pepr 0.38.3 → 0.39.1

package/src/sdk/cosign.ts

@@ -0,0 +1,327 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { https } from "follow-redirects";
+import { readFile, unlink } from "node:fs/promises";
+import { createWriteStream } from "node:fs";
+import * as crypto from "node:crypto";
+import { PublicKeyDetails, TrustedRoot } from "@sigstore/protobuf-specs";
+import { bundleFromJSON } from "@sigstore/bundle";
+import { toSignedEntity, toTrustMaterial, Verifier } from "@sigstore/verify";
+
+export enum MediaTypeDockerV2 {
+  Manifest = "application/vnd.docker.distribution.manifest.v2+json",
+}
+
+export enum MediaTypeOciV1 {
+  Manifest = "application/vnd.oci.image.manifest.v1+json",
+  Index = "application/vnd.oci.image.index.v1+json",
+}
+
+/* eslint-disable  @typescript-eslint/no-explicit-any */
+export async function head(
+  rawUrl: string,
+  mediaType: string,
+  optsParam: Record<string, any> = {},
+): Promise<any> {
+  const url = new URL(rawUrl);
+
+  return new Promise((resolve, reject) => {
+    const opts = {
+      protocol: url.protocol,
+      hostname: url.hostname,
+      port: url.port,
+      path: url.pathname,
+      method: "HEAD",
+      headers: { Accept: mediaType },
+      ...optsParam,
+    };
+
+    https
+      .request(opts, resp => {
+        const { statusCode } = resp;
+
+        let error;
+        if (!statusCode?.toString().startsWith("2") && !statusCode?.toString().startsWith("3")) {
+          reject(new Error(`err: status code: ${statusCode}: expected 2xx|3xx`));
+          error = true;
+        }
+
+        if (error) {
+          resp.resume();
+          return;
+        }
+
+        resp.setEncoding("utf8");
+
+        resp.on("data", () => {});
+
+        resp.on("end", () => {
+          resolve(resp.headers);
+        });
+      })
+      .on("error", e => reject(e))
+      .end();
+  });
+}
+
+/* eslint-disable  @typescript-eslint/no-explicit-any */
+export async function get(
+  rawUrl: string,
+  mediaType: string,
+  optsParam: Record<string, any> = {},
+): Promise<any> {
+  const url = new URL(rawUrl);
+
+  return new Promise((resolve, reject) => {
+    const opts = {
+      protocol: url.protocol,
+      hostname: url.hostname,
+      port: url.port,
+      path: url.pathname,
+      method: "GET",
+      headers: {
+        "User-Agent": "node",
+        Accept: mediaType,
+      },
+      ...optsParam,
+    };
+
+    https
+      .request(opts, resp => {
+        const { statusCode } = resp;
+
+        let error;
+
+        if (!statusCode?.toString().startsWith("2") && !statusCode?.toString().startsWith("3")) {
+          console.log(resp.headers);
+          reject(new Error(`err: status code: ${statusCode}: expected 2xx`));
+          error = true;
+        }
+
+        if (error) {
+          resp.resume();
+          return;
+        }
+
+        resp.setEncoding("utf8");
+
+        let raw = "";
+        resp.on("data", chunk => {
+          raw += chunk;
+        });
+        resp.on("end", () => {
+          try {
+            resolve({ head: resp.headers, body: raw });
+          } catch (e) {
+            reject(e);
+          }
+        });
+      })
+      .on("error", e => reject(e))
+      .end();
+  });
+}
+
+/* eslint-disable  @typescript-eslint/no-explicit-any */
+export async function download(
+  rawUrl: string,
+  localPath: string,
+  optsParam: Record<string, any> = {},
+): Promise<void> {
+  const url = new URL(rawUrl);
+
+  return new Promise((resolve, reject) => {
+    const opts = {
+      protocol: url.protocol,
+      hostname: url.hostname,
+      port: url.port,
+      path: url.pathname,
+      method: "GET",
+      headers: {
+        "User-Agent": "node",
+        Accept: "application/octet-stream",
+      },
+      ...optsParam,
+    };
+
+    https
+      .request(opts, resp => {
+        const { statusCode } = resp;
+
+        let error;
+
+        if (!statusCode?.toString().startsWith("2") && !statusCode?.toString().startsWith("3")) {
+          console.log(resp.headers);
+          reject(new Error(`err: status code: ${statusCode}: expected 2xx`));
+          error = true;
+        }
+
+        if (error) {
+          resp.resume();
+          return;
+        }
+
+        const ws = createWriteStream(localPath).on("finish", () => {
+          ws.close(() => resolve());
+        });
+
+        resp.pipe(ws);
+      })
+      .on("error", async err => {
+        await unlink(localPath);
+        reject(err);
+      })
+      .end();
+  });
+}
+
+//
+// TODO: should support using certs too
+//
+
+/**
+ * Returns all containers in a pod
+ * @param {string} iref image reference
+ * @param {array} pubkeys list of paths to node crypto code signing pubkeys
+ * @returns {boolean} whether the iref was signed by a key in the pubkeys
+ */
+export async function verifyImage(
+  iref: string,
+  pubkeys: string[],
+  tlsCrts?: string[],
+): Promise<boolean> {
+  const X: Record<string, any> = {};
+
+  // <host---> / <image----------------------->
+  //           / <name---------------> : <tag->
+  // docker.io / library / hello-world : latest
+  //
+  // <host> / <image------------------------------------->
+  //        / <name------------------------------> : <tag>
+  // ttl.sh / 5dad3c9b-7ccc-4115-be27-c9244e7c0e06 : 2000m
+
+  X.iref = {};
+  X.iref.raw = iref;
+  X.iref.host = iref.split("/")[0];
+  X.iref.image = iref.replace(`${X.iref.host}/`, "");
+  X.iref.tag = X.iref.image.split(":").at(-1);
+  X.iref.name = X.iref.image.replace(`:${X.iref.tag}`, "");
+
+  X.manifest = {
+    url: `https://${X.iref.host}/v2/${X.iref.name}/manifests/${X.iref.tag}`,
+  };
+
+  const supportsMediaType = async (url: string, mediaType: string) => {
+    return (await head(url, mediaType, { ca: tlsCrts }))["content-type"] === mediaType;
+  };
+
+  const canOciV1Manifest = async (manifestUrl: string) => {
+    return supportsMediaType(manifestUrl, MediaTypeOciV1.Manifest);
+  };
+
+  const canDockerV2Manifest = async (manifestUrl: string) => {
+    return supportsMediaType(manifestUrl, MediaTypeDockerV2.Manifest);
+  };
+
+  // prettier-ignore
+  const manifestResp =
+    await canOciV1Manifest(X.manifest.url) ? await get(X.manifest.url, MediaTypeOciV1.Manifest, {ca: tlsCrts}) :
+    await canDockerV2Manifest(X.manifest.url) ? await get(X.manifest.url, MediaTypeDockerV2.Manifest, {ca: tlsCrts}) :
+    (() => { throw "Can't pull image manifest with supported MediaType." })();
+  X.manifest.content = manifestResp.body;
+
+  X.manifest.digest = `sha256:${crypto
+    .createHash("sha256")
+    .update(X.manifest.content)
+    .digest("hex")
+    .toString()}`;
+
+  X.sig = {};
+  X.sig.tag = `${X.manifest.digest.replace(":", "-")}.sig`;
+  X.sig.triangulated = `${X.iref.host}/${X.iref.name}:${X.sig.tag}`;
+  X.sig.url = `https://${X.iref.host}/v2/${X.iref.name}/manifests/${X.sig.tag}`;
+
+  const sigManifestResp = await get(X.sig.url, MediaTypeOciV1.Manifest, { ca: tlsCrts });
+  X.sig.manifest = sigManifestResp.body;
+
+  const cosignSigLayer = JSON.parse(X.sig.manifest).layers.filter((f: any) =>
+    Object.hasOwn(f?.annotations, "dev.cosignproject.cosign/signature"),
+  )[0];
+
+  X.sig.blob = {};
+  X.sig.blob.digest = cosignSigLayer.digest;
+  X.sig.blob.signature = cosignSigLayer.annotations["dev.cosignproject.cosign/signature"];
+  X.sig.blob.url = `https://${X.iref.host}/v2/${X.iref.name}/blobs/${X.sig.blob.digest}`;
+
+  const sigBlobResp = await get(X.sig.blob.url, "application/octet-stream", { ca: tlsCrts });
+  X.sig.blob.content = sigBlobResp.body;
+
+  let verified = false;
+
+  for (const pubkey of pubkeys) {
+    // https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/__tests__/verifier.test.ts
+    const pubKeyRaw = await readFile(`${pubkey}`, { encoding: "utf8" });
+    const pubKey = crypto.createPublicKey({
+      key: pubKeyRaw,
+      format: "pem",
+      encoding: "utf-8",
+    });
+
+    const trustedRoot = {
+      tlogs: [],
+      ctlogs: [],
+      timestampAuthorities: [],
+      certificateAuthorities: [],
+    } as unknown as TrustedRoot;
+
+    const keys = {
+      hint: {
+        rawBytes: pubKey.export({ type: "spki", format: "der" }),
+        keyDetails: PublicKeyDetails.PKIX_ECDSA_P256_SHA_256,
+      },
+    };
+    const trustMaterial = toTrustMaterial(trustedRoot, keys);
+
+    const subject = new Verifier(trustMaterial, {
+      ctlogThreshold: 0,
+      tlogThreshold: 0,
+      tsaThreshold: 0,
+    });
+
+    const bundle = bundleFromJSON({
+      mediaType: "application/vnd.dev.sigstore.bundle+json;version=0.1",
+      verificationMaterial: {
+        publicKey: {
+          hint: "hint",
+        },
+        tlogEntries: [],
+        timestampVerificationData: {
+          rfc3161Timestamps: [],
+        },
+      },
+      messageSignature: {
+        messageDigest: {
+          algorithm: "SHA2_256",
+          digest: crypto.createHash("sha256").update(X.sig.blob.content).digest().toString(),
+        },
+        signature: X.sig.blob.signature,
+      },
+    });
+
+    const signedEntity = toSignedEntity(bundle, Buffer.from(X.sig.blob.content));
+
+    try {
+      subject.verify(signedEntity);
+      verified = true;
+      break;
+    } catch (e) {
+      if (e.message.includes("signature verification failed")) {
+        continue;
+      }
+      throw e;
+    }
+  }
+
+  return verified;
+}

package/src/sdk/heredoc.ts

@@ -0,0 +1,36 @@
+// Refs:
+// - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals#tagged_templates
+
+export function heredoc(strings: TemplateStringsArray, ...values: string[]) {
+  // shuffle strings & expression values back together
+  const zipped = strings
+    .reduce((acc: string[], cur, idx) => {
+      acc.push(cur, values[idx] || "");
+      return acc;
+    }, [])
+    .filter(x => x);
+
+  // rebuild as line-oriented
+  const asLines = zipped.join("").split(/[\r\n]+/);
+
+  // strip whitespace-only first & last lines
+  asLines[0].trim().length === 0 ? asLines.shift() : null;
+  asLines.slice(-1)[0].trim().length === 0 ? asLines.pop() : null;
+
+  // find smallest indent
+  const indent = asLines.reduce((acc, cur) => {
+    const firstAt = cur.search(/\S/);
+    return Math.min(firstAt !== -1 ? firstAt : Number.POSITIVE_INFINITY, acc);
+  }, Number.POSITIVE_INFINITY);
+
+  // de-indent all lines
+  const snipped = asLines.map(line => {
+    if (line.length < indent) {
+      return "";
+    }
+    return line.slice(indent);
+  });
+
+  // rejoin into multiline string
+  return snipped.join("\n");
+}

package/src/sdk/sdk.ts

@@ -3,7 +3,6 @@
 
 import { PeprValidateRequest } from "../lib/validate-request";
 import { PeprMutateRequest } from "../lib/mutate-request";
-import { a } from "../lib";
 import { V1OwnerReference } from "@kubernetes/client-node";
 import { GenericKind } from "kubernetes-fluent-client";
 import { K8s, kind } from "kubernetes-fluent-client";
@@ -16,7 +15,7 @@ import Log from "../lib/logger";
  * @returns the list of containers in the pod
  */
 export function containers(
-  request: PeprValidateRequest<a.Pod> | PeprMutateRequest<a.Pod>,
+  request: PeprValidateRequest<kind.Pod> | PeprMutateRequest<kind.Pod>,
   containerType?: "containers" | "initContainers" | "ephemeralContainers",
 ) {
   const containers = request.Raw.spec?.containers || [];

package/dist/lib/adjudicators.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adjudicators.d.ts","sourceRoot":"","sources":["../../src/lib/adjudicators.ts"],"names":[],"mappings":"AA+BA,eAAO,MAAM,iBAAiB,uBAAqD,CAAC;AACpF,eAAO,MAAM,aAAa,uBAAuD,CAAC;AAClF,eAAO,MAAM,eAAe,uBAAyD,CAAC;AACtF,eAAO,MAAM,YAAY,uBAAsD,CAAC;AAChF,eAAO,MAAM,WAAW,uBAA+C,CAAC;AAKxE,eAAO,MAAM,wBAAwB,uBAAmE,CAAC;AACzG,eAAO,MAAM,wBAAwB,uBAAuC,CAAC;AAE7E,eAAO,MAAM,WAAW,mBAAkD,CAAC;AAC3E,eAAO,MAAM,WAAW,uBAAqC,CAAC;AAC9D,eAAO,MAAM,WAAW,uBAA0B,CAAC;AAEnD,eAAO,MAAM,gBAAgB,mBAAuD,CAAC;AACrF,eAAO,MAAM,gBAAgB,uBAA0C,CAAC;AAExE,eAAO,MAAM,kBAAkB,mBAAyD,CAAC;AACzF,eAAO,MAAM,kBAAkB,uBAA4C,CAAC;AAE5E,eAAO,MAAM,aAAa,mBAAoD,CAAC;AAC/E,eAAO,MAAM,aAAa,uBAAuC,CAAC;AAKlE,eAAO,MAAM,wBAAwB,uBAAyE,CAAC;AAC/G,eAAO,MAAM,wBAAwB,2BAAuC,CAAC;AAE7E,eAAO,MAAM,WAAW,uBAAyD,CAAC;AAClF,eAAO,MAAM,WAAW,2BAAqC,CAAC;AAC9D,eAAO,MAAM,WAAW,2BAA0B,CAAC;AAEnD,eAAO,MAAM,gBAAgB,uBAA8D,CAAC;AAC5F,eAAO,MAAM,gBAAgB,2BAA0C,CAAC;AAExE,eAAO,MAAM,iBAAiB,uBAA+D,CAAC;AAC9F,eAAO,MAAM,iBAAiB,2BAA2C,CAAC;AAE1E,eAAO,MAAM,uBAAuB,uBAAoE,CAAC;AACzG,eAAO,MAAM,uBAAuB,2BAAiD,CAAC;AAEtF,eAAO,MAAM,kBAAkB,uBAAgE,CAAC;AAChG,eAAO,MAAM,kBAAkB,2BAA4C,CAAC;AAE5E,eAAO,MAAM,aAAa,uBAA2D,CAAC;AACtF,eAAO,MAAM,aAAa,2BAAuC,CAAC;AAElE,eAAO,MAAM,YAAY,uBAAiD,CAAC;AAC3E,eAAO,MAAM,aAAa,2BAA+C,CAAC;AAE1E,eAAO,MAAM,YAAY,uBAAuD,CAAC;AACjF,eAAO,MAAM,YAAY,2BAAsC,CAAC;AAEhE,eAAO,MAAM,cAAc,uBAAyD,CAAC;AACrF,eAAO,MAAM,cAAc,2BAAwC,CAAC;AAEpE,eAAO,MAAM,WAAW,uBAAsD,CAAC;AAC/E,eAAO,MAAM,WAAW,2BAAqC,CAAC;AAE9D,eAAO,MAAM,eAAe,qEAS1B,CAAC;AAEH,eAAO,MAAM,eAAe,uBAS1B,CAAC;AACH,eAAO,MAAM,mBAAmB,uBAAgE,CAAC;AAKjG,eAAO,MAAM,2BAA2B,yBAGtC,CAAC;AAEH,eAAO,MAAM,cAAc,6BAGzB,CAAC;AAEH,eAAO,MAAM,mBAAmB,6BAG9B,CAAC;AAEH,eAAO,MAAM,WAAW,6EAEvB,CAAC;AACF,eAAO,MAAM,gBAAgB,6EAA4C,CAAC;AAC1E,eAAO,MAAM,iBAAiB,2GAAiD,CAAC;AAEhF,eAAO,MAAM,mBAAmB,6BAG9B,CAAC;AAEH,eAAO,MAAM,wBAAwB,6BAQnC,CAAC;AAEH,eAAO,MAAM,aAAa,yCAyBzB,CAAC;AAEF,eAAO,MAAM,qBAAqB,6BAGhC,CAAC;AAEH,eAAO,MAAM,gBAAgB,6BAG3B,CAAC;AAEH,eAAO,MAAM,oBAAoB,6BAI/B,CAAC;AAEH,eAAO,MAAM,uBAAuB,+DAIlC,CAAC;AAEH,eAAO,MAAM,oBAAoB,6BAI/B,CAAC;AAEH,eAAO,MAAM,mCAAmC,uBAAqD,CAAC;AAEtG,eAAO,MAAM,qBAAqB,8DAIhC,CAAC;AAEH,eAAO,MAAM,eAAe,yCAG3B,CAAC;AAEF,eAAO,MAAM,eAAe,6BAG1B,CAAC;AAEH,eAAO,MAAM,iBAAiB,6BAG5B,CAAC;AAEH,eAAO,MAAM,cAAc,6BAGzB,CAAC"}

package/dist/lib/filter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"filter.d.ts","sourceRoot":"","sources":["../../src/lib/filter.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAa,MAAM,SAAS,CAAC;AAqC/D;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,gBAAgB,EACrB,oBAAoB,EAAE,MAAM,EAAE,EAC9B,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAC3B,MAAM,CA0FR"}