cosign

Documentation

Index

• Constants
• Variables
• func DecodePEM(raw []byte, signatureAlgorithm crypto.Hash) (signature.Verifier, error)
• func EnsureReferences(ctx context.Context, c client.Reader, img string, namespace string, ...) error
• func FindSignature(imageDigest name.Digest, opts ...remote.Option) (name.Tag, ggcrv1.Hash, error)
• func FindSignatureImage(imageRef name.Reference, opts ...remote.Option) (name.Tag, ggcrv1.Image, error)
• func GetDefaultSignatureAnnotations(imageName string) map[string]interface{}
• func GetSignatureCacheRepository(ctx context.Context, c client.Reader, namespace string) (name.Repository, error)
• func ParseSSHPublicKey(keystr string) (crypto.PublicKey, error)
• func PemEncodeCryptoPublicKey(pubKey crypto.PublicKey) ([]byte, string, error)
• func PemEncodeSSHPublicKey(key ssh.PublicKey) ([]byte, error)
• func SimpleDigest(ref name.Reference, opts ...remote.Option) (string, error)
• func UnmarshalPEMToPublicKey(pemBytes []byte) (crypto.PublicKey, error)
• func VerifiersFromPublicKeyRef(ctx context.Context, keyRef string, algorithm string) (verifiers []signature.Verifier, err error)
• func VerifySignature(ctx context.Context, opts VerifyOpts) error
• type AcornPublicKey
• type ErrNoMatchingSignatures
  • func (e *ErrNoMatchingSignatures) Error() string
  • func (e *ErrNoMatchingSignatures) Unwrap() error
• type ErrNoSignaturesFound
  • func (e *ErrNoSignaturesFound) Error() string
  • func (e *ErrNoSignaturesFound) Unwrap() error
• type ErrNoSupportedKeys
  • func (e ErrNoSupportedKeys) Error() string
• type GitHubPublicKey
• type Keys
• type KeysBytes
  • func ImportKeyPair(keyRef string, pass []byte) (*KeysBytes, error)
  • func (k *KeysBytes) Password() []byte
• type VerificationFailure
  • func NewVerificationFailure(err error) *VerificationFailure
  • func (e *VerificationFailure) Error() string
  • func (e *VerificationFailure) Unwrap() error
• type VerifyOpts
  • func (o *VerifyOpts) WithRemoteOpts(ctx context.Context, c client.Reader, namespace string, ...) error

Constants

const (
	SignatureAnnotationSignedName = "acorn.io/signed-name" // If an image was signed by `acorn image sign foo/bar:v1`, this annotation should be set to `foo/bar:v1` (the payload usually only includes the image digest)
)

Variables

var (
	PublicKeyPattern  = regexp.MustCompile(`^-----BEGIN (RSA |ED25519 |ECDSA )?PUBLIC KEY-----\n(.*\n)+-----END (RSA |ED25519 |ECDSA )?PUBLIC KEY-----\s*$`)
	PrivateKeyPattern = regexp.MustCompile(`^-----BEGIN (ENCRYPTED )?(RSA |ED25519 |ECDSA )?PRIVATE KEY-----\n(.*\n)+-----END (ENCRYPTED )?(RSA |ED25519 |ECDSA )?PRIVATE KEY-----\s*$`)
)

var ErrAnnotationsUnmatched = cosign.NewVerificationError("annotations unmatched")

Functions

func DecodePEM

func DecodePEM(raw []byte, signatureAlgorithm crypto.Hash) (signature.Verifier, error)

func EnsureReferences

func EnsureReferences(ctx context.Context, c client.Reader, img string, namespace string, opts *VerifyOpts) error

EnsureReferences will enrich the VerifyOpts with the image digest and signature reference. It's outsourced here, so we can ensure that it's used as few times as possible to reduce the number of potential GET requests to the registry which would count against potential rate limits.

func FindSignature

func FindSignature(imageDigest name.Digest, opts ...remote.Option) (name.Tag, ggcrv1.Hash, error)

func FindSignatureImage

func FindSignatureImage(imageRef name.Reference, opts ...remote.Option) (name.Tag, ggcrv1.Image, error)

func GetDefaultSignatureAnnotations

func GetDefaultSignatureAnnotations(imageName string) map[string]interface{}

func GetSignatureCacheRepository

func GetSignatureCacheRepository(ctx context.Context, c client.Reader, namespace string) (name.Repository, error)

func ParseSSHPublicKey

func ParseSSHPublicKey(keystr string) (crypto.PublicKey, error)

func PemEncodeCryptoPublicKey

func PemEncodeCryptoPublicKey(pubKey crypto.PublicKey) ([]byte, string, error)

func PemEncodeSSHPublicKey

func PemEncodeSSHPublicKey(key ssh.PublicKey) ([]byte, error)

func SimpleDigest

func SimpleDigest(ref name.Reference, opts ...remote.Option) (string, error)

SimpleDigest is an adaption of crane.Digest

• it returns the sha256 hash of the remote image at ref.
• removed: it does not support platform specific images (we don't need that here)
• added: it returns an error if the image is not found on first try with HEAD (to lower the number of GET requests against potentially rate limited registries)

func UnmarshalPEMToPublicKey

func UnmarshalPEMToPublicKey(pemBytes []byte) (crypto.PublicKey, error)

UnmarshalPEMToPublicKey converts a PEM-encoded byte slice into a crypto.PublicKey

func VerifiersFromPublicKeyRef

func VerifiersFromPublicKeyRef(ctx context.Context, keyRef string, algorithm string) (verifiers []signature.Verifier, err error)

func VerifySignature

func VerifySignature(ctx context.Context, opts VerifyOpts) error

VerifySignature checks if the image is signed with the given key and if the annotations match the given rules This does a lot of image and image manifest juggling to fetch artifacts, digests, etc. from the registry, so we have to be careful to not do too many GET requests that count against registry rate limits (e.g. for Docker Hub). Crane uses HEAD (with GET as a fallback) wherever it can, so it's a good choice here e.g. for fetching digests.

Types

type AcornPublicKey

type AcornPublicKey struct {
	ID          string `json:"id,omitempty"`
	Key         string `json:"key,omitempty"`
	Fingerprint string `json:"fingerprint,omitempty"`
}

type ErrNoMatchingSignatures

type ErrNoMatchingSignatures struct {
	Err error
}

func (*ErrNoMatchingSignatures) Error

func (e *ErrNoMatchingSignatures) Error() string

func (*ErrNoMatchingSignatures) Unwrap

func (e *ErrNoMatchingSignatures) Unwrap() error

type ErrNoSignaturesFound

type ErrNoSignaturesFound struct {
	Err error
}

func (*ErrNoSignaturesFound) Error

func (e *ErrNoSignaturesFound) Error() string

func (*ErrNoSignaturesFound) Unwrap

func (e *ErrNoSignaturesFound) Unwrap() error

type ErrNoSupportedKeys

type ErrNoSupportedKeys struct {
	Username string
}

func (ErrNoSupportedKeys) Error

func (e ErrNoSupportedKeys) Error() string

type GitHubPublicKey

type GitHubPublicKey struct {
	ID  int    `json:"id,omitempty"`
	Key string `json:"key,omitempty"`
}

type Keys

type Keys struct {
	// contains filtered or unexported fields
}

type KeysBytes

type KeysBytes struct {
	PrivateBytes []byte
	PublicBytes  []byte
	// contains filtered or unexported fields
}

func ImportKeyPair

func ImportKeyPair(keyRef string, pass []byte) (*KeysBytes, error)

func (*KeysBytes) Password

func (k *KeysBytes) Password() []byte

type VerificationFailure

type VerificationFailure struct {
	Err error
}

func NewVerificationFailure

func NewVerificationFailure(err error) *VerificationFailure

func (*VerificationFailure) Error

func (e *VerificationFailure) Error() string

func (*VerificationFailure) Unwrap

func (e *VerificationFailure) Unwrap() error

type VerifyOpts

type VerifyOpts struct {
	ImageRef           name.Digest
	SignatureRef       name.Reference
	Namespace          string
	AnnotationRules    labels.Selector
	Key                string
	SignatureAlgorithm string
	RemoteOpts         []remote.Option
	NoCache            bool
	Verifiers          []signature.Verifier
}

func (*VerifyOpts) WithRemoteOpts

func (o *VerifyOpts) WithRemoteOpts(ctx context.Context, c client.Reader, namespace string, remoteOpts ...remote.Option) error