cosign

Documentation

Index

• Constants
• func CertToPem(c *x509.Certificate) []byte
• func Descriptors(ref name.Reference) ([]v1.Descriptor, error)
• func DestinationRef(ref name.Reference, img *remote.Descriptor) (name.Reference, error)
• func DockerMediaTypes() bool
• func Experimental() bool
• func FindTlogEntry(rekorClient *client.Rekor, b64Sig string, payload, pubKey []byte) (uuid string, index int64, err error)
• func GeneratePrivateKey() (*ecdsa.PrivateKey, error)
• func KeyToPem(pub crypto.PublicKey) ([]byte, error)
• func LoadCerts(pemStr string) ([]*x509.Certificate, error)
• func LoadECDSAPrivateKey(key []byte, pass []byte) (signature.ECDSASignerVerifier, error)
• func Munge(desc v1.Descriptor) string
• func PemToECDSAKey(raw []byte) (*ecdsa.PublicKey, error)
• func PublicKeyPem(ctx context.Context, key signature.PublicKeyProvider) ([]byte, error)
• func SignatureImage(dstTag name.Reference, opts ...remote.Option) (v1.Image, error)
• func TlogServer() string
• func TrustedCert(cert *x509.Certificate, roots *x509.CertPool) error
• func Upload(ctx context.Context, signature, payload []byte, dst name.Reference, ...) (uploadedSig []byte, err error)
• func UploadTLog(signature, payload []byte, pemBytes []byte) (*models.LogEntryAnon, error)
• func VerifyTLogEntry(rekorClient *client.Rekor, uuid string) (*models.LogEntryAnon, error)
• type Bundle
• type CheckOpts
• type Keys
  • func GenerateKeyPair(pf PassFunc) (*Keys, error)
• type PassFunc
• type PublicKey
  • func LoadPublicKey(ctx context.Context, keyRef string) (pub PublicKey, err error)
• type SignedPayload
  • func FetchSignatures(ctx context.Context, ref name.Reference) ([]SignedPayload, *v1.Descriptor, error)
  • func Verify(ctx context.Context, ref name.Reference, co *CheckOpts) ([]SignedPayload, error)
  • func (sp *SignedPayload) TrustedCert(roots *x509.CertPool) error
  • func (sp *SignedPayload) VerifyBundle() (bool, error)
  • func (sp *SignedPayload) VerifyClaims(d *v1.Descriptor, ss *payload.SimpleContainerImage) error
  • func (sp *SignedPayload) VerifyKey(ctx context.Context, pubKey PublicKey) error
  • func (sp *SignedPayload) VerifyTlog(rc *client.Rekor, publicKeyPem []byte) (uuid string, index int64, err error)
• type UploadOpts

Constants

const (
	PemType = "ENCRYPTED COSIGN PRIVATE KEY"

	BundleKey = "dev.sigstore.cosign/bundle"
)

const (
	ExperimentalEnv = "COSIGN_EXPERIMENTAL"

	DockerMediaTypesEnv = "COSIGN_DOCKER_MEDIA_TYPES"
	ServerEnv           = "REKOR_SERVER"
)

const SimpleSigningMediaType = "application/vnd.dev.cosign.simplesigning.v1+json"

Functions

func CertToPem

func CertToPem(c *x509.Certificate) []byte

func Descriptors

func Descriptors(ref name.Reference) ([]v1.Descriptor, error)

func DestinationRef

func DestinationRef(ref name.Reference, img *remote.Descriptor) (name.Reference, error)

func DockerMediaTypes

func DockerMediaTypes() bool

func Experimental

func Experimental() bool

func FindTlogEntry

func FindTlogEntry(rekorClient *client.Rekor, b64Sig string, payload, pubKey []byte) (uuid string, index int64, err error)

func GeneratePrivateKey

func GeneratePrivateKey() (*ecdsa.PrivateKey, error)

func KeyToPem

func KeyToPem(pub crypto.PublicKey) ([]byte, error)

func LoadCerts

func LoadCerts(pemStr string) ([]*x509.Certificate, error)

func LoadECDSAPrivateKey

func LoadECDSAPrivateKey(key []byte, pass []byte) (signature.ECDSASignerVerifier, error)

func Munge

func Munge(desc v1.Descriptor) string

func PemToECDSAKey

func PemToECDSAKey(raw []byte) (*ecdsa.PublicKey, error)

func PublicKeyPem

func PublicKeyPem(ctx context.Context, key signature.PublicKeyProvider) ([]byte, error)

func SignatureImage

func SignatureImage(dstTag name.Reference, opts ...remote.Option) (v1.Image, error)

SignatureImage returns the existing destination image, or a new, empty one.

func TlogServer

func TlogServer() string

tlogServer returns the name of the tlog server, can be overwritten via env var

func TrustedCert

func TrustedCert(cert *x509.Certificate, roots *x509.CertPool) error

func Upload

func Upload(ctx context.Context, signature, payload []byte, dst name.Reference, opts UploadOpts) (uploadedSig []byte, err error)

func UploadTLog

func UploadTLog(signature, payload []byte, pemBytes []byte) (*models.LogEntryAnon, error)

Upload will upload the signature, public key and payload to the tlog

func VerifyTLogEntry

func VerifyTLogEntry(rekorClient *client.Rekor, uuid string) (*models.LogEntryAnon, error)

Types

type Bundle

type Bundle struct {
	SignedEntryTimestamp strfmt.Base64
	Body                 interface{}
	IntegratedTime       int64
	LogIndex             *int64
}

type CheckOpts

type CheckOpts struct {
	Annotations  map[string]interface{}
	Claims       bool
	VerifyBundle bool
	Tlog         bool
	PubKey       PublicKey
	Roots        *x509.CertPool
}

There are only payloads. Some have certs, some don't.

type Keys

type Keys struct {
	PrivateBytes []byte
	PublicBytes  []byte
}

func GenerateKeyPair

func GenerateKeyPair(pf PassFunc) (*Keys, error)

type PassFunc

type PassFunc func(bool) ([]byte, error)

type PublicKey

type PublicKey interface {
	signature.Verifier
	signature.PublicKeyProvider
}

func LoadPublicKey

func LoadPublicKey(ctx context.Context, keyRef string) (pub PublicKey, err error)

type SignedPayload

type SignedPayload struct {
	Base64Signature string
	Payload         []byte
	Cert            *x509.Certificate
	Chain           []*x509.Certificate
	Bundle          *Bundle
}

func FetchSignatures

func FetchSignatures(ctx context.Context, ref name.Reference) ([]SignedPayload, *v1.Descriptor, error)

func Verify

func Verify(ctx context.Context, ref name.Reference, co *CheckOpts) ([]SignedPayload, error)

Verify does all the main cosign checks in a loop, returning validated payloads. If there were no payloads, we return an error.

func (*SignedPayload) TrustedCert

func (sp *SignedPayload) TrustedCert(roots *x509.CertPool) error

func (*SignedPayload) VerifyBundle

func (sp *SignedPayload) VerifyBundle() (bool, error)

func (*SignedPayload) VerifyClaims

func (sp *SignedPayload) VerifyClaims(d *v1.Descriptor, ss *payload.SimpleContainerImage) error

func (*SignedPayload) VerifyKey

func (sp *SignedPayload) VerifyKey(ctx context.Context, pubKey PublicKey) error

func (*SignedPayload) VerifyTlog

func (sp *SignedPayload) VerifyTlog(rc *client.Rekor, publicKeyPem []byte) (uuid string, index int64, err error)

type UploadOpts

type UploadOpts struct {
	Cert                  string
	Chain                 string
	DupeDetector          signature.Verifier
	Bundle                *Bundle
	AdditionalAnnotations map[string]string
	RemoteOpts            []remote.Option
}