835 - Keyless Support for SBOM Attestations (#910)

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

test/cli/attest_cmd_test.go

@@ -26,7 +26,7 @@ func TestAttestCmd(t *testing.T) {
 		},
 		{
 			name: "can encode syft.json as the predicate given a password",
-			args: []string{"attest", "-o", "json", img},
+			args: []string{"attest", "-o", "json", "--key", "cosign.key", img},
 			assertions: []traitAssertion{
 				assertSuccessfulReturnCode,
 			},
@@ -34,7 +34,7 @@ func TestAttestCmd(t *testing.T) {
 		},
 		{
 			name: "can encode syft.json as the predicate given a blank password",
-			args: []string{"attest", "-o", "json", img},
+			args: []string{"attest", "-o", "json", "--key", "cosign.key", img},
 			assertions: []traitAssertion{
 				assertSuccessfulReturnCode,
 			},

test/cli/cosign_test.go

@@ -59,9 +59,11 @@ func TestCosignWorkflow(t *testing.T) {
 				"attest",
 				"-o",
 				"json",
+				"--key",
+				"cosign.key",
 				img,
 			},
-			// cosign attach attestation --attestation image_latest_sbom_attestation.json caphill4/attest:latest
+			// cosign attach attestation
 			cosignAttachArgs: []string{
 				"attach",
 				"attestation",
@@ -69,7 +71,7 @@ func TestCosignWorkflow(t *testing.T) {
 				attestationFile,
 				img,
 			},
-			// cosign verify-attestation -key cosign.pub caphill4/attest:latest
+			// cosign verify-attestation
 			cosignVerifyArgs: []string{
 				"verify-attestation",
 				"-key",

test/cli/test-fixtures/attestation/Dockerfile.ctfe_init

@@ -0,0 +1,10 @@
+FROM golang:1.17.8@sha256:c7c94588b6445f5254fbc34df941afa10de04706deb330e62831740c9f0f2030 AS builder
+
+WORKDIR /root/
+
+RUN go install github.com/google/trillian/cmd/createtree@v1.3.10
+ADD ./config/logid.sh /root/
+ADD ./config/ctfe /root/ctfe
+RUN chmod +x /root/logid.sh
+
+CMD /root/logid.sh

test/cli/test-fixtures/attestation/config/config.json

@@ -0,0 +1,9 @@
+{
+  "OIDCIssuers": {
+	"http://dex-idp:8888/auth": {
+      "IssuerURL": "http://dex-idp:8888/auth",
+      "ClientID": "fulcio",
+      "Type": "email"
+    }
+  }
+}

test/cli/test-fixtures/attestation/config/ctfe/ct_server.cfg

@@ -0,0 +1,11 @@
+config {
+	log_id: %LOGID%
+	prefix: "test"
+	roots_pem_file: "/etc/config/root.pem"
+	private_key: {
+		[type.googleapis.com/keyspb.PEMKeyFile] {
+			path: "/etc/config/privkey.pem"
+			password: "foobar"
+		}
+	}
+}

test/cli/test-fixtures/attestation/config/ctfe/privkey.pem

@@ -0,0 +1,8 @@
+-----BEGIN EC PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-CBC,05BAAA9143C46320
+
+AttbquLclNy7ZEnlDFpReZvV2PZKuv89YMWqDvGGtnBVw+3eXYIa54Xli1CyXEPn
+qNGvibjIxj+Q19+VhA3n42SE2fHyULHKPZHebSL5qcVvZTqmbtAe/dZNH1SiGG2f
+bWauIw0oeHhXW5i9isxrLggPMRmPA65Ii3W7gyWFmjE=
+-----END EC PRIVATE KEY-----

test/cli/test-fixtures/attestation/config/ctfe/pubkey.pem

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbbQiLx6GKy6ivhc11wJGbQjc2VX/
+mnuk5d670MTXR3p+LIAcxd5MhqIHpLmyYJ5mDKLEoZ/pC0nPuje3JueBcA==
+-----END PUBLIC KEY-----

test/cli/test-fixtures/attestation/config/dex/docker-compose-config.yaml

@@ -0,0 +1,48 @@
+#
+# Copyright 2021 The Sigstore Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+issuer: http://dex-idp:8888/auth
+
+storage:
+  type: memory
+
+web:
+  http: dex-idp:8888
+
+frontend:
+  issuer: Fulcio in Docker Compose
+
+expiry:
+  signingKeys: "24h"
+  idTokens: "1m"
+  authRequests: "24h"
+
+oauth2:
+  responseTypes: [ "code" ]
+  alwaysShowLoginScreen: false
+  skipApprovalScreen: true
+
+connectors:
+- type: mockCallback
+  id: approved
+  name: AlwaysApprovesOIDCProvider
+
+staticClients:
+  - id: fulcio
+    public: true
+    name: 'Fulcio in Docker Compose'
+
+# Dex's issuer URL + "/callback"
+redirectURI: http://dex-idp:8888/auth/callback

test/cli/test-fixtures/attestation/config/logid.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+#
+# Copyright 2021 The Sigstore Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+function get_log_id() {
+	curl -s --retry-connrefused --retry 10 http://trillian-log-server:8095/metrics |grep "^quota_acquired_tokens{spec=\"trees"|head -1|awk ' { print $1 } '|sed -e 's/[^0-9]*//g' > /tmp/logid
+}
+
+function get_ephemeral_ca() {
+	curl -s --retry-connrefused --retry 10 http://fulcio-server:5555/api/v1/rootCert > /etc/config/root.pem
+}
+
+function create_log () {
+	/go/bin/createtree -admin_server trillian-log-server:8096 > /tmp/logid
+	echo -n "Created log ID " && cat /tmp/logid
+}
+
+function update_config() {
+	cat /root/ctfe/ct_server.cfg | sed -e "s/%LOGID%/"`cat /tmp/logid`"/g" > /etc/config/ct_server.cfg
+	cp /root/ctfe/*.pem /etc/config/
+}
+
+# check to see if log id exists; if so, use that
+echo -n "Checking for existing configuration..."
+echo "Checking for preexisting logs..."
+get_log_id
+# else create one
+if ! [[ -s /tmp/logid ]]; then
+	echo "No log found; let's create one..."
+	create_log
+fi
+echo "Updating config with current log"
+update_config
+
+configid=`cat /etc/config/ct_server.cfg|grep log_id|awk ' { print $2 } '`
+echo "Exisiting configuration uses log ID $configid, exiting"
+
+echo "Grabing fulcio root pem file"
+get_ephemeral_ca
+
+echo "Finished ct_server configuration"

test/cli/test-fixtures/attestation/docker-compose-config.yaml

@@ -0,0 +1,48 @@
+#
+# Copyright 2021 The Sigstore Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+issuer: http://dex-idp:8888/auth
+
+storage:
+  type: memory
+
+web:
+  http: 0.0.0.0:8888
+
+frontend:
+  issuer: Fulcio in Docker Compose
+
+expiry:
+  signingKeys: "24h"
+  idTokens: "1m"
+  authRequests: "24h"
+
+oauth2:
+  responseTypes: [ "code" ]
+  alwaysShowLoginScreen: true
+  skipApprovalScreen: true
+
+connectors:
+- type: mockCallback
+  id: https://any.valid.url/
+  name: AlwaysApprovesOIDCProvider
+
+staticClients:
+  - id: fulcio
+    public: true
+    name: 'Fulcio in Docker Compose'
+
+# Dex's issuer URL + "/callback"
+redirectURI: http://dex-idp:8888/auth/callback

test/cli/test-fixtures/attestation/docker-compose.yaml

@@ -0,0 +1,116 @@
+version: '3.2'
+services:
+  fulcio-server:
+    image: fulcio_fulcio-server
+    command: [
+      "fulcio-server",
+      "serve",
+      "--host=0.0.0.0",
+      "--port=5555",
+      "--ca=ephemeralca",
+      "--ct-log-url=http://ct_server:6962/test",
+      ]
+    restart: always # keep the server running
+    ports:
+      - "5555:5555"
+    volumes:
+      - ./config/config.json:/etc/fulcio-config/config.json:z
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:5555/ping"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 5s
+    depends_on:
+      - dex-idp
+  mysql:
+    image: gcr.io/trillian-opensource-ci/db_server:3c8193ebb2d7fedb44d18e9c810d0d2e4dbb7e4d
+    environment:
+      - MYSQL_ROOT_PASSWORD=password
+      - MYSQL_DATABASE=test
+      - MYSQL_USER=test
+      - MYSQL_PASSWORD=password
+    restart: always # keep the MySQL server running
+    healthcheck:
+      test: ["CMD", "/etc/init.d/mysql", "status"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+      start_period: 10s
+  ctfe_init:
+    build:
+      context: .
+      dockerfile: Dockerfile.ctfe_init
+    depends_on:
+      - trillian-log-server
+      - fulcio-server
+    volumes:
+      - ctfeConfig:/etc/config/:rw
+  ct_server:
+    image: gcr.io/trillian-opensource-ci/ctfe
+    volumes:
+      - ctfeConfig:/etc/config/:rw
+    command: [
+        "--log_config" ,"/etc/config/ct_server.cfg",
+        "--log_rpc_server", "trillian-log-server:8096",
+        "--http_endpoint", "0.0.0.0:6962",
+        "--alsologtostderr",
+    ]
+    restart: always # retry while ctfe_init is running
+    depends_on:
+      - trillian-log-server
+      - trillian-log-signer
+      - ctfe_init
+    ports:
+      - "6962:6962"
+  dex-idp:
+    image: dexidp/dex:v2.30.0
+    user: root
+    command: [
+      "dex",
+      "serve",
+      "/etc/config/docker-compose-config.yaml",
+      ]
+    restart: always # keep the server running
+    ports:
+      - "8888:8888"
+    volumes:
+      - ./config/dex:/etc/config/:ro
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8888/auth/healthz"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 5s
+  trillian-log-server:
+    image: gcr.io/trillian-opensource-ci/log_server
+    command: [
+      "--storage_system=mysql",
+      "--mysql_uri=test:password@tcp(mysql:3306)/test",
+      "--rpc_endpoint=0.0.0.0:8096",
+      "--http_endpoint=0.0.0.0:8095",
+      "--alsologtostderr",
+    ]
+    restart: always # retry while mysql is starting up
+    ports:
+      - "8096:8096"
+      - "8095:8095"
+    depends_on:
+      - mysql
+  trillian-log-signer:
+    image: gcr.io/trillian-opensource-ci/log_signer
+    command: [
+      "--storage_system=mysql",
+      "--mysql_uri=test:password@tcp(mysql:3306)/test",
+      "--rpc_endpoint=0.0.0.0:8095",
+      "--http_endpoint=0.0.0.0:8097",
+      "--force_master",
+      "--alsologtostderr",
+    ]
+    restart: always # retry while mysql is starting up
+    ports:
+      - "8097:8097"
+    depends_on:
+      - mysql
+volumes:
+  ctfeConfig: {}