diff --git a/go.mod b/go.mod index 89e8050533..05dc55551e 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/openshift/api v0.0.0-20240521185306-0314f31e7774 github.com/openshift/apiserver-library-go v0.0.0-20230816171015-6bfafa975bfb github.com/openshift/client-go v0.0.0-20240523113335-452272e0496d - github.com/sigstore/cosign/v2 v2.6.4 + github.com/sigstore/cosign/v2 v2.6.5 github.com/spf13/cobra v1.10.2 github.com/spf13/viper v1.21.0 github.com/stretchr/testify v1.11.1 diff --git a/go.sum b/go.sum index 53ec9719ee..29de37764e 100644 --- a/go.sum +++ b/go.sum @@ -2539,8 +2539,8 @@ github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepq github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI= github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= -github.com/sigstore/cosign/v2 v2.6.4 h1:DiyWP1/SVM+K8gXLIyn22FSFdEhw1e4dzdZKfRq5qOw= -github.com/sigstore/cosign/v2 v2.6.4/go.mod h1:g+P/LgYyJkC85WGGDho7yySl3C6xTJzzpLm21ZV+E6s= +github.com/sigstore/cosign/v2 v2.6.5 h1:D7kFSWS2HzfD+LpEuBO89D1KfOAODlkWuuhzXS8yzi0= +github.com/sigstore/cosign/v2 v2.6.5/go.mod h1:g+P/LgYyJkC85WGGDho7yySl3C6xTJzzpLm21ZV+E6s= github.com/sigstore/fulcio v1.8.4 h1:awmmItiPwteo8t8sVOoIAPnmbDfLb1JGW0LPY8SNCdY= github.com/sigstore/fulcio v1.8.4/go.mod h1:2jh+uWOfWroKHlhUzr81AFqnAYeZiIi3NC/vegCbiYw= github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY= diff --git a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob.go b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob.go index 125ccbfdce..f1065ad826 100644 --- a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob.go +++ b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob.go @@ -249,26 +249,14 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error { if err != nil { return err } - // A certificate is required in the bundle unless we specified with - // --key, --sk, or --certificate. - if b.Cert == "" && co.SigVerifier == nil && cert == nil { - return fmt.Errorf("bundle does not contain cert for verification, please provide public key") - } - // We have to condition on this because sign-blob may not output the signing - // key to the bundle when there is no tlog upload. if b.Cert != "" { - // b.Cert can either be a certificate or public key certBytes := []byte(b.Cert) if isb64(certBytes) { certBytes, _ = base64.StdEncoding.DecodeString(b.Cert) } bundleCert, err := loadCertFromPEM(certBytes) if err != nil { - // check if cert is actually a public key - co.SigVerifier, err = sigs.LoadPublicKeyRaw(certBytes, crypto.SHA256) - if err != nil { - return fmt.Errorf("loading verifier from bundle: %w", err) - } + return fmt.Errorf("loading verifier certificate from bundle: %w", err) } // if a cert was passed in, make sure it matches the cert in the bundle if cert != nil && !cert.Equal(bundleCert) { @@ -276,6 +264,11 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error { } cert = bundleCert } + // A verifier must come either from a certificate from the bundle, + // or provided via --key, --sk, or --certificate. + if co.SigVerifier == nil && cert == nil { + return fmt.Errorf("bundle does not contain cert for verification, please provide public key") + } opts = append(opts, static.WithBundle(b.Bundle)) } if c.RFC3161TimestampPath != "" { diff --git a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob_attestation.go b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob_attestation.go index 4919aed78d..bbef47771e 100644 --- a/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob_attestation.go +++ b/vendor/github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify_blob_attestation.go @@ -348,26 +348,14 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st if err != nil { return err } - // A certificate is required in the bundle unless we specified with - // --key, --sk, or --certificate. - if b.Cert == "" && co.SigVerifier == nil && cert == nil { - return fmt.Errorf("bundle does not contain cert for verification, please provide public key") - } - // We have to condition on this because sign-blob may not output the signing - // key to the bundle when there is no tlog upload. if b.Cert != "" { - // b.Cert can either be a certificate or public key certBytes := []byte(b.Cert) if isb64(certBytes) { certBytes, _ = base64.StdEncoding.DecodeString(b.Cert) } bundleCert, err := loadCertFromPEM(certBytes) if err != nil { - // check if cert is actually a public key - co.SigVerifier, err = sigs.LoadPublicKeyRaw(certBytes, crypto.SHA256) - if err != nil { - return fmt.Errorf("loading verifier from bundle: %w", err) - } + return fmt.Errorf("loading verifier certificate from bundle: %w", err) } // if a cert was passed in, make sure it matches the cert in the bundle if cert != nil && !cert.Equal(bundleCert) { @@ -375,6 +363,11 @@ func (c *VerifyBlobAttestationCommand) Exec(ctx context.Context, artifactPath st } cert = bundleCert } + // A verifier must come either from a certificate from the bundle, + // or provided via --key, --sk, or --certificate. + if co.SigVerifier == nil && cert == nil { + return fmt.Errorf("bundle does not contain cert for verification, please provide public key") + } encodedSig, err = base64.StdEncoding.DecodeString(b.Base64Signature) if err != nil { diff --git a/vendor/github.com/sigstore/cosign/v2/pkg/cosign/verify.go b/vendor/github.com/sigstore/cosign/v2/pkg/cosign/verify.go index 7bd95a91f1..7f9a1f4827 100644 --- a/vendor/github.com/sigstore/cosign/v2/pkg/cosign/verify.go +++ b/vendor/github.com/sigstore/cosign/v2/pkg/cosign/verify.go @@ -945,15 +945,23 @@ func keyBytes(sig oci.Signature, co *CheckOpts) ([]byte, error) { if err != nil { return nil, err } - // We have a public key. + var pub crypto.PublicKey if co.SigVerifier != nil { - pub, err := co.SigVerifier.PublicKey(co.PKOpts...) + pub, err = co.SigVerifier.PublicKey(co.PKOpts...) if err != nil { return nil, err } - return cryptoutils.MarshalPublicKeyToPEM(pub) } - return cryptoutils.MarshalCertificateToPEM(cert) + if cert != nil && co.SigVerifier != nil { + if err := cryptoutils.EqualKeys(cert.PublicKey, pub); err != nil { + return nil, fmt.Errorf("both public key and certificate were provided but did not match") + } + } + + if cert != nil { + return cryptoutils.MarshalCertificateToPEM(cert) + } + return cryptoutils.MarshalPublicKeyToPEM(pub) } // VerifyBlobSignature verifies a blob signature. diff --git a/vendor/modules.txt b/vendor/modules.txt index 641ac20826..7881647c6f 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1197,7 +1197,7 @@ github.com/segmentio/asm/internal/unsafebytes # github.com/shibumi/go-pathspec v1.3.0 ## explicit; go 1.17 github.com/shibumi/go-pathspec -# github.com/sigstore/cosign/v2 v2.6.4 +# github.com/sigstore/cosign/v2 v2.6.5 ## explicit; go 1.25.0 github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio/fulcioverifier