cosign

Documentation

Index

• Constants
• func CertToPem(c *x509.Certificate) []byte
• func Descriptors(ref name.Reference) ([]v1.Descriptor, error)
• func DestinationTag(ref name.Reference, img *remote.Descriptor) (name.Tag, error)
• func Experimental() bool
• func FindTlogEntry(rekorClient *client.Rekor, b64Sig string, payload, pubKey []byte) (string, error)
• func GeneratePrivateKey() (*ecdsa.PrivateKey, error)
• func ImageSignature(ctx context.Context, signer Signer, img v1.Descriptor, ...) (payload, signature []byte, err error)
• func KeyToPem(pub *ecdsa.PublicKey) []byte
• func LoadCerts(pemStr string) ([]*x509.Certificate, error)
• func LoadPrivateKey(key []byte, pass []byte) (*ecdsa.PrivateKey, error)
• func LoadPublicKey(keyRef string) (*ecdsa.PublicKey, error)
• func Munge(desc v1.Descriptor) string
• func PayloadSignature(ctx context.Context, signer Signer, payload []byte) (signature []byte, err error)
• func TlogServer() string
• func TrustedCert(cert *x509.Certificate, roots *x509.CertPool) error
• func Upload(signature, payload []byte, dstTag name.Reference, cert, chain string) error
• func UploadTLog(signature, payload []byte, pemBytes []byte) (string, error)
• func VerifySignature(pubkey *ecdsa.PublicKey, base64sig string, payload []byte) error
• type CheckOpts
• type Critical
• type ECDSASigner
  • func (s *ECDSASigner) Sign(_ context.Context, payload []byte) (signature []byte, err error)
• type ECDSAVerifier
  • func (v *ECDSAVerifier) Verify(_ context.Context, payload, signature []byte) error
• type Identity
• type Image
• type ImagePayload
  • func (p *ImagePayload) MarshalJSON() ([]byte, error)
• type Keys
  • func GenerateKeyPair(pf PassFunc) (*Keys, error)
• type PassFunc
• type SignedPayload
  • func FetchSignatures(ctx context.Context, ref name.Reference) ([]SignedPayload, *v1.Descriptor, error)
  • func Verify(ctx context.Context, ref name.Reference, co CheckOpts) ([]SignedPayload, error)
  • func (sp *SignedPayload) TrustedCert(roots *x509.CertPool) error
  • func (sp *SignedPayload) VerifyClaims(d *v1.Descriptor, ss *SimpleSigning) error
  • func (sp *SignedPayload) VerifyKey(pubKey *ecdsa.PublicKey) error
  • func (sp *SignedPayload) VerifyTlog(rc *client.Rekor, publicKeyPem []byte) (string, error)
• type Signer
• type SimpleSigning
• type Verifier

Constants

const (
	ExperimentalEnv = "COSIGN_EXPERIMENTAL"

	ServerEnv = "REKOR_SERVER"
)

Functions

func CertToPem

func CertToPem(c *x509.Certificate) []byte

func Descriptors

func Descriptors(ref name.Reference) ([]v1.Descriptor, error)

func DestinationTag

func DestinationTag(ref name.Reference, img *remote.Descriptor) (name.Tag, error)

func Experimental

func Experimental() bool

func FindTlogEntry

func FindTlogEntry(rekorClient *client.Rekor, b64Sig string, payload, pubKey []byte) (string, error)

func GeneratePrivateKey

func GeneratePrivateKey() (*ecdsa.PrivateKey, error)

func ImageSignature

func ImageSignature(ctx context.Context, signer Signer, img v1.Descriptor, payloadAnnotations map[string]string) (payload, signature []byte, err error)

func KeyToPem

func KeyToPem(pub *ecdsa.PublicKey) []byte

func LoadCerts

func LoadCerts(pemStr string) ([]*x509.Certificate, error)

func LoadPrivateKey

func LoadPrivateKey(key []byte, pass []byte) (*ecdsa.PrivateKey, error)

func LoadPublicKey

func LoadPublicKey(keyRef string) (*ecdsa.PublicKey, error)

func Munge

func Munge(desc v1.Descriptor) string

func PayloadSignature

func PayloadSignature(ctx context.Context, signer Signer, payload []byte) (signature []byte, err error)

func TlogServer

func TlogServer() string

tlogServer returns the name of the tlog server, can be overwritten via env var

func TrustedCert

func TrustedCert(cert *x509.Certificate, roots *x509.CertPool) error

func Upload

func Upload(signature, payload []byte, dstTag name.Reference, cert, chain string) error

func UploadTLog

func UploadTLog(signature, payload []byte, pemBytes []byte) (string, error)

Upload will upload the signature, public key and payload to the tlog

func VerifySignature

func VerifySignature(pubkey *ecdsa.PublicKey, base64sig string, payload []byte) error

Types

type CheckOpts

type CheckOpts struct {
	Annotations map[string]string
	Claims      bool
	Tlog        bool
	PubKey      *ecdsa.PublicKey
	Roots       *x509.CertPool
}

There are only payloads. Some have certs, some don't.

type Critical

type Critical struct {
	Identity Identity
	Image    Image
	Type     string
}

type ECDSASigner

type ECDSASigner struct {
	Key *ecdsa.PrivateKey
}

func (*ECDSASigner) Sign

func (s *ECDSASigner) Sign(_ context.Context, payload []byte) (signature []byte, err error)

Sign returns an ASN.1-encoded signature of the SHA-256 hash of the given payload.

type ECDSAVerifier

type ECDSAVerifier struct {
	PubKey *ecdsa.PublicKey
}

func (*ECDSAVerifier) Verify

func (v *ECDSAVerifier) Verify(_ context.Context, payload, signature []byte) error

type Identity

type Identity struct {
	DockerReference string `json:"docker-reference"`
}

type Image

type Image struct {
	DockerManifestDigest string `json:"Docker-manifest-digest"`
}

type ImagePayload

type ImagePayload struct {
	Img         v1.Descriptor
	Annotations map[string]string
}

func (*ImagePayload) MarshalJSON

func (p *ImagePayload) MarshalJSON() ([]byte, error)

type Keys

type Keys struct {
	PrivateBytes []byte
	PublicBytes  []byte
}

func GenerateKeyPair

func GenerateKeyPair(pf PassFunc) (*Keys, error)

type PassFunc

type PassFunc func(bool) ([]byte, error)

type SignedPayload

type SignedPayload struct {
	Base64Signature string
	Payload         []byte
	Cert            *x509.Certificate
	Chain           []*x509.Certificate
}

func FetchSignatures

func FetchSignatures(ctx context.Context, ref name.Reference) ([]SignedPayload, *v1.Descriptor, error)

func Verify

func Verify(ctx context.Context, ref name.Reference, co CheckOpts) ([]SignedPayload, error)

Verify does all the main cosign checks in a loop, returning validated payloads. If there were no payloads, we return an error.

func (*SignedPayload) TrustedCert

func (sp *SignedPayload) TrustedCert(roots *x509.CertPool) error

func (*SignedPayload) VerifyClaims

func (sp *SignedPayload) VerifyClaims(d *v1.Descriptor, ss *SimpleSigning) error

func (*SignedPayload) VerifyKey

func (sp *SignedPayload) VerifyKey(pubKey *ecdsa.PublicKey) error

func (*SignedPayload) VerifyTlog

func (sp *SignedPayload) VerifyTlog(rc *client.Rekor, publicKeyPem []byte) (string, error)

type Signer

type Signer interface {
	Sign(ctx context.Context, payload []byte) (signature []byte, err error)
}

type SimpleSigning

type SimpleSigning struct {
	Critical Critical
	Optional map[string]string
}

type Verifier

type Verifier interface {
	Verify(ctx context.Context, payload, signature []byte) error
}