sigstore 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4bad4cf73b877e79849d568698cd6e2c8af6c703e86f86f5295318b284b2c8bf
-  data.tar.gz: ca77603d12213e6ffc87058bdcc0d08bd45541184b5831f41a8c40bff807b2e4
+  metadata.gz: 6c3e5197bbb3241e4291d84bbb83a86c5dbc68cc954f774dbbef9ea8279be207
+  data.tar.gz: 2bf3d8b1c10807dc993a1275ad788128f9483b718c87da5b21f79588ce533ed1
 SHA512:
-  metadata.gz: 9bd301c8d5579f50336d40259cd3799bb0cce2aff589d54e54509ef6852774defc642a8201894066f6c3d478a7a0476c344932b15df42a990e36673a1c5449e4
-  data.tar.gz: d7550a3c470f6c2ab794ec9ecc9bba4ad40129ae4156357ae5e0a6b8b9d4e26f3209578e81e1b88621f9ca90f463a84e274af0e37070b7f1a8b5393eacae185e
+  metadata.gz: c23dd685934043f14460c655650eb25280e7984789bd2fa5b3c70afdb1ab0a8cfd591eaf07d3e894fbec5bbffd087c4cd4f3ad9d1c9d04da9f18f47aa670bd4e
+  data.tar.gz: 2ad3857c1e1c85fe04007d471d4c68c19bf5080bfbd0c492860a60717f88af987fb66498c2d51ab267e763eba3357da72c95149592f352594625152a8d920015

data/lib/sigstore/internal/json.rb

@@ -18,33 +18,44 @@ module Sigstore::Internal
   module JSON
     # Implements https://wiki.laptop.org/go/Canonical_JSON
     #
-    # TODO: This is a naive implementation. Performance can be improved by
-    #       serializing into a buffer instead of concatenating strings.
-    def self.canonical_generate(data)
+    def self.canonical_generate(data, buffer = +"")
       case data
       when NilClass
-        "null"
+        buffer << "null"
       when TrueClass
-        "true"
+        buffer << "true"
       when FalseClass
-        "false"
+        buffer << "false"
       when Integer
-        data.to_s
+        buffer << data.to_s
       when String
-        "\"#{data.gsub(/(["\\])/, '\\\\\1')}\""
+        buffer << '"' << data.gsub(/(["\\])/, '\\\\\1') << '"'
       when Array
-        contents = data.map { |v| canonical_generate(v) }.join(",")
-        "[#{contents}]"
+        buffer << "["
+        data.each_with_index do |v, i|
+          buffer << "," unless i.zero?
+          canonical_generate(v, buffer)
+        end
+        buffer << "]"
       when Hash
         contents = data.sort_by do |k, _|
           raise ArgumentError, "Non-string key in hash" unless k.is_a?(String)
 
           k.encode("utf-16").codepoints
         end
-        contents.map! do |k, v|
-          "#{canonical_generate(k)}:#{canonical_generate(v)}"
+        buffer << "{"
+        comma = false
+        contents.each do |k, v|
+          if comma
+            buffer << ","
+          else
+            comma = true
+          end
+          canonical_generate(k, buffer)
+          buffer << ":"
+          canonical_generate(v, buffer)
         end
-        "{#{contents.join(",")}}"
+        buffer << "}"
       else
         raise ArgumentError, "Unsupported data type: #{data.class}"
       end

data/lib/sigstore/internal/x509.rb

@@ -38,6 +38,8 @@ module Sigstore
 
         def self.read(certificate_bytes)
           new(OpenSSL::X509::Certificate.new(certificate_bytes))
+        rescue OpenSSL::X509::CertificateError => e
+          raise Error::InvalidCertificate, e.message
         end
 
         def tbs_certificate_der
@@ -104,7 +106,7 @@ module Sigstore
 
           key_usage = extension(Extension::KeyUsage) ||
                       raise(Error::InvalidCertificate,
-                            "no keyUsage in #{@x509_certificate.extensions.map(&:to_h)}")
+                            "no keyUsage in #{openssl.extensions.map(&:to_h)}")
 
           unless key_usage.digital_signature
             raise Error::InvalidCertificate,

data/lib/sigstore/models.rb

@@ -80,6 +80,12 @@ module Sigstore
 
     def initialize(*)
       super
+
+      unless bundle.is_a?(Bundle::V1::Bundle)
+        raise ArgumentError,
+              "bundle must be a #{Bundle::V1::Bundle}, is #{bundle.class}"
+      end
+
       @trusted_root = TrustedRoot.new(artifact_trust_root)
       @sbundle = SBundle.new(bundle)
       if sbundle.message_signature? && !artifact
@@ -138,13 +144,19 @@ module Sigstore
         expected_hashed_rekord_tlog_entry(hashed_input)
       when :dsse_envelope
         rekor_entry = verification_material.tlog_entries.first
-        case JSON.parse(rekor_entry.canonicalized_body).values_at("kind", "apiVersion")
+        canonicalized_body = begin
+          JSON.parse(rekor_entry.canonicalized_body)
+        rescue JSON::ParserError
+          raise Error::InvalidBundle, "expected canonicalized_body to be JSON"
+        end
+
+        case kind_version = canonicalized_body.values_at("kind", "apiVersion")
         when %w[dsse 0.0.1]
           expected_dsse_0_0_1_tlog_entry
         when %w[intoto 0.0.2]
           expected_intoto_0_0_2_tlog_entry
         else
-          raise Error::InvalidRekorEntry, "Unhandled rekor entry kind/version: #{t.inspect}"
+          raise Error::InvalidRekorEntry, "Unhandled rekor entry kind/version: #{kind_version.inspect}"
         end
       else
         raise Error::InvalidBundle, "expected either message_signature or dsse_envelope"
@@ -154,6 +166,8 @@ module Sigstore
     private
 
     def validate_version!
+      raise Error::InvalidBundle, "bundle requires verification material" unless verification_material
+
       case bundle_type
       when BundleType::BUNDLE_0_1
         unless verification_material.tlog_entries.all?(&:inclusion_promise)
@@ -169,7 +183,7 @@ module Sigstore
           raise Error::InvalidBundle,
                 "must contain an inclusion proof"
         end
-        unless verification_material.tlog_entries.all? { |t| t.inclusion_proof.checkpoint.envelope }
+        unless verification_material.tlog_entries.all? { |t| t.inclusion_proof.checkpoint&.envelope }
           raise Error::InvalidBundle,
                 "inclusion proof must contain a checkpoint"
         end
@@ -192,9 +206,9 @@ module Sigstore
       when :certificate
         @leaf_certificate = Internal::X509::Certificate.read(verification_material.certificate.raw_bytes)
       else
-        raise Error::InvalidBundle, "Unsupported bundle content: #{content}"
+        raise Error::InvalidBundle, "Unsupported bundle content: #{content.inspect}"
       end
-      raise Error::InvalidBundle, "Expected leaf certificate" unless @leaf_certificate.leaf?
+      raise Error::InvalidBundle, "expected certificate to be leaf" unless @leaf_certificate.leaf?
     end
 
     def expected_hashed_rekord_tlog_entry(hashed_input)

data/lib/sigstore/policy.rb

@@ -51,14 +51,16 @@ module Sigstore
       OID = "1.3.6.1.4.1.57264.1.1"
     end
 
-    class OIDCIssuerV2 < SingleX509ExtPolicy
-      OID = "1.3.6.1.4.1.57264.1.8"
-
+    class SingleX509ExtDerEncodedPolicy < SingleX509ExtPolicy
       def ext_value(ext)
         OpenSSL::ASN1.decode(ext.value_der).value
       end
     end
 
+    class OIDCIssuerV2 < SingleX509ExtDerEncodedPolicy
+      OID = "1.3.6.1.4.1.57264.1.8"
+    end
+
     class AnyOf
       def initialize(*policies)
         @policies = policies

data/lib/sigstore/signer.rb

@@ -97,9 +97,9 @@ module Sigstore
 
       {
         credentials: {
-          oidc_identity_token: @identity_token.raw_token
+          oidcIdentityToken: @identity_token.raw_token
         },
-        certificate_signing_request: Internal::Util.base64_encode(csr.to_pem)
+        certificateSigningRequest: Internal::Util.base64_encode(csr.to_pem)
       }
     end
 

data/lib/sigstore/tuf/updater.rb

@@ -21,6 +21,8 @@ require_relative "snapshot"
 require_relative "targets"
 require_relative "timestamp"
 
+require "set"
+
 module Sigstore::TUF
   class Updater
     include Sigstore::Loggable

data/lib/sigstore/tuf.rb

@@ -91,7 +91,7 @@ module Sigstore
 
       def get_dirs(url)
         app_name = "sigstore-ruby"
-        app_author = "segiddins"
+        app_author = "sigstore"
 
         repo_base = URI.encode_uri_component(url)
         home = Dir.home

data/lib/sigstore/verifier.rb

@@ -118,7 +118,7 @@ module Sigstore
 
         unless store_ctx.verify
           return VerificationFailure.new(
-            "failed to validate certification from fulcio cert chain: #{store_ctx.error_string}"
+            "failed to validate certificate from fulcio cert chain: #{store_ctx.error_string}"
           )
         end
 
@@ -183,7 +183,12 @@ module Sigstore
 
         case bundle.dsse_envelope.payloadType
         when "application/vnd.in-toto+json"
-          verify_in_toto(input, JSON.parse(bundle.dsse_envelope.payload))
+          in_toto = begin
+            JSON.parse(bundle.dsse_envelope.payload)
+          rescue JSON::ParserError
+            raise Error::InvalidBundle, "invalid JSON for in-toto statement in DSSE payload"
+          end
+          verify_in_toto(input, in_toto)
         else
           raise Sigstore::Error::Unimplemented,
                 "unsupported DSSE payload type: #{bundle.dsse_envelope.payloadType.inspect}"
@@ -432,7 +437,11 @@ module Sigstore
 
       logger.debug { "Found rekor entry: #{entry}" }
 
-      actual_body = JSON.parse(entry.canonicalized_body)
+      actual_body = begin
+        JSON.parse(entry.canonicalized_body)
+      rescue JSON::ParserError
+        raise Error::InvalidRekorEntry, "invalid JSON in rekor entry canonicalized_body"
+      end
       if bundle.dsse_envelope?
         # since the hash is over the uncanonicalized envelope, we need to remove it
         #

data/lib/sigstore/version.rb

@@ -15,5 +15,5 @@
 # limitations under the License.
 
 module Sigstore
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end

data/lib/sigstore.rb

@@ -42,3 +42,6 @@ module Sigstore
     end
   end
 end
+
+require_relative "sigstore/verifier"
+require_relative "sigstore/signer"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sigstore
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - The Sigstore Authors
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-10-21 00:00:00.000000000 Z
+date: 2024-11-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: net-http
@@ -121,7 +121,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
+rubygems_version: 3.5.22
 signing_key: 
 specification_version: 4
 summary: A pure-ruby implementation of sigstore signature verification