Skip to content
This repository was archived by the owner on Sep 23, 2025. It is now read-only.

Commit cc676ff

Browse files
vaikasvaikas
committed
add v1alpha1 docs, construct the rekor logid from public key.
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
1 parent a07dfa6 commit cc676ff

7 files changed

Lines changed: 374 additions & 7 deletions

File tree

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,4 +197,8 @@ docs/generate-api:
197197
"v1beta1" \
198198
`find ./pkg/apis/policy/v1beta1/ -iname '*types.go' | sort -r | tr '\n' ' '` \
199199
> docs/api-types/index.md;
200+
go run -ldflags "$(GO_LDFLAGS)" ./cmd/api-docs/main.go \
201+
"v1alpha1" \
202+
`find ./pkg/apis/policy/v1alpha1/ -iname '*types.go' | sort -r | tr '\n' ' '` \
203+
> docs/api-types/index-v1alpha1.md;
200204

‎config/300-trustroot.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ spec:
9999
description: / The hash algorithm used for the Merkle Tree
100100
type: string
101101
logID:
102-
description: The unique identifier for this transparency log.
102+
description: The unique identifier for this transparency log. Note for Rekor entries this should be left out, since the LogID is constructed from the PublicKey in order to support sharding.
103103
type: string
104104
publicKey:
105105
description: PEM encoded public key
@@ -117,7 +117,7 @@ spec:
117117
description: / The hash algorithm used for the Merkle Tree
118118
type: string
119119
logID:
120-
description: The unique identifier for this transparency log.
120+
description: The unique identifier for this transparency log. Note for Rekor entries this should be left out, since the LogID is constructed from the PublicKey in order to support sharding.
121121
type: string
122122
publicKey:
123123
description: PEM encoded public key

‎docs/api-types/index-v1alpha1.md‎

Lines changed: 320 additions & 0 deletions
Large diffs are not rendered by default.

‎pkg/apis/policy/v1alpha1/trustroot_types.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,11 @@ type TransparencyLogInstance struct {
117117
HashAlgorithm string `json:"hashAlgorithm"`
118118
// PEM encoded public key
119119
PublicKey []byte `json:"publicKey"`
120-
// The unique identifier for this transparency log.
121-
LogID string `json:"logID"`
120+
// The unique identifier for this transparency log. Note for Rekor entries
121+
// this should be left out, since the LogID is constructed from the
122+
// PublicKey in order to support sharding.
123+
// +optional
124+
LogID string `json:"logID,omitempty"`
122125
}
123126

124127
type DistinguishedName struct {

‎pkg/webhook/validator.go‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,11 @@ package webhook
1818
import (
1919
"bytes"
2020
"context"
21+
"crypto"
2122
"crypto/ecdsa"
23+
"crypto/sha256"
2224
"crypto/x509"
25+
"encoding/hex"
2326
"encoding/json"
2427
"errors"
2528
"fmt"
@@ -1417,7 +1420,11 @@ func rekorKeysFromTrustRef(ctx context.Context, trustRootRef string) (*cosign.Tr
14171420
if !ok {
14181421
return nil, "", fmt.Errorf("public key %d is not ecdsa.PublicKey", i)
14191422
}
1420-
retKeys.Keys[tlog.LogID] = cosign.RekorPubKey{
1423+
logID, err := getLogID(tlog.LogID, pkecdsa)
1424+
if err != nil {
1425+
return nil, "", fmt.Errorf("failed to create LogID from public key")
1426+
}
1427+
retKeys.Keys[logID] = cosign.RekorPubKey{
14211428
PubKey: pkecdsa,
14221429
Status: tuf.Active,
14231430
}
@@ -1427,3 +1434,20 @@ func rekorKeysFromTrustRef(ctx context.Context, trustRootRef string) (*cosign.Tr
14271434
}
14281435
return nil, "", fmt.Errorf("trustRootRef %s not found", trustRootRef)
14291436
}
1437+
1438+
// LogID for Rekor apparently gets generated from the public key, so for future
1439+
// proofing, we allow one to specify it in the TLog config for
1440+
// TransparencyLogInstance but perhaps for Rekor we should never allow for it?
1441+
//
1442+
// getLogID generates a SHA256 hash of a DER-encoded public key.
1443+
func getLogID(logID string, pub crypto.PublicKey) (string, error) {
1444+
if logID != "" {
1445+
return logID, nil
1446+
}
1447+
pubBytes, err := x509.MarshalPKIXPublicKey(pub)
1448+
if err != nil {
1449+
return "", err
1450+
}
1451+
digest := sha256.Sum256(pubBytes)
1452+
return hex.EncodeToString(digest[:]), nil
1453+
}

‎pkg/webhook/validator_test.go‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,8 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7D2WvgqSzs9jpdJsOJ5Nl6xg8JXm
117117
Nmo7M3bN7+dQddw9Ibc2R3SV8tzBZw0rST8FKcn4apJepcKM4qUpYUeNfw==
118118
-----END PUBLIC KEY-----
119119
`
120+
// This is the Rekor LogID constructed from above public key.
121+
rekorLogID = "0bac0fddd0c15fbc46f8b1bf51c2b57676a9f262294fe13417d85602e73f392a"
120122
)
121123

122124
func TestValidatePodSpec(t *testing.T) {
@@ -2914,10 +2916,18 @@ func TestRekorClientAndKeysFromAuthority(t *testing.T) {
29142916
BaseURL: *apis.HTTPS("rekor.example.com"),
29152917
}},
29162918
}
2919+
// This one constructs the Rekor logid from the PublicKey
2920+
skNoLogID := config.SigstoreKeys{
2921+
TLogs: []config.TransparencyLogInstance{{
2922+
PublicKey: []byte(rekorPublicKey),
2923+
BaseURL: *apis.HTTPS("rekor.example.com"),
2924+
}},
2925+
}
29172926
c := &config.Config{
29182927
SigstoreKeysConfig: &config.SigstoreKeysMap{
29192928
SigstoreKeys: map[string]config.SigstoreKeys{
2920-
"test-trust-root": sk,
2929+
"test-trust-root": sk,
2930+
"test-trust-root-construct-logid": skNoLogID,
29212931
},
29222932
},
29232933
}
@@ -2960,6 +2970,13 @@ func TestRekorClientAndKeysFromAuthority(t *testing.T) {
29602970
wantLogID: "rekor-logid",
29612971
ctx: testCtx,
29622972
wantClient: true,
2973+
}, {
2974+
name: "trustroot found, LogID constructed from PublicKey",
2975+
tlog: &v1alpha1.TLog{TrustRootRef: "test-trust-root-construct-logid"},
2976+
wantPK: ecpk,
2977+
wantLogID: rekorLogID,
2978+
ctx: testCtx,
2979+
wantClient: true,
29632980
}}
29642981

29652982
for _, tc := range tests {

‎test/testdata/trustroot/e2e/bring-your-own-keys.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ spec:
3030
hashAlgorithm: sha-256
3131
publicKey: |-
3232
REKOR_PUBLIC_KEY
33-
logID: ""
3433
ctLogs:
3534
- baseURL: https://ctfe.example.com
3635
hashAlgorithm: sha-256

0 commit comments

Comments
 (0)