sigstore 0.2.3 → 0.3.0

data/lib/sigstore/signer.rb

@@ -14,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+require "protobug_in_toto_attestation_protos"
+
 require_relative "internal/util"
 require_relative "internal/x509"
 require_relative "models"
@@ -26,32 +28,32 @@ module Sigstore
   class Signer
     include Loggable
 
-    def initialize(jwt:, trusted_root:)
+    STATEMENT_REGISTRY = Protobug::Registry.new do |registry|
+      InTotoAttestation::V1.register_statement_protos(registry)
+    end
+
+    def initialize(jwt:, trusted_root:, signing_config: nil)
       @identity_token = OIDC::IdentityToken.new(jwt)
       @trusted_root = trusted_root
+      @signing_config = signing_config
 
       @verifier = Verifier.for_trust_root(trust_root: @trusted_root)
     end
 
+    IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json"
+
     def sign(payload)
-      # 2) generate a keypair
-      keypair = generate_keypair
-      # 3) generate a CreateSigningCertificateRequest
-      csr = generate_csr(keypair)
-      # 4) get a cert chain from fulcio
-      leaf = fetch_cert(csr)
-      # 5) verify returned cert chain
-      verify_chain(leaf)
-      # 6) sign the payload
+      keypair, leaf = issue_signing_certificate
+
+      # Sign the payload, then submit a hash of the signature to the TSA and the
+      # signing metadata (a hashedrekord) to the transparency log.
       signature = sign_payload(payload, keypair)
-      # 7) send hash of signature to timestamping service
       timestamp_verification_data = submit_signature_hash_to_timstamping_service(signature)
-      # 8) submit signed metadata to transparency service
+
       hashed_input = Common::V1::HashOutput.new
       hashed_input.algorithm = Common::V1::HashAlgorithm::SHA2_256
       hashed_input.digest = OpenSSL::Digest("SHA256").digest(payload)
-      tlog_entry = submit_signed_metadata_to_transparency_service(signature, leaf, hashed_input)
-      # 9) perform verification
+      tlog_entry = submit_message_signature_entry(signature, leaf, hashed_input)
 
       bundle = collect_bundle(leaf, [tlog_entry], timestamp_verification_data, hashed_input, signature)
       verify(payload, bundle)
@@ -59,8 +61,39 @@ module Sigstore
       bundle
     end
 
+    # Sign +payload+ (an in-toto statement) as a DSSE envelope, returning a
+    # bundle whose content is the envelope rather than a message signature.
+    def sign_dsse(payload, payload_type: IN_TOTO_PAYLOAD_TYPE)
+      keypair, leaf = issue_signing_certificate
+
+      # DSSE signs the Pre-Authentication Encoding of the payload, not the
+      # payload itself.
+      pae = Internal::Util.dsse_pae(payload_type, payload)
+      signature = sign_payload(pae, keypair)
+      envelope = build_dsse_envelope(payload, payload_type, signature)
+
+      timestamp_verification_data = submit_signature_hash_to_timstamping_service(signature)
+      tlog_entry = submit_dsse_entry(envelope, leaf, pae)
+
+      bundle = collect_dsse_bundle(leaf, [tlog_entry], timestamp_verification_data, envelope)
+      verify_dsse_statement(payload, bundle)
+
+      bundle
+    end
+
     private
 
+    # Generate an ephemeral keypair, obtain a Fulcio signing certificate bound to
+    # the identity token, and verify the returned chain. Shared by all signing
+    # flows; returns [keypair, leaf_certificate].
+    def issue_signing_certificate
+      keypair = generate_keypair
+      csr = generate_csr(keypair)
+      leaf = fetch_cert(csr)
+      verify_chain(leaf)
+      [keypair, leaf]
+    end
+
     def generate_keypair
       # maybe allow configuring?
       key = OpenSSL::PKey::EC.generate("prime256v1")
@@ -104,8 +137,14 @@ module Sigstore
       }
     end
 
+    def fulcio_url
+      return @signing_config.fulcio.url if @signing_config
+
+      @trusted_root.certificate_authority_for_signing.uri
+    end
+
     def fetch_cert(csr)
-      uri = URI.parse @trusted_root.certificate_authority_for_signing.uri
+      uri = URI.parse fulcio_url
       uri = URI.join(uri, "api/v2/signingCert")
       resp = Net::HTTP.post(
         uri,
@@ -188,13 +227,57 @@ module Sigstore
       key.sign("SHA256", payload)
     end
 
-    # TODO: implement
-    def submit_signature_hash_to_timstamping_service(_signature)
+    def submit_signature_hash_to_timstamping_service(signature)
       # The Signer sends a hash of the signature as the messageImprint in a TimeStampReq to the Timestamping Service and
       # receives a TimeStampResp including a `TimeStampToken`.
       # The signer MUST verify the TimeStampToken against the payload and Timestamping Service root certificate.
+      #
+      # Timestamping is driven by the signing config: a Rekor v2 entry carries no
+      # integrated time, so a TSA timestamp is the only trusted signing time. The
+      # returned tokens are verified below in #verify (against the trusted root).
+      tsa_urls = @signing_config&.tsa_urls || []
+      return nil if tsa_urls.empty?
+
+      timestamps = tsa_urls.map { |url| request_timestamp(url, signature) }
 
-      nil
+      Bundle::V1::TimestampVerificationData.new.tap do |data|
+        data.rfc3161_timestamps = timestamps
+      end
+    end
+
+    def request_timestamp(url, signature)
+      # The message imprint is a hash of the signature (RFC 3161 §2.4.1); the
+      # Verifier binds the timestamp back to the bundle signature via this imprint.
+      req = OpenSSL::Timestamp::Request.new
+      req.algorithm = "SHA256"
+      req.message_imprint = OpenSSL::Digest::SHA256.digest(signature)
+      req.cert_requested = true
+      req.version = 1
+      req.nonce = OpenSSL::BN.rand(64)
+
+      uri = URI.parse(url)
+      resp = Net::HTTP.post(
+        uri, req.to_der,
+        { "Content-Type" => "application/timestamp-query", "User-Agent" => Sigstore::USER_AGENT }
+      )
+      unless resp.code == "200"
+        raise Error::InvalidTimestamp, "TSA #{url} returned #{resp.code} #{resp.message}\n#{resp.body}"
+      end
+
+      # Parse the response to fail fast on a malformed token and confirm the TSA
+      # actually granted a timestamp (PKIStatus GRANTED / GRANTED_WITH_MODS); a token
+      # is only present for those statuses. Cryptographic verification of the token is
+      # deferred to the verification step.
+      response = OpenSSL::Timestamp::Response.new(resp.body)
+      unless [OpenSSL::Timestamp::Response::GRANTED,
+              OpenSSL::Timestamp::Response::GRANTED_WITH_MODS].include?(response.status)
+        raise Error::InvalidTimestamp,
+              "TSA #{url} did not grant a timestamp (status #{response.status}): #{response.status_text.inspect}"
+      end
+
+      Common::V1::RFC3161SignedTimestamp.new.tap do |ts|
+        ts.signed_timestamp = resp.body
+      end
     end
 
     def build_proposed_hashed_rekord_entry(signature, cert, hashed_input)
@@ -226,17 +309,27 @@ module Sigstore
       }
     end
 
-    def submit_signed_metadata_to_transparency_service(signature, cert, hashed_input)
-      # The Signer chooses a format for signing metadata; this format MUST be in the supportedMetadataFormats in the
-      # Transparency Service configuration. The Signer prepares signing metadata containing at a minimum:
-      # * The signature.
-      # * The payload (possibly pre-hashed; if so, the entry also includes the identifier of the hash algorithm).
-      # * Verification material (signing certificate or verification key).
-      #   * If the verification material is a certificate, the client SHOULD upload only the signing certificate and
-      #     SHOULD NOT upload the CA certificate chain.
-      #
-      # The signing metadata might contain additional, application-specific metadata according to the format used.
-      # The Signer then canonically encodes the metadata (according to the chosen format).
+    # Submit a hashedrekord entry for a message signature: the prehash digest of
+    # the artifact, signed.
+    #
+    # The Signer chooses a format for signing metadata; this format MUST be in the supportedMetadataFormats in the
+    # Transparency Service configuration. The Signer prepares signing metadata containing at a minimum:
+    # * The signature.
+    # * The payload (possibly pre-hashed; if so, the entry also includes the identifier of the hash algorithm).
+    # * Verification material (signing certificate or verification key).
+    #   * If the verification material is a certificate, the client SHOULD upload only the signing certificate and
+    #     SHOULD NOT upload the CA certificate chain.
+    #
+    # The signing metadata might contain additional, application-specific metadata according to the format used.
+    # The Signer then canonically encodes the metadata (according to the chosen format).
+    def submit_message_signature_entry(signature, cert, hashed_input)
+      # A Rekor v2 (tiled) instance speaks a different API and a different entry
+      # format (hashedrekord 0.0.2). When the signing config selects one, submit
+      # there; otherwise fall back to the v1 hashedrekord flow.
+      if rekor_v2?
+        request = build_create_entry_request(hashed_input.digest, signature, cert)
+        return submit_rekor_v2_entry(request)
+      end
 
       # TODO: allow configuring the entry kind?
       proposed_entry = build_proposed_hashed_rekord_entry(signature, cert, hashed_input)
@@ -248,11 +341,110 @@ module Sigstore
       @verifier.rekor_client.log.entries.post(proposed_entry)
     end
 
+    # Submit a transparency log entry for a DSSE envelope. Rekor v1 stores a
+    # native `dsse` entry; Rekor v2 stores a hashedrekord over the DSSE PAE (the
+    # signed bytes), since v2 only supports the hashedrekord type.
+    def submit_dsse_entry(envelope, cert, pae)
+      if rekor_v2?
+        digest = OpenSSL::Digest::SHA256.digest(pae)
+        request = build_create_entry_request(digest, envelope.signatures.first.sig, cert)
+        return submit_rekor_v2_entry(request)
+      end
+
+      proposed_entry = build_proposed_dsse_entry(envelope, cert)
+
+      ctlog = @trusted_root.tlog_for_signing
+      logger.info { "Submitting to #{ctlog.base_url}" }
+
+      @verifier.rekor_client.log.entries.post(proposed_entry)
+    end
+
+    def rekor_v2?
+      @signing_config && @signing_config.tlog.major_api_version == 2
+    end
+
+    def submit_rekor_v2_entry(request)
+      tlog_url = @signing_config.tlog.url
+      logger.info { "Submitting to #{tlog_url} (Rekor v2)" }
+
+      Rekor::V2Client.new(url: tlog_url).create_entry(request)
+    end
+
+    # A Rekor v2 CreateEntryRequest for a hashedrekord 0.0.2 entry. The request
+    # carries only the prehash digest and the signature + verifier; the log fills
+    # in the data.algorithm (derived from the verifier key details) itself.
+    def build_create_entry_request(digest, signature, cert)
+      {
+        "hashedRekordRequestV002" => {
+          "digest" => Internal::Util.base64_encode(digest),
+          "signature" => {
+            "content" => Internal::Util.base64_encode(signature),
+            "verifier" => {
+              "x509Certificate" => {
+                "rawBytes" => Internal::Util.base64_encode(cert.to_der)
+              },
+              "keyDetails" => key_details(cert)
+            }
+          }
+        }
+      }
+    end
+
+    # A Rekor v1 `dsse` 0.0.1 proposed entry: the full DSSE envelope (as JSON)
+    # plus the signing certificate as a verifier.
+    def build_proposed_dsse_entry(envelope, cert)
+      {
+        "apiVersion" => "0.0.1",
+        "kind" => "dsse",
+        "spec" => {
+          "proposedContent" => {
+            # Rekor expects the envelope as a JSON string nested in the request.
+            "envelope" => envelope.to_json,
+            "verifiers" => [Internal::Util.base64_encode(cert.to_pem)]
+          }
+        }
+      }
+    end
+
+    # The Sigstore PublicKeyDetails enum name for the leaf certificate's key,
+    # used as the Rekor v2 verifier key_details. Only the algorithms this signer
+    # can produce are mapped.
+    def key_details(cert)
+      public_key = cert.openssl.public_key
+      unless public_key.is_a?(OpenSSL::PKey::EC)
+        raise Error::Signing, "unsupported signing key type: #{public_key.class}"
+      end
+
+      case public_key.group.curve_name
+      when "prime256v1" then "PKIX_ECDSA_P256_SHA_256"
+      when "secp384r1" then "PKIX_ECDSA_P384_SHA_384"
+      when "secp521r1" then "PKIX_ECDSA_P521_SHA_512"
+      else
+        raise Error::Signing, "unsupported EC curve: #{public_key.group.curve_name}"
+      end
+    end
+
     def verify(artifact, bundle)
+      input = Verification::V1::Artifact.new.tap { |a| a.artifact = artifact }
+      verify_bundle(input, bundle)
+    end
+
+    # Self-verify a freshly-signed DSSE bundle. The in-toto statement's subject
+    # is matched against an artifact, so verify against the first subject's
+    # SHA2-256 digest (the only artifact reference available at signing time).
+    def verify_dsse_statement(statement, bundle)
+      statement = InTotoAttestation::V1::Statement.decode_json(statement, registry: STATEMENT_REGISTRY)
+      subject = statement.subject.find { |s| s.digest["sha256"] }
+      raise Error::Signing, "in-toto statement has no sha256 subject to verify against" unless subject
+
+      input = Verification::V1::Artifact.new.tap { |a| a.artifact_uri = "sha256:#{subject.digest["sha256"]}" }
+      verify_bundle(input, bundle)
+    end
+
+    def verify_bundle(artifact, bundle)
       verification_input = Verification::V1::Input.new
       verification_input.bundle = bundle
-      verification_input.artifact = Verification::V1::Artifact.new
-      verification_input.artifact.artifact = artifact
+      verification_input.artifact = artifact
 
       result = @verifier.verify(
         input: VerificationInput.new(verification_input),
@@ -267,6 +459,21 @@ module Sigstore
     end
 
     def collect_bundle(leaf_certificate, tlog_entries, timestamp_verification_data, hashed_input, signature)
+      collect_base_bundle(leaf_certificate, tlog_entries, timestamp_verification_data).tap do |bundle|
+        bundle.message_signature = Sigstore::Common::V1::MessageSignature.new.tap do |ms|
+          ms.message_digest = hashed_input
+          ms.signature = signature
+        end
+      end
+    end
+
+    def collect_dsse_bundle(leaf_certificate, tlog_entries, timestamp_verification_data, envelope)
+      collect_base_bundle(leaf_certificate, tlog_entries, timestamp_verification_data).tap do |bundle|
+        bundle.dsse_envelope = envelope
+      end
+    end
+
+    def collect_base_bundle(leaf_certificate, tlog_entries, timestamp_verification_data)
       bundle = Bundle::V1::Bundle.new
       bundle.media_type = BundleType::BUNDLE_0_3.media_type
       bundle.verification_material = Bundle::V1::VerificationMaterial.new
@@ -274,11 +481,15 @@ module Sigstore
       bundle.verification_material.certificate.raw_bytes = leaf_certificate.to_der
       bundle.verification_material.tlog_entries = tlog_entries
       bundle.verification_material.timestamp_verification_data = timestamp_verification_data
-      bundle.message_signature = Sigstore::Common::V1::MessageSignature.new.tap do |ms|
-        ms.message_digest = hashed_input
-        ms.signature = signature
-      end
       bundle
     end
+
+    def build_dsse_envelope(payload, payload_type, signature)
+      DSSE::Envelope.new.tap do |envelope|
+        envelope.payload = payload
+        envelope.payloadType = payload_type
+        envelope.signatures = [DSSE::Signature.new.tap { |s| s.sig = signature }]
+      end
+    end
   end
 end

data/lib/sigstore/signing_config.rb

@@ -0,0 +1,181 @@
+# frozen_string_literal: true
+
+# Copyright 2024 The Sigstore Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require "openssl"
+require "protobug_sigstore_protos"
+
+require_relative "error"
+require_relative "tuf"
+
+module Sigstore
+  # Parses a SigningConfig (signingconfig.v0.2) document and selects the
+  # services (Fulcio CA, OIDC provider, Rekor transparency log, Timestamping
+  # Authority) a client should use to sign.
+  #
+  # The document is decoded through the protobuf-specs SigningConfig message
+  # (shipped since protobug_sigstore_protos 0.2.0). The service-selection
+  # algorithm mirrors sigstore-python's SigningConfig._get_valid_services: per
+  # kind, keep services whose major API version is supported and whose validity
+  # window covers now, collapse to one service per operator (highest supported
+  # version), then apply the ServiceConfiguration selector (ANY/EXACT/ALL).
+  class SigningConfig
+    MEDIA_TYPE = "application/vnd.dev.sigstore.signingconfig.v0.2+json"
+
+    REGISTRY = Protobug::Registry.new do |registry|
+      Sigstore::TrustRoot::V1.register_sigstore_trustroot_protos(registry)
+    end
+
+    Selector = Sigstore::TrustRoot::V1::ServiceSelector
+
+    REKOR_VERSIONS = [1, 2].freeze
+    TSA_VERSIONS = [1].freeze
+    FULCIO_VERSIONS = [1].freeze
+    OIDC_VERSIONS = [1].freeze
+
+    # The signing config published by the public-good (or staging) Sigstore
+    # instance via TUF, or nil if the repository does not publish one. Mirrors
+    # TrustedRoot.production/.staging.
+    def self.production(offline: false)
+      from_tuf(TUF::DEFAULT_TUF_URL, offline)
+    end
+
+    def self.staging(offline: false)
+      from_tuf(TUF::STAGING_TUF_URL, offline)
+    end
+
+    def self.from_tuf(url, offline)
+      updater = TUF::TrustUpdater.new(url, offline)
+      updater.refresh unless offline
+      from_tuf_updater(updater)
+    end
+
+    # Build from an already-refreshed TrustUpdater, so a caller that also needs
+    # the trusted root can share one updater (and one refresh).
+    def self.from_tuf_updater(updater)
+      path = updater.signing_config_path
+      path && from_file(path)
+    end
+
+    def self.from_file(path)
+      from_json(Gem.read_binary(path))
+    end
+
+    def self.from_json(contents)
+      new(Sigstore::TrustRoot::V1::SigningConfig.decode_json(contents, registry: REGISTRY))
+    rescue Protobug::Error => e
+      raise Error::InvalidSigningConfig, "invalid signing config: #{e.message}"
+    end
+
+    def initialize(config)
+      unless config.media_type == MEDIA_TYPE
+        raise Error::InvalidSigningConfig, "unsupported signing config format: #{config.media_type.inspect}"
+      end
+
+      @fulcios = select_services(config.ca_urls, FULCIO_VERSIONS, nil)
+      raise Error::InvalidSigningConfig, "No valid Fulcio CA found in signing config" if @fulcios.empty?
+
+      @oidcs = select_services(config.oidc_urls, OIDC_VERSIONS, nil)
+
+      @tlogs = select_services(config.rekor_tlog_urls, REKOR_VERSIONS, config.rekor_tlog_config,
+                               prefer_version: preferred_rekor_major_version)
+      raise Error::InvalidSigningConfig, "No valid Rekor transparency log found in signing config" if @tlogs.empty?
+
+      @tsas = select_services(config.tsa_urls, TSA_VERSIONS, config.tsa_config)
+    end
+
+    # The Rekor transparency log to submit the signing metadata to.
+    def tlog
+      @tlogs.first
+    end
+
+    def fulcio
+      @fulcios.first
+    end
+
+    def oidc_url
+      @oidcs.first&.url
+    end
+
+    # The Timestamping Authority URLs to request RFC 3161 timestamps from.
+    def tsa_urls
+      @tsas.map(&:url)
+    end
+
+    private
+
+    # On OpenSSL builds with a broken X509::Store#time (ruby/openssl#770) an RFC 3161
+    # timestamp cannot be verified, and Rekor v2 entries carry no integrated time, so a
+    # v2 bundle could never be verified there (even the signer's own self-verification
+    # would fail). Prefer a Rekor v1 log in that case, when the signing config offers one,
+    # so signing still produces a verifiable bundle.
+    def preferred_rekor_major_version
+      return nil unless OpenSSL::X509::Store.new.instance_variable_defined?(:@time)
+
+      1
+    end
+
+    def select_services(services, supported_versions, config, prefer_version: nil)
+      by_operator = Hash.new { |h, k| h[k] = [] }
+      services.each do |service|
+        next unless supported_versions.include?(service.major_api_version)
+        next unless timerange_valid?(service.valid_for)
+
+        by_operator[service.operator] << service
+      end
+
+      # One service per operator. Normally prefer the highest supported version; when
+      # +prefer_version+ is supplied and an operator offers it, pick that version instead.
+      result = by_operator.values.map do |op_services|
+        (prefer_version && op_services.find { |s| s.major_api_version == prefer_version }) ||
+          op_services.max_by(&:major_api_version)
+      end
+
+      # An absent ServiceConfiguration (or the ALL selector) imposes no count
+      # constraint, so every per-operator service is returned.
+      return result if config.nil? || config.selector == Selector::ALL
+
+      if config.selector == Selector::EXACT
+        count = config.count
+        unless count.is_a?(Integer) && count.positive?
+          raise Error::InvalidSigningConfig,
+                "EXACT selector requires a positive integer count, got #{count.inspect}"
+        end
+
+        # EXACT means at least `count` services must remain after filtering and
+        # per-operator collapsing; select the first `count` of them. Fewer than
+        # `count` is a misconfiguration; more is acceptable (mirrors
+        # sigstore-python's SigningConfig._get_valid_services).
+        if result.size < count
+          raise Error::InvalidSigningConfig, "Expected #{count} services in signing config, found #{result.size}"
+        end
+
+        return result.first(count)
+      end
+
+      result.first(1)
+    end
+
+    def timerange_valid?(period)
+      return true unless period
+
+      now = Time.now.utc
+      return false if period.start && now < period.start.to_time
+      return false if period.end && now > period.end.to_time
+
+      true
+    end
+  end
+end

data/lib/sigstore/trusted_root.rb

@@ -36,8 +36,13 @@ module Sigstore
     end
 
     def self.from_tuf(url, offline)
-      path = TUF::TrustUpdater.new(url, offline).tap { _1.refresh unless offline }.trusted_root_path
-      from_file(path)
+      from_tuf_updater(TUF::TrustUpdater.new(url, offline).tap { _1.refresh unless offline })
+    end
+
+    # Build from an already-refreshed TrustUpdater, so a caller that also needs
+    # the signing config can share one updater (and one refresh).
+    def self.from_tuf_updater(updater)
+      from_file(updater.trusted_root_path)
     end
 
     def self.from_file(path)
@@ -46,8 +51,11 @@ module Sigstore
     end
 
     def rekor_keys
+      # A trusted root may list more than one transparency log (e.g. a Rekor v1
+      # instance alongside a Rekor v2 tiled log). The keyring selects the right
+      # key per entry by log id, so return all of them.
       keys = tlog_keys(tlogs).to_a
-      raise Error::InvalidBundle, "Did not find one Rekor key" if keys.size != 1
+      raise Error::InvalidBundle, "Did not find any Rekor keys" if keys.empty?
 
       keys
     end
@@ -87,7 +95,15 @@ module Sigstore
 
       tlogs.each do |transparency_log_instance|
         key = transparency_log_instance.public_key
-        parsed_key = Internal::Key.from_key_details(key.key_details, key.raw_bytes)
+        # Verification keyring: include keys whose validity window has started, allowing
+        # already-expired keys so historical entries still verify, but skipping keys that
+        # are not yet valid. This mirrors the signing-path window check in #tlog_for_signing
+        # and sigstore-python's verify-purpose keyring (allow_expired: true).
+        next unless timerange_valid?(key.valid_for, allow_expired: true)
+
+        declared_log_id = transparency_log_instance.log_id&.key_id
+        key_id = declared_log_id.unpack1("H*") if declared_log_id && !declared_log_id.empty?
+        parsed_key = Internal::Key.from_key_details(key.key_details, key.raw_bytes, key_id:)
         yield parsed_key if parsed_key
       end
     end

data/lib/sigstore/tuf.rb

@@ -120,6 +120,19 @@ module Sigstore
         path
       end
 
+      # Path to the TUF-distributed v0.2 signing config, or nil if the repository
+      # does not publish one (older repositories, or offline mode where it is not
+      # vendored). Signing always requires network access, so there is no cached
+      # offline fallback as there is for the trusted root.
+      def signing_config_path
+        return unless @updater
+
+        info = @updater.get_targetinfo("signing_config.v0.2.json")
+        return unless info
+
+        @updater.find_cached_target(info) || @updater.download_target(info)
+      end
+
       def refresh
         raise ArgumentError, "Offline mode: cannot refresh" if @offline || !@updater