v1

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 29, 2025 License: Apache-2.0 Imports: 6 Imported by: 4

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var File_sigstore_trustroot_proto protoreflect.FileDescriptor

Functions

This section is empty.

Types

type CertificateAuthority 

type CertificateAuthority struct {

	// The root certificate MUST be self-signed, and so the subject and
	// issuer are the same.
	Subject *v1.DistinguishedName `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
	// The URI identifies the certificate authority.
	//
	// It is RECOMMENDED that the URI is the base URL for the certificate
	// authority, that can be provided to any SDK/client provided
	// by the certificate authority to interact with the certificate
	// authority.
	Uri string `protobuf:"bytes,2,opt,name=uri,proto3" json:"uri,omitempty"`
	// The certificate chain for this CA. The last certificate in the chain
	// MUST be the trust anchor. The trust anchor MAY be a self-signed root
	// CA certificate or MAY be an intermediate CA certificate.
	CertChain *v1.X509CertificateChain `protobuf:"bytes,3,opt,name=cert_chain,json=certChain,proto3" json:"cert_chain,omitempty"`
	// The time the *entire* chain was valid. This is at max the
	// longest interval when *all* certificates in the chain were valid,
	// but it MAY be shorter. Clients MUST check timestamps against *both*
	// the `valid_for` time range *and* the entire certificate chain.
	//
	// The TimeRange should be considered valid *inclusive* of the
	// endpoints.
	ValidFor *v1.TimeRange `protobuf:"bytes,4,opt,name=valid_for,json=validFor,proto3" json:"valid_for,omitempty"`
	// contains filtered or unexported fields
}

CertificateAuthority enlists the information required to identify which CA to use and perform signature verification.

func (*CertificateAuthority) Descriptor deprecated 

func (*CertificateAuthority) Descriptor() ([]byte, []int)

Deprecated: Use CertificateAuthority.ProtoReflect.Descriptor instead.

func (*CertificateAuthority) GetCertChain 

func (x *CertificateAuthority) GetCertChain() *v1.X509CertificateChain

func (*CertificateAuthority) GetSubject 

func (x *CertificateAuthority) GetSubject() *v1.DistinguishedName

func (*CertificateAuthority) GetUri 

func (x *CertificateAuthority) GetUri() string

func (*CertificateAuthority) GetValidFor 

func (x *CertificateAuthority) GetValidFor() *v1.TimeRange

func (*CertificateAuthority) ProtoMessage 

func (*CertificateAuthority) ProtoMessage()

func (*CertificateAuthority) ProtoReflect 

func (x *CertificateAuthority) ProtoReflect() protoreflect.Message

func (*CertificateAuthority) Reset 

func (x *CertificateAuthority) Reset()

func (*CertificateAuthority) String 

func (x *CertificateAuthority) String() string

type ClientTrustConfig added in v0.3.1 

type ClientTrustConfig struct {

	// MUST be application/vnd.dev.sigstore.clienttrustconfig.v0.1+json
	MediaType string `protobuf:"bytes,1,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
	// The root of trust, which MUST be present.
	TrustedRoot *TrustedRoot `protobuf:"bytes,2,opt,name=trusted_root,json=trustedRoot,proto3" json:"trusted_root,omitempty"`
	// Configuration for signing clients, which MUST be present.
	SigningConfig *SigningConfig `protobuf:"bytes,3,opt,name=signing_config,json=signingConfig,proto3" json:"signing_config,omitempty"`
	// contains filtered or unexported fields
}

ClientTrustConfig describes the complete state needed by a client to perform both signing and verification operations against a particular instance of Sigstore.

func (*ClientTrustConfig) Descriptor deprecated added in v0.3.1 

func (*ClientTrustConfig) Descriptor() ([]byte, []int)

Deprecated: Use ClientTrustConfig.ProtoReflect.Descriptor instead.

func (*ClientTrustConfig) GetMediaType added in v0.3.1 

func (x *ClientTrustConfig) GetMediaType() string

func (*ClientTrustConfig) GetSigningConfig added in v0.3.1 

func (x *ClientTrustConfig) GetSigningConfig() *SigningConfig

func (*ClientTrustConfig) GetTrustedRoot added in v0.3.1 

func (x *ClientTrustConfig) GetTrustedRoot() *TrustedRoot

func (*ClientTrustConfig) ProtoMessage added in v0.3.1 

func (*ClientTrustConfig) ProtoMessage()

func (*ClientTrustConfig) ProtoReflect added in v0.3.1 

func (x *ClientTrustConfig) ProtoReflect() protoreflect.Message

func (*ClientTrustConfig) Reset added in v0.3.1 

func (x *ClientTrustConfig) Reset()

func (*ClientTrustConfig) String added in v0.3.1 

func (x *ClientTrustConfig) String() string

type SigningConfig added in v0.3.1 

type SigningConfig struct {

	// MUST be application/vnd.dev.sigstore.signingconfig.v0.1+json
	MediaType string `protobuf:"bytes,5,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
	// A URL to a Fulcio-compatible CA, capable of receiving
	// Certificate Signing Requests (CSRs) and responding with
	// issued certificates.
	//
	// This URL **MUST** be the "base" URL for the CA, which clients
	// should construct an appropriate CSR endpoint on top of.
	// For example, if `ca_url` is `https://example.com/ca`, then
	// the client **MAY** construct the CSR endpoint as
	// `https://example.com/ca/api/v2/signingCert`.
	CaUrl string `protobuf:"bytes,1,opt,name=ca_url,json=caUrl,proto3" json:"ca_url,omitempty"`
	// A URL to an OpenID Connect identity provider.
	//
	// This URL **MUST** be the "base" URL for the OIDC IdP, which clients
	// should perform well-known OpenID Connect discovery against.
	OidcUrl string `protobuf:"bytes,2,opt,name=oidc_url,json=oidcUrl,proto3" json:"oidc_url,omitempty"`
	// One or more URLs to Rekor-compatible transparency log.
	//
	// Each URL **MUST** be the "base" URL for the transparency log,
	// which clients should construct appropriate API endpoints on top of.
	TlogUrls []string `protobuf:"bytes,3,rep,name=tlog_urls,json=tlogUrls,proto3" json:"tlog_urls,omitempty"`
	// One ore more URLs to RFC 3161 Time Stamping Authority (TSA).
	//
	// Each URL **MUST** be the **full** URL for the TSA, meaning that it
	// should be suitable for submitting Time Stamp Requests (TSRs) to
	// via HTTP, per RFC 3161.
	TsaUrls []string `protobuf:"bytes,4,rep,name=tsa_urls,json=tsaUrls,proto3" json:"tsa_urls,omitempty"`
	// contains filtered or unexported fields
}

SigningConfig represents the trusted entities/state needed by Sigstore signing. In particular, it primarily contains service URLs that a Sigstore signer may need to connect to for the online aspects of signing.

func (*SigningConfig) Descriptor deprecated added in v0.3.1 

func (*SigningConfig) Descriptor() ([]byte, []int)

Deprecated: Use SigningConfig.ProtoReflect.Descriptor instead.

func (*SigningConfig) GetCaUrl added in v0.3.1 

func (x *SigningConfig) GetCaUrl() string

func (*SigningConfig) GetMediaType added in v0.3.3 

func (x *SigningConfig) GetMediaType() string

func (*SigningConfig) GetOidcUrl added in v0.3.1 

func (x *SigningConfig) GetOidcUrl() string

func (*SigningConfig) GetTlogUrls added in v0.3.1 

func (x *SigningConfig) GetTlogUrls() []string

func (*SigningConfig) GetTsaUrls added in v0.3.1 

func (x *SigningConfig) GetTsaUrls() []string

func (*SigningConfig) ProtoMessage added in v0.3.1 

func (*SigningConfig) ProtoMessage()

func (*SigningConfig) ProtoReflect added in v0.3.1 

func (x *SigningConfig) ProtoReflect() protoreflect.Message

func (*SigningConfig) Reset added in v0.3.1 

func (x *SigningConfig) Reset()

func (*SigningConfig) String added in v0.3.1 

func (x *SigningConfig) String() string

type TransparencyLogInstance 

type TransparencyLogInstance struct {

	// The base URL at which can be used to URLs for the client.
	BaseUrl string `protobuf:"bytes,1,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
	// The hash algorithm used for the Merkle Tree.
	HashAlgorithm v1.HashAlgorithm `` /* 143-byte string literal not displayed */
	// The public key used to verify signatures generated by the log.
	// This attribute contains the signature algorithm used by the log.
	PublicKey *v1.PublicKey `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	// The unique identifier for this transparency log.
	// Represented as the SHA-256 hash of the log's public key,
	// calculated over the DER encoding of the key represented as
	// SubjectPublicKeyInfo.
	// See https://www.rfc-editor.org/rfc/rfc6962#section-3.2
	LogId *v1.LogId `protobuf:"bytes,4,opt,name=log_id,json=logId,proto3" json:"log_id,omitempty"`
	// The checkpoint key identifier for the log used in a checkpoint.
	// Optional, not provided for logs that do not generate checkpoints.
	// For logs that do generate checkpoints, if not set, assume
	// log_id equals checkpoint_key_id.
	// Follows the specification described here
	// for ECDSA and Ed25519 signatures:
	// https://github.com/C2SP/C2SP/blob/main/signed-note.md#signatures
	// For RSA signatures, the key ID will match the ECDSA format, the
	// hashed DER-encoded SPKI public key. Publicly witnessed logs MUST NOT
	// use RSA-signed checkpoints, since witnesses do not support
	// RSA signatures.
	// This is provided for convenience. Clients can also calculate the
	// checkpoint key ID given the log's public key.
	// SHOULD be set for logs generating Ed25519 signatures.
	// SHOULD be 4 bytes long, as a truncated hash.
	CheckpointKeyId *v1.LogId `protobuf:"bytes,5,opt,name=checkpoint_key_id,json=checkpointKeyId,proto3" json:"checkpoint_key_id,omitempty"`
	// contains filtered or unexported fields
}

TransparencyLogInstance describes the immutable parameters from a transparency log. See https://www.rfc-editor.org/rfc/rfc9162.html#name-log-parameters for more details. The included parameters are the minimal set required to identify a log, and verify an inclusion proof/promise.

func (*TransparencyLogInstance) Descriptor deprecated 

func (*TransparencyLogInstance) Descriptor() ([]byte, []int)

Deprecated: Use TransparencyLogInstance.ProtoReflect.Descriptor instead.

func (*TransparencyLogInstance) GetBaseUrl 

func (x *TransparencyLogInstance) GetBaseUrl() string

func (*TransparencyLogInstance) GetCheckpointKeyId added in v0.3.2 

func (x *TransparencyLogInstance) GetCheckpointKeyId() *v1.LogId

func (*TransparencyLogInstance) GetHashAlgorithm 

func (x *TransparencyLogInstance) GetHashAlgorithm() v1.HashAlgorithm

func (*TransparencyLogInstance) GetLogId 

func (x *TransparencyLogInstance) GetLogId() *v1.LogId

func (*TransparencyLogInstance) GetPublicKey 

func (x *TransparencyLogInstance) GetPublicKey() *v1.PublicKey

func (*TransparencyLogInstance) ProtoMessage 

func (*TransparencyLogInstance) ProtoMessage()

func (*TransparencyLogInstance) ProtoReflect 

func (x *TransparencyLogInstance) ProtoReflect() protoreflect.Message

func (*TransparencyLogInstance) Reset 

func (x *TransparencyLogInstance) Reset()

func (*TransparencyLogInstance) String 

func (x *TransparencyLogInstance) String() string

type TrustedRoot 

type TrustedRoot struct {

	// MUST be application/vnd.dev.sigstore.trustedroot.v0.1+json
	// when encoded as JSON.
	// Clients MUST be able to process and parse content with the media
	// type defined in the old format:
	// application/vnd.dev.sigstore.trustedroot+json;version=0.1
	MediaType string `protobuf:"bytes,1,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
	// A set of trusted Rekor servers.
	Tlogs []*TransparencyLogInstance `protobuf:"bytes,2,rep,name=tlogs,proto3" json:"tlogs,omitempty"`
	// A set of trusted certificate authorities (e.g Fulcio), and any
	// intermediate certificates they provide.
	// If a CA is issuing multiple intermediate certificate, each
	// combination shall be represented as separate chain. I.e, a single
	// root cert may appear in multiple chains but with different
	// intermediate and/or leaf certificates.
	// The certificates are intended to be used for verifying artifact
	// signatures.
	CertificateAuthorities []*CertificateAuthority `` /* 127-byte string literal not displayed */
	// A set of trusted certificate transparency logs.
	Ctlogs []*TransparencyLogInstance `protobuf:"bytes,4,rep,name=ctlogs,proto3" json:"ctlogs,omitempty"`
	// A set of trusted timestamping authorities.
	TimestampAuthorities []*CertificateAuthority `protobuf:"bytes,5,rep,name=timestamp_authorities,json=timestampAuthorities,proto3" json:"timestamp_authorities,omitempty"`
	// contains filtered or unexported fields
}

TrustedRoot describes the client's complete set of trusted entities. How the TrustedRoot is populated is not specified, but can be a combination of many sources such as TUF repositories, files on disk etc.

The TrustedRoot is not meant to be used for any artifact verification, only to capture the complete/global set of trusted verification materials. When verifying an artifact, based on the artifact and policies, a selection of keys/authorities are expected to be extracted and provided to the verification function. This way the set of keys/authorities can be kept to a minimal set by the policy to gain better control over what signatures that are allowed.

The embedded transparency logs, CT logs, CAs and TSAs MUST include any previously used instance -- otherwise signatures made in the past cannot be verified.

All the listed instances SHOULD be sorted by the 'valid_for' in ascending order, that is, the oldest instance first. Only the last instance is allowed to have their 'end' timestamp unset. All previous instances MUST have a closed interval of validity. The last instance MAY have a closed interval. Clients MUST accept instances that overlaps in time, if not clients may experience problems during rotations of verification materials.

To be able to manage planned rotations of either transparency logs or certificate authorities, clienst MUST accept lists of instances where the last instance have a 'valid_for' that belongs to the future. This should not be a problem as clients SHOULD first seek the trust root for a suitable instance before creating a per artifact trust root (that is, a sub-set of the complete trust root) that is used for verification.

func (*TrustedRoot) Descriptor deprecated 

func (*TrustedRoot) Descriptor() ([]byte, []int)

Deprecated: Use TrustedRoot.ProtoReflect.Descriptor instead.

func (*TrustedRoot) GetCertificateAuthorities 

func (x *TrustedRoot) GetCertificateAuthorities() []*CertificateAuthority

func (*TrustedRoot) GetCtlogs 

func (x *TrustedRoot) GetCtlogs() []*TransparencyLogInstance

func (*TrustedRoot) GetMediaType 

func (x *TrustedRoot) GetMediaType() string

func (*TrustedRoot) GetTimestampAuthorities 

func (x *TrustedRoot) GetTimestampAuthorities() []*CertificateAuthority

func (*TrustedRoot) GetTlogs 

func (x *TrustedRoot) GetTlogs() []*TransparencyLogInstance

func (*TrustedRoot) ProtoMessage 

func (*TrustedRoot) ProtoMessage()

func (*TrustedRoot) ProtoReflect 

func (x *TrustedRoot) ProtoReflect() protoreflect.Message

func (*TrustedRoot) Reset 

func (x *TrustedRoot) Reset()

func (*TrustedRoot) String 

func (x *TrustedRoot) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.