cosign

Documentation

Index

• func ComputeLeafHash(e *models.LogEntryAnon) ([]byte, error)
• func FindTLogEntriesByPayload(ctx context.Context, rekorClient *client.Rekor, payload []byte) (uuids []string, err error)
• func GetRekorServerURL() string
• func GetTlogEntry(ctx context.Context, rekorClient *rekorgenclient.Rekor, uuid string) (*models.LogEntryAnon, error)
• func SignBlob(blobPath string, keyPath, certPath *string, rekorURL string, ...) (map[string][]byte, error)
• func SignImage(resBundleRef string, keyPath, certPath *string, rekorURL string, ...) error
• func VerifyBlob(msgBytes, sigBytes, certBytes, bundleBytes []byte, pubkeyPath *string, ...) (bool, string, *int64, error)
• func VerifyImage(resBundleRef, pubkeyPath, certRef, certChain, rekorURL, oidcIssuer string, ...) (bool, string, *int64, error)

Functions

func ComputeLeafHash

func ComputeLeafHash(e *models.LogEntryAnon) ([]byte, error)

func FindTLogEntriesByPayload

func FindTLogEntriesByPayload(ctx context.Context, rekorClient *client.Rekor, payload []byte) (uuids []string, err error)

FindTLogEntriesByPayload is removed in cosign v2.x, so we implement it here

func GetRekorServerURL

func GetRekorServerURL() string

func GetTlogEntry

func GetTlogEntry(ctx context.Context, rekorClient *rekorgenclient.Rekor, uuid string) (*models.LogEntryAnon, error)

cosign has a bug in GetTlogEntry() function as of v1.12.1, so use this instead here

func SignBlob

func SignBlob(blobPath string, keyPath, certPath *string, rekorURL string, tlogUpload, force bool, pf cosign.PassFunc) (map[string][]byte, error)

func SignImage

func SignImage(resBundleRef string, keyPath, certPath *string, rekorURL string, tlogUpload, force bool, pf cosign.PassFunc, imageAnnotations map[string]interface{}, allowInsecure bool) error

func VerifyBlob

func VerifyBlob(msgBytes, sigBytes, certBytes, bundleBytes []byte, pubkeyPath *string, certRef, certChain, rekorURL, oidcIssuer string, rootCerts *x509.CertPool) (bool, string, *int64, error)

func VerifyImage

func VerifyImage(resBundleRef, pubkeyPath, certRef, certChain, rekorURL, oidcIssuer string, rootCerts *x509.CertPool, allowInsecure bool) (bool, string, *int64, error)