835 - Keyless Support for SBOM Attestations (#910)

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

test/cli/test-fixtures/attestation/config/config.json

@@ -0,0 +1,9 @@
+{
+  "OIDCIssuers": {
+	"http://dex-idp:8888/auth": {
+      "IssuerURL": "http://dex-idp:8888/auth",
+      "ClientID": "fulcio",
+      "Type": "email"
+    }
+  }
+}

test/cli/test-fixtures/attestation/config/ctfe/ct_server.cfg

@@ -0,0 +1,11 @@
+config {
+	log_id: %LOGID%
+	prefix: "test"
+	roots_pem_file: "/etc/config/root.pem"
+	private_key: {
+		[type.googleapis.com/keyspb.PEMKeyFile] {
+			path: "/etc/config/privkey.pem"
+			password: "foobar"
+		}
+	}
+}

test/cli/test-fixtures/attestation/config/ctfe/privkey.pem

@@ -0,0 +1,8 @@
+-----BEGIN EC PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-CBC,05BAAA9143C46320
+
+AttbquLclNy7ZEnlDFpReZvV2PZKuv89YMWqDvGGtnBVw+3eXYIa54Xli1CyXEPn
+qNGvibjIxj+Q19+VhA3n42SE2fHyULHKPZHebSL5qcVvZTqmbtAe/dZNH1SiGG2f
+bWauIw0oeHhXW5i9isxrLggPMRmPA65Ii3W7gyWFmjE=
+-----END EC PRIVATE KEY-----

test/cli/test-fixtures/attestation/config/ctfe/pubkey.pem

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbbQiLx6GKy6ivhc11wJGbQjc2VX/
+mnuk5d670MTXR3p+LIAcxd5MhqIHpLmyYJ5mDKLEoZ/pC0nPuje3JueBcA==
+-----END PUBLIC KEY-----

test/cli/test-fixtures/attestation/config/dex/docker-compose-config.yaml

@@ -0,0 +1,48 @@
+#
+# Copyright 2021 The Sigstore Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+issuer: http://dex-idp:8888/auth
+
+storage:
+  type: memory
+
+web:
+  http: dex-idp:8888
+
+frontend:
+  issuer: Fulcio in Docker Compose
+
+expiry:
+  signingKeys: "24h"
+  idTokens: "1m"
+  authRequests: "24h"
+
+oauth2:
+  responseTypes: [ "code" ]
+  alwaysShowLoginScreen: false
+  skipApprovalScreen: true
+
+connectors:
+- type: mockCallback
+  id: approved
+  name: AlwaysApprovesOIDCProvider
+
+staticClients:
+  - id: fulcio
+    public: true
+    name: 'Fulcio in Docker Compose'
+
+# Dex's issuer URL + "/callback"
+redirectURI: http://dex-idp:8888/auth/callback

test/cli/test-fixtures/attestation/config/logid.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+#
+# Copyright 2021 The Sigstore Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+function get_log_id() {
+	curl -s --retry-connrefused --retry 10 http://trillian-log-server:8095/metrics |grep "^quota_acquired_tokens{spec=\"trees"|head -1|awk ' { print $1 } '|sed -e 's/[^0-9]*//g' > /tmp/logid
+}
+
+function get_ephemeral_ca() {
+	curl -s --retry-connrefused --retry 10 http://fulcio-server:5555/api/v1/rootCert > /etc/config/root.pem
+}
+
+function create_log () {
+	/go/bin/createtree -admin_server trillian-log-server:8096 > /tmp/logid
+	echo -n "Created log ID " && cat /tmp/logid
+}
+
+function update_config() {
+	cat /root/ctfe/ct_server.cfg | sed -e "s/%LOGID%/"`cat /tmp/logid`"/g" > /etc/config/ct_server.cfg
+	cp /root/ctfe/*.pem /etc/config/
+}
+
+# check to see if log id exists; if so, use that
+echo -n "Checking for existing configuration..."
+echo "Checking for preexisting logs..."
+get_log_id
+# else create one
+if ! [[ -s /tmp/logid ]]; then
+	echo "No log found; let's create one..."
+	create_log
+fi
+echo "Updating config with current log"
+update_config
+
+configid=`cat /etc/config/ct_server.cfg|grep log_id|awk ' { print $2 } '`
+echo "Exisiting configuration uses log ID $configid, exiting"
+
+echo "Grabing fulcio root pem file"
+get_ephemeral_ca
+
+echo "Finished ct_server configuration"