687417a30b90989f50cbd53d0eab66f7905" } ] } \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/tsaCertChain.pem b/pkg/reconciler/trustroot/testdata/tsaCertChain.pem index 9430f4fd2..453b12d33 100644 --- a/pkg/reconciler/trustroot/testdata/tsaCertChain.pem +++ b/pkg/reconciler/trustroot/testdata/tsaCertChain.pem @@ -1,18 +1,18 @@ -----BEGIN CERTIFICATE----- -MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 -MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDzENMAsGA1UEAxMEbGVhZjBZMBMG -ByqGSM49AgEGCCqGSM49AwEHA0IABCNxMOw1rxPlbqRR1//XWhbUdr3Ss4TLOWwk -DrgH6UKBYU2jAkR/vlNk8lsCWdVLRtrX5uk5kx6268+wzEak/m6jMzAxMA4GA1Ud -DwEB/wQEAwIEEDAfBgNVHSMEGDAWgBSO60qMR9pTnfzXXM73hWw3um6d7DAKBggq -hkjOPQQDAgNJADBGAiEAlx+K0sb82V8xiJDyV3CTQVKLyCGvIz9mLqpYHtm68tcC -IQDpBXdPLgsBNnuNaAOTsGjIkbF+yih+0u4vMCQDoQ48vA== +MIIBPTCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 +MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDzENMAsGA1UEAxMEbGVhZjBZMBMG +ByqGSM49AgEGCCqGSM49AwEHA0IABAOJTgHPothg44K6qtLYX05X6AeHl5SbSu40 +hs5fgUwxqM/q5dAkyLIFF97/EjFohTMf3TKUkoDKovPIOzOa5O6jMzAxMA4GA1Ud +DwEB/wQEAwIEEDAfBgNVHSMEGDAWgBTBiZBUV7Q6uzvzkdNs27ayNVqwmTAKBggq +hkjOPQQDAgNIADBFAiB57pSBN27X8/xzO4xfELuI1ZNJn+d8qDllAq4aquKqMQIh +AN4/ShbJXTbyLrn/PKwBkpnduey7EmXJlaQGEc5iYiWp -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIBSzCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 -MDcyMDA5MDA0NloXDTM2MDcyMDA5MDA0NlowDTELMAkGA1UEAxMCY2EwWTATBgcq -hkjOPQIBBggqhkjOPQMBBwNCAARnmSPSK4FXomdJHvVDqsVuI53ezlBNODUVK3pd -dglbjLrHzrWYFWddF7wh7IXYC92NfExAQJCYTHt7p2U7Xwi6o0IwQDAOBgNVHQ8B -Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUjutKjEfaU53811zO -94VsN7punewwCgYIKoZIzj0EAwIDSQAwRgIhAIRRfwvlYsonpB3ta2VwKyl9xgzQ -T2kangYk/otGQ3aHAiEAlT7E7GIhH+pibEXnZ58YzmEJAcsb+ny3hc7mNjHwCz0= +MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 +MDcyNzE1MjI0NVoXDTM2MDcyNzE1MjI0NVowDTELMAkGA1UEAxMCY2EwWTATBgcq +hkjOPQIBBggqhkjOPQMBBwNCAAT+OCSU0aJP8LtLqbZdIUmoSyXGjaiQ6zqL10ph +yF0ARu5wwamIbX97E5VozjldlkCWonfSBJgCBuS5g6N4DxjYo0IwQDAOBgNVHQ8B +Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUwYmQVFe0Ors785HT +bNu2sjVasJkwCgYIKoZIzj0EAwIDSAAwRQIhAJfUleJ643oEBQ9pe8FMZ3EDJ4hN +ACpr/jjxH8nM7bWiAiAweomZPvBZ9xJsFJZle2JWYAktziLNvvo53ny2bUqjHA== -----END CERTIFICATE----- diff --git a/pkg/reconciler/trustroot/testdata/tufRepo.tar b/pkg/reconciler/trustroot/testdata/tufRepo.tar index 927d899bc..0a593bccc 100644 Binary files a/pkg/reconciler/trustroot/testdata/tufRepo.tar and b/pkg/reconciler/trustroot/testdata/tufRepo.tar differ diff --git a/pkg/reconciler/trustroot/testdata/tufRepoWithCustomTrustedRootJSON.tar b/pkg/reconciler/trustroot/testdata/tufRepoWithCustomTrustedRootJSON.tar index f4cefb975..ae2bd8498 100644 Binary files a/pkg/reconciler/trustroot/testdata/tufRepoWithCustomTrustedRootJSON.tar and b/pkg/reconciler/trustroot/testdata/tufRepoWithCustomTrustedRootJSON.tar differ diff --git a/pkg/reconciler/trustroot/testdata/tufRepoWithTrustedRootJSON.tar b/pkg/reconciler/trustroot/testdata/tufRepoWithTrustedRootJSON.tar index ed89d15d9..f09767878 100644 Binary files a/pkg/reconciler/trustroot/testdata/tufRepoWithTrustedRootJSON.tar and b/pkg/reconciler/trustroot/testdata/tufRepoWithTrustedRootJSON.tar differ diff --git a/pkg/reconciler/trustroot/trustroot.go b/pkg/reconciler/trustroot/trustroot.go index 21491a402..26d7341ca 100644 --- a/pkg/reconciler/trustroot/trustroot.go +++ b/pkg/reconciler/trustroot/trustroot.go @@ -18,6 +18,7 @@ import ( "context" "crypto" "crypto/ecdsa" + "encoding/hex" "encoding/json" "errors" "fmt" @@ -95,14 +96,22 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, trustroot *v1alpha1.Trus if !ok { return fmt.Errorf("public key %d is not ecdsa.PublicKey", i) } - sigstoreKeys.Tlogs[i].LogId = &config.LogID{KeyId: []byte(logID)} + logIDBytes, err := hex.DecodeString(logID) + if err != nil { + return fmt.Errorf("invalid rekor log ID encoding %d: %w", i, err) + } + sigstoreKeys.Tlogs[i].LogId = &config.LogID{KeyId: logIDBytes} } for i, ctlog := range sigstoreKeys.Ctlogs { _, logID, err := pemToKeyAndID(config.SerializePublicKey(ctlog.PublicKey)) if err != nil { return fmt.Errorf("invalid ctlog public key %d: %w", i, err) } - sigstoreKeys.Ctlogs[i].LogId = &config.LogID{KeyId: []byte(logID)} + logIDBytes, err := hex.DecodeString(logID) + if err != nil { + return fmt.Errorf("invalid ctlog log ID encoding %d: %w", i, err) + } + sigstoreKeys.Ctlogs[i].LogId = &config.LogID{KeyId: logIDBytes} } // See if the CM holding configs exists @@ -328,10 +337,14 @@ func genTransparencyLogInstance(baseURL string, pkBytes []byte) (*config.Transpa if err != nil { return nil, fmt.Errorf("failed to construct LogID: %w", err) } + logIDBytes, err := hex.DecodeString(logID) + if err != nil { + return nil, fmt.Errorf("failed to decode LogID: %w", err) + } return &config.TransparencyLogInstance{ BaseUrl: baseURL, HashAlgorithm: pbcommon.HashAlgorithm_SHA2_256, PublicKey: pbpk, - LogId: &pbcommon.LogId{KeyId: []byte(logID)}, + LogId: &pbcommon.LogId{KeyId: logIDBytes}, }, nil } diff --git a/pkg/reconciler/trustroot/trustroot_test.go b/pkg/reconciler/trustroot/trustroot_test.go index af6447b98..de8af3552 100644 --- a/pkg/reconciler/trustroot/trustroot_test.go +++ b/pkg/reconciler/trustroot/trustroot_test.go @@ -23,6 +23,7 @@ import ( "crypto/x509" "crypto/x509/pkix" _ "embed" + "encoding/hex" "encoding/pem" "fmt" "math/big" @@ -447,11 +448,19 @@ func makeConfigMapWithSigstoreKeys() *corev1.ConfigMap { if err != nil { panic("failed to convert test SigstoreKeys") } + rekorLogIDBytes, err := hex.DecodeString(rekorLogID) + if err != nil { + panic("failed to decode rekor log ID") + } for i := range c.Tlogs { - c.Tlogs[i].LogId = &config.LogID{KeyId: []byte(rekorLogID)} + c.Tlogs[i].LogId = &config.LogID{KeyId: rekorLogIDBytes} + } + ctfeLogIDBytes, err := hex.DecodeString(ctfeLogID) + if err != nil { + panic("failed to decode ctfe log ID") } for i := range c.Ctlogs { - c.Ctlogs[i].LogId = &config.LogID{KeyId: []byte(ctfeLogID)} + c.Ctlogs[i].LogId = &config.LogID{KeyId: ctfeLogIDBytes} } marshalled, err := resources.Marshal(c) if err != nil { diff --git a/pkg/webhook/validation.go b/pkg/webhook/validation.go index 76333c162..e37d83ba2 100644 --- a/pkg/webhook/validation.go +++ b/pkg/webhook/validation.go @@ -76,6 +76,14 @@ func validSignatures(ctx context.Context, ref name.Reference, checkOpts *cosign. return sigs, err } +// validBundleFormat verifies cosign v3 bundle-format signatures via the attestation +// API, which is the only path that supports bundles in cosign v3.0.x. +func validBundleFormat(ctx context.Context, ref name.Reference, checkOpts *cosign.CheckOpts) ([]oci.Signature, error) { + checkOpts.ClaimVerifier = cosign.IntotoSubjectClaimVerifier + sigs, _, err := cosignVerifyAttestations(ctx, ref, checkOpts) + return sigs, err +} + func validAttestations(ctx context.Context, ref name.Reference, checkOpts *cosign.CheckOpts) ([]oci.Signature, error) { cfg := policycontrollerconfig.FromContextOrDefaults(ctx) if cfg.EnableOCI11 { diff --git a/pkg/webhook/validator.go b/pkg/webhook/validator.go index c01ea59d6..7eec9ab39 100644 --- a/pkg/webhook/validator.go +++ b/pkg/webhook/validator.go @@ -847,7 +847,13 @@ func ValidatePolicySignaturesForAuthority(ctx context.Context, ref name.Referenc case authority.Keyless != nil: if authority.Keyless.URL != nil { - sps, err := validSignatures(ctx, ref, checkOpts) + var sps []oci.Signature + var err error + if checkOpts.NewBundleFormat { + sps, err = validBundleFormat(ctx, ref, checkOpts) + } else { + sps, err = validSignatures(ctx, ref, checkOpts) + } if err != nil { logging.FromContext(ctx).Errorf("failed validSignatures for authority %s with fulcio for %s: %v", name, ref.Name(), err) return nil, fmt.Errorf("signature keyless validation failed for authority %s for %s: %w", name, ref.Name(), err) @@ -1642,7 +1648,7 @@ func fulcioCertsFromAuthority(ctx context.Context, keylessRef *webhookcip.Keyles if err != nil { return nil, nil, nil, fmt.Errorf("unmarshaling public key %d failed: %w", i, err) } - ctlogKeys.Keys[string(ctlog.LogId.KeyId)] = cosign.TransparencyLogPubKey{ + ctlogKeys.Keys[logIDToHex(ctlog.LogId.KeyId)] = cosign.TransparencyLogPubKey{ PubKey: pk, Status: tuf.Active, } @@ -1734,7 +1740,7 @@ func rekorKeysFromTrustRef(ctx context.Context, trustRootRef string) (*cosign.Tr if !ok { return nil, "", fmt.Errorf("public key %d is not ecdsa.PublicKey", i) } - retKeys.Keys[string(tlog.LogId.KeyId)] = cosign.TransparencyLogPubKey{ + retKeys.Keys[logIDToHex(tlog.LogId.KeyId)] = cosign.TransparencyLogPubKey{ PubKey: pkecdsa, Status: tuf.Active, } @@ -1745,6 +1751,20 @@ func rekorKeysFromTrustRef(ctx context.Context, trustRootRef string) (*cosign.Tr return nil, "", fmt.Errorf("trustRootRef %s not found", trustRootRef) } +// logIDToHex normalizes a LogID KeyId to a hex string regardless of whether it +// was stored as raw binary (32 bytes, new format) or ASCII hex (64 bytes, old format). +func logIDToHex(keyID []byte) string { + if len(keyID) == sha256.Size*2 && isHexASCII(keyID) { + return string(keyID) + } + return hex.EncodeToString(keyID) +} + +func isHexASCII(b []byte) bool { + _, err := hex.Decode(make([]byte, hex.DecodedLen(len(b))), b) + return err == nil +} + // splitPEMCertificateChain returns a list of leaf (non-CA) certificates, a certificate pool for // intermediate CA certificates, and a certificate pool for root CA certificates func splitPEMCertificateChain(pem []byte) (leaves, intermediates, roots []*x509.Certificate, err error) { diff --git a/pkg/webhook/validator_test.go b/pkg/webhook/validator_test.go index 25700b589..3ae7ad051 100644 --- a/pkg/webhook/validator_test.go +++ b/pkg/webhook/validator_test.go @@ -22,6 +22,7 @@ import ( "crypto/ecdsa" "crypto/x509" "encoding/base64" + "encoding/hex" "encoding/json" "errors" "fmt" @@ -134,6 +135,14 @@ aEcvjlCkgBCKXbrkumZV0m0dSlK1V1gxEiyQ8y6hk1MxJNe2AZrZUt7a4w== ctfeLogID = "39d1c085f7d5f3fe7a0de9e52a3ead14186891e52a9269d90de7990a30b55083" ) +func mustHexDecode(s string) []byte { + b, err := hex.DecodeString(s) + if err != nil { + panic(err) + } + return b +} + func TestValidatePodSpec(t *testing.T) { tag := name.MustParseReference("gcr.io/distroless/static:nonroot") // Resolved via crane digest on 2021/09/25 @@ -3395,7 +3404,7 @@ func TestFulcioCertsFromAuthority(t *testing.T) { CertChain: certChain, }}, Ctlogs: []*config.TransparencyLogInstance{{ - LogId: &config.LogID{KeyId: []byte(ctfeLogID)}, + LogId: &config.LogID{KeyId: mustHexDecode(ctfeLogID)}, PublicKey: pbpk, }}, } @@ -3503,7 +3512,7 @@ func TestRekorClientAndKeysFromAuthority(t *testing.T) { sk := config.SigstoreKeys{ Tlogs: []*config.TransparencyLogInstance{{ PublicKey: pbpk, - LogId: &config.LogID{KeyId: []byte(rekorLogID)}, + LogId: &config.LogID{KeyId: mustHexDecode(rekorLogID)}, BaseUrl: "rekor.example.com", }}, } @@ -3646,7 +3655,7 @@ func TestCheckOptsFromAuthority(t *testing.T) { skRekor := config.SigstoreKeys{ Tlogs: []*config.TransparencyLogInstance{{ PublicKey: pbpkRekor, - LogId: &config.LogID{KeyId: []byte("rekor-logid")}, + LogId: &config.LogID{KeyId: mustHexDecode(rekorLogID)}, BaseUrl: "rekor.example.com", }}, } @@ -3663,7 +3672,7 @@ func TestCheckOptsFromAuthority(t *testing.T) { CertChain: certChainPB, }}, Ctlogs: []*config.TransparencyLogInstance{{ - LogId: &config.LogID{KeyId: []byte(ctfeLogID)}, + LogId: &config.LogID{KeyId: mustHexDecode(ctfeLogID)}, PublicKey: pbpkCTFE, }}, } @@ -3671,7 +3680,7 @@ func TestCheckOptsFromAuthority(t *testing.T) { MediaType: "application/vnd.dev.sigstore.trustedroot+json;version=0.1", Tlogs: []*config.TransparencyLogInstance{{ PublicKey: pbpkRekor, - LogId: &config.LogID{KeyId: []byte("rekor-logid")}, + LogId: &config.LogID{KeyId: mustHexDecode(rekorLogID)}, BaseUrl: "rekor.example.com", HashAlgorithm: pbcommon.HashAlgorithm_SHA2_256, }}, @@ -3683,7 +3692,7 @@ func TestCheckOptsFromAuthority(t *testing.T) { CertChain: certChainPB, }}, Ctlogs: []*config.TransparencyLogInstance{{ - LogId: &config.LogID{KeyId: []byte(ctfeLogID)}, + LogId: &config.LogID{KeyId: mustHexDecode(ctfeLogID)}, PublicKey: pbpkCTFE, HashAlgorithm: pbcommon.HashAlgorithm_SHA2_256, }}, @@ -3746,7 +3755,7 @@ func TestCheckOptsFromAuthority(t *testing.T) { ctx: testCtx, wantClient: true, wantCheckOpts: &cosign.CheckOpts{ - RekorPubKeys: &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{"rekor-logid": {PubKey: ecpk, Status: tuf.Active}}}, + RekorPubKeys: &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{rekorLogID: {PubKey: ecpk, Status: tuf.Active}}}, }, }, { name: "trustroot found, Fulcio", @@ -3779,7 +3788,7 @@ func TestCheckOptsFromAuthority(t *testing.T) { wantCheckOpts: &cosign.CheckOpts{ RootCerts: roots, IntermediateCerts: intermediates, - RekorPubKeys: &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{"rekor-logid": {PubKey: ecpk, Status: tuf.Active}}}, + RekorPubKeys: &cosign.TrustedTransparencyLogPubKeys{Keys: map[string]cosign.TransparencyLogPubKey{rekorLogID: {PubKey: ecpk, Status: tuf.Active}}}, Identities: []cosign.Identity{{ Issuer: "issuer", Subject: "subject",