steiza
commented
7 months ago So here is a very rough example of what pkg/sign/ might look like:
For interface.go:
package sign
import (
protobundle "github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1"
protocommon "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1"
)
// this is just a convienient way to bundle the information from the signer to the witness(es)
type SignedEntity struct{
dataDigest []byte
signature []byte
ephemeralPublicKey []byte
envelope []byte
}
func Sign(data []byte, signer *Signer, witnesses []Witness, bundleVersion string) (*protobundle.Bundle, error) {
bundle := Bundle{}
signerResult, err := signer.SignData(data)
if err != nil {
return nil, err
}
// Put signerResult into SignedEntity, depending on type
// Put signerResult into bundle, depending on type
for _, witness := range witnesses {
witnessResult, err := witness.Witness(se)
if err != nil {
return nil, err
}
// Put witnessResult into bundle, depending on type
}
return bundle, nil
}For signer.go:
package sign
import (
"crypto"
"crypto/x509"
)
type Signer struct{}
type SignerResult struct{
// Populate these fields if you are signing with a key
signature []byte
publicKeyHint []byte
// Populate these fields if you are signing with Fulcio
ephemeralPublicKey []byte
signingCertificate *x509.Certificate
}
func (s *Signer) SignData(data) (*SignerResult, error) {
return nil, errors.New("not implemented")
}
type Fulcio struct {
baseUrl string
}
type Keypair struct {
crypto.PublicKey
crypto.PrivateKey
publicKeyHint []byte
}
func (f *Fulcio) SignData(data) (*SignerResult, error) {}
func (k *Keypair) SignData(data) (*SignerResult, error) {}For witness.go:
package sign
import (
"errors"
protocommon "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1"
protorekor "github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1"
)
type Witness struct{}
type WitnessResult struct {
*protocommon.RFC3161SignedTimestamp
*protorekor.TransparencyLogEntry
}
func (w *Witness) Witness(se *SignedEntity) (*WitnessResult, error) {
return nil, errors.New("not implemented")
}
type TimestampAuthority struct{
baseUrl string
}
type Rekor struct {
baseUrl string
entryType string
}
func (ta *TimestampAuthority) Witness(se *SignedEntity) (*WitnessResult, error) {
// uses se.signature
}
func (r *Rekor) Witness(se *SignedEntity) (*WitnessResult, error) {
// hashedrekord uses se.signature and se.dataDigest
// dsse uses se.envelope and se.ephemeralPublicKey
}
haydentherapper
cmurphy
spencerschrock
Description
It would be great if sigstore-go could not just verify, but also sign bundles.
There aren't many libraries that support signing bundles today (just sigstore-js?) This would also allow sigstore-go to support the full range of tests in sigstore-conformance.
Goals
sigstore-go/pkg/sign/supports signing Sigstore bundlescmd/conformance/main.gois updated to supportsign-bundleandsign(similar toverify,signwill "wrap" the bundle flow).Anti-Goals
cmd/sigstore-go/main.go, it should not compete with cosignsigstore-goitselfReferences