Signing example improvements #458

jku · 2025-04-16T16:36:00Z

Fixes #457 and improves singing example:

Support --signing-config <FILE> (similarly to verify supporting trustedroot)
Also support --trusted-root <FILE> (so that the bundle can be verified after signing)

This PR requires #465.

examples/sigstore-go-signing/main.go

pkg/root/signing_config_test.go

examples/sigstore-go-signing/main.go

pkg/root/signing_config.go

jku · 2025-04-22T15:59:17Z

I'm working on this tomorrow but I think I'll split this into two: bug fix and the feature work...

jku · 2025-04-24T12:40:54Z

The bug in ValidFor handling is handled in the linked PR: I'm leaving this PR for the feature work that follows the bug fix.

I'm still seeing a strange failure in the verification step in examples/sigstore-go-signing when a TSA is included in the signingconfig: I will document it here later today.

jku · 2025-04-24T14:30:13Z

Here is the remaining issue I see:

background

I'm using the signing example with signingconfig and trustedroot files from Signing event: sign/add-timestamp root-signing-staging#244 -- I'm trying to test the next staging signing config and trustedroot before we add them into the TUF repository
the signingconfig and trustedroot include a TSA

results

Running the signing-example with just the signingconfig seems to work:

 $ ./sigstore-go-signing --tsa --rekor -id-token $TOKEN --signing-config ~/src/root-signing-staging/targets/signing_config_0_2.json  hello_world.txt 
Using public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6CLoAIFCWshnK9+qdzFcWi3+FsE6
/TIdzstUtpA/CTBFkgd3KFW6/8cCKx0QrI1I1NZSz3WIH3xIcuHhBspf2Q==
-----END PUBLIC KEY-----


{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial":{"certificate":{"rawBytes":"MIICzDCCAlGgAwIBAgIUD0nVfEiMHNzJKcw7Ms4Yu9Wc9IUwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwNDI0MTQwOTQ0WhcNMjUwNDI0MTQxOTQ0WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6CLoAIFCWshnK9+qdzFcWi3+FsE6/TIdzstUtpA/CTBFkgd3KFW6/8cCKx0QrI1I1NZSz3WIH3xIcuHhBspf2aOCAXAwggFsMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUYJ/dxDrreOaYYfp6A6CIcf/dYX0wHwYDVR0jBBgwFoAUcYYwphR8Ym/599b0BRp/X//rb6wwGQYDVR0RAQH/BA8wDYELamt1QGdvdG8uZmkwLAYKKwYBBAGDvzABAQQeaHR0cHM6Ly9naXRodWIuY29tL2xvZ2luL29hdXRoMC4GCisGAQQBg78wAQgEIAweaHR0cHM6Ly9naXRodWIuY29tL2xvZ2luL29hdXRoMIGLBgorBgEEAdZ5AgQCBH0EewB5AHcAKzC83GiIyeLh2CYpXnQfSDkxlgLynDPLXkNA/rKshnoAAAGWaCINeAAABAMASDBGAiEA0y8FZzhVvFOn8IAbUprJsmtFt7RSLGqI5Hd+csFQBiACIQDL0zuCyO8mny6l/sRWlAfo3eHt331oB9AmXTuqzwJiIjAKBggqhkjOPQQDAwNpADBmAjEA53S44PXGDsFERYpn+b0i++L/c3GaLAgSCDUNCCa5Y82ZJ16U3PylYU9DVIVMtjrPAjEAzM5yO4wPNXTUkT7P+Refy7NcrbIytNBHtSELZZQCWAX+iOUZM43xiAN+kYi0YZx0"}, "tlogEntries":[{"logIndex":"41223928", "logId":{"keyId":"0y8wo8MtY5wrdiIFohx7sHeI5oKDpK5vQhGHI6G+pJY="}, "kindVersion":{"kind":"hashedrekord", "version":"0.0.1"}, "integratedTime":"1745503784", "inclusionPromise":{"signedEntryTimestamp":"MEQCIGXw+c1qm/wZ+r0PHci4zXaCKXZJK6X0jW7ngXThTSeLAiAIzWQLPaAg19ocfjfTsBJgvdssD+DyLNtehHcBrTGVbQ=="}, "inclusionProof":{"logIndex":"9541516", "rootHash":"nBsLUmG61wfyG/epi/j2Eg7zE/YuseKi3bnUIbIQfSE=", "treeSize":"9541517", "hashes":["5VtXgxznIhXYCl9KeOfcv20ihITVBd4/WLXA+i5xWaE=", "B6UqFLsE9IJ//b7/JS3GARryY3xjBiWr5xU8vs0CmOI=", "Llj6SdgRE5sRer95msj+rzDjiRI4PFJndcpDqkG+IFk=", "O2XaZfUGIee6bMZWvo8haWG3QV0OuQNA5z/Z1q5Lisc=", "DMHH0f5alupejso2qvNvVRJ/XvlIBGBOf3YGltmaQMI=", "ZC8CFCObTb0ofLpLSxhg8erNiSjMItnCVQY0sXPBg0E=", "FySOP2K+cnf8w7rq2oX/MlXshQka2y+MJ0Bffe5EHv4=", "/R3TBYaRYRzbN32wMW3eh/hoXTU8qkZcYMRf2xj5w3E=", "z4/Qhzab/IOndrkc6duUjoZbQq/ELELHRdEvlG7MTJU=", "GoHRwlhYuJIYJdmRnHX5HWLr2ngxzHnAIIqBewovBi0=", "OdoqbUqBYHhj2W1RLM8APkQOnM2K9gzGm1KPFmwIIeQ="], "checkpoint":{"envelope":"rekor.sigstage.dev - 8202293616175992157\n9541517\nnBsLUmG61wfyG/epi/j2Eg7zE/YuseKi3bnUIbIQfSE=\n\n— rekor.sigstage.dev 0y8wozBGAiEAq4++5Yc/3/Aw27ZnEaHyYZiyzBZXnGmuF5Wegk2xOZECIQC1d16gBsugA/o4nlgyiT222cu/ZXfeArLmcplrebZhYg==\n"}}, "canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJiOTRkMjdiOTkzNGQzZTA4YTUyZTUyZDdkYTdkYWJmYWM0ODRlZmUzN2E1MzgwZWU5MDg4ZjdhY2UyZWZjZGU5In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRkF1YW9KaFhzZm53aC9uNzJRTGlCRGVhWGZQR3hSVlNCbXMzZFp4T0M5VkFpQUEyT0NjSFAwdWlvK21ZYUZlZGhnbkNkbmtwY3E2Q1YvWHBXL2pKZnhUa2c9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZSRU5EUVd4SFowRjNTVUpCWjBsVlJEQnVWbVpGYVUxSVRucEtTMk4zTjAxek5GbDFPVmRqT1VsVmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFZkMDVFU1RCTlZGRjNUMVJSTUZkb1kwNU5hbFYzVGtSSk1FMVVVWGhQVkZFd1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVUyUTB4dlFVbEdRMWR6YUc1TE9TdHhaSHBHWTFkcE15dEdjMFUyTDFSSlpIcHpkRlVLZEhCQkwwTlVRa1pyWjJRelMwWlhOaTg0WTBOTGVEQlJja2t4U1RGT1dsTjZNMWRKU0RONFNXTjFTR2hDYzNCbU1tRlBRMEZZUVhkblowWnpUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZaU2k5a0NuaEVjbkpsVDJGWldXWndOa0UyUTBsalppOWtXVmd3ZDBoM1dVUldVakJxUWtKbmQwWnZRVlZqV1ZsM2NHaFNPRmx0THpVNU9XSXdRbEp3TDFndkwzSUtZalozZDBkUldVUldVakJTUVZGSUwwSkJPSGRFV1VWTVlXMTBNVkZIWkhaa1J6aDFXbTFyZDB4QldVdExkMWxDUWtGSFJIWjZRVUpCVVZGbFlVaFNNQXBqU0UwMlRIazVibUZZVW05a1YwbDFXVEk1ZEV3eWVIWmFNbXgxVERJNWFHUllVbTlOUXpSSFEybHpSMEZSVVVKbk56aDNRVkZuUlVsQmQyVmhTRkl3Q21OSVRUWk1lVGx1WVZoU2IyUlhTWFZaTWpsMFRESjRkbG95YkhWTU1qbG9aRmhTYjAxSlIweENaMjl5UW1kRlJVRmtXalZCWjFGRFFrZ3dSV1YzUWpVS1FVaGpRVXQ2UXpnelIybEplV1ZNYURKRFdYQllibEZtVTBScmVHeG5USGx1UkZCTVdHdE9RUzl5UzNOb2JtOUJRVUZIVjJGRFNVNWxRVUZCUWtGTlFRcFRSRUpIUVdsRlFUQjVPRVphZW1oV2RrWlBiamhKUVdKVmNISktjMjEwUm5RM1VsTk1SM0ZKTlVoa0syTnpSbEZDYVVGRFNWRkVUREI2ZFVONVR6aHRDbTU1Tm13dmMxSlhiRUZtYnpObFNIUXpNekZ2UWpsQmJWaFVkWEY2ZDBwcFNXcEJTMEpuWjNGb2EycFBVRkZSUkVGM1RuQkJSRUp0UVdwRlFUVXpVelFLTkZCWVIwUnpSa1ZTV1hCdUsySXdhU3NyVEM5ak0wZGhURUZuVTBORVZVNURRMkUxV1RneVdrb3hObFV6VUhsc1dWVTVSRlpKVmsxMGFuSlFRV3BGUVFwNlRUVjVUelIzVUU1WVZGVnJWRGRRSzFKbFpuazNUbU55WWtsNWRFNUNTSFJUUlV4YVdsRkRWMEZZSzJsUFZWcE5ORE40YVVGT0sydFphVEJaV25nd0NpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19"}], "timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICyjADAgEAMIICwQYJKoZIhvcNAQcCoIICsjCCAq4CAQMxDTALBglghkgBZQMEAgEwgbgGCyqGSIb3DQEJEAEEoIGoBIGlMIGiAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgrCVlhEfTP6ohyMTlPUXQ3qUcVh8cdj9lU1Qk/x+EpPoCFQDGwni5BYaccCC+sfJLHJ3Xm3a3QxgPMjAyNTA0MjQxNDA5NDRaMAMCAQGgMqQwMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhoAAxggHbMIIB1wIBATBRMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQCFAo1oQZh1eJBc8aJlqfyffJ+A3ynMAsGCWCGSAFlAwQCAaCB/DAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI1MDQyNDE0MDk0NFowLwYJKoZIhvcNAQkEMSIEICPo7q3CvNGVkc+Rz2QF0gCzXGggFXKyWjzwRCMrO26VMIGOBgsqhkiG9w0BCRACLzF/MH0wezB5BCAG9P/gR/6zWZm3M7DXoyNQHPwY5MAzZqhF13U250snRDBVMD2kOzA5MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIDAeBgNVBAMTF3NpZ3N0b3JlLXRzYS1zZWxmc2lnbmVkAhQKNaEGYdXiQXPGiZan8n3yfgN8pzAKBggqhkjOPQQDAgRnMGUCMA2GdvoiqRo0axmjHhkBjHdz+JLi5l/+aX5yrUA9Jl6qm49p462M0+Fc48w8E4V3wAIxAJluBUYMk1CVWtNG8ZpJsp7zFnaGSQu9m70JU4bWwvGGQ4s2gcUpyn2HMzYLzXYM1A=="}]}}, "messageSignature":{"messageDigest":{"algorithm":"SHA2_256", "digest":"uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek="}, "signature":"MEQCIFAuaoJhXsfnwh/n72QLiBDeaXfPGxRVSBms3dZxOC9VAiAA2OCcHP0uio+mYaFedhgnCdnkpcq6CV/XpW/jJfxTkg=="}}

The resulting bundle passes the verify example:

$ ./sigstore-go-verification -artifact ../sigstore-go-signing/hello_world.txt -requireTimestamp -expectedSAN [email protected] -expectedIssuer https://github.com/login/oauth -trustedrootJSONpath ~/src/root-signing-staging/targets/trusted_root.json ../sigstore-go-signing/bundle.json 
Verification successful!
{
   "mediaType": "application/vnd.dev.sigstore.verificationresult+json;version=0.1",
   "signature": {
      "certificate": {
         "certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
         "subjectAlternativeName": "[email protected]",
         "issuer": "https://github.com/login/oauth"
      }
   },
   "verifiedTimestamps": [
      {
         "type": "Tlog",
         "uri": "https://rekor.sigstage.dev",
         "timestamp": "2025-04-24T17:09:44+03:00"
      }
   ],
   "verifiedIdentity": {
      "subjectAlternativeName": {
         "subjectAlternativeName": "[email protected]"
      },
      "issuer": {
         "issuer": "https://github.com/login/oauth"
      }
   },
   "statement": {}
}

the issue is that running the signing example with a trusted root (enabling some verification after the signing) fails:

$ ./sigstore-go-signing --tsa --rekor -id-token $TOKEN --signing-config ~/src/root-signing-staging/targets/signing_config_0_2.json --trusted-root ~/src/root-signing-staging/targets/trusted_root.json hello_world.txt 
Using public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExtzu0NNdtnFEmLEGSChSXYo5AcJ7
tq282LMifHmdhnBSFCtqrgCjxbXzH8QAzAbki81mowFvD4U6LuQha7dQJg==
-----END PUBLIC KEY-----


2025/04/24 17:05:57 failed to verify timestamps: threshold not met for verified signed timestamps: 0 < 1

In both cases (sigstore-go-verify and sigstore-go-signing with --trusted-root) the code calls verifySignedTimestamp (https://github.com/sigstore/sigstore-go/blob/main/pkg/verify/tsa.go#L58) and the result is an error
sigstore-go-verify does not seem to think the error is a problem -- it even lists the timestamp as verified in the output

I am not sure where the issue is -- sigstore-go, my trusted root or my signing config.

jku · 2025-04-24T14:43:21Z

it even lists the timestamp as verified in the output

Actually that "timestamp" might be the integrated time since it says "type: TLog"?

jku · 2025-04-24T17:44:22Z

Documenting the debugging so far:
the timestamp verification fails because PKCS7.VerifyWithOpts() (https://github.com/sigstore/timestamp-authority/blob/main/pkg/verification/verify.go#L290 ) fails with pkcs7: No certificate for signer. The pkcs7 code expects to get a certificate with a specific issuer name and serial number: issuer matches but the serial number does not

loosebazooka · 2025-04-24T19:17:11Z

Just an update to keep people from investigating this further. I think the issue here is that the wrong TSA cert is embedded in https://github.com/sigstore/root-signing-staging/pull/244/files#diff-ca7959d2b4378c4b4d637c1ab78718347f9c6381b239c38f10f4d9f31a78843eR97-R101

Changing this to the one from the staging TSA: http://timestamp.sigstage.dev/api/v1/timestamp/certchain appears to work for me.

jku · 2025-04-25T08:10:43Z

Changing this to the one from the staging TSA: http://timestamp.sigstage.dev/api/v1/timestamp/certchain appears to work for me.

Thank you 🥇

The whole thing seems to work fine now: and the output in verification example looks correct:

Verification successful!
{
   "mediaType": "application/vnd.dev.sigstore.verificationresult+json;version=0.1",
   "signature": {
      "certificate": {
         "certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
         "subjectAlternativeName": "[email protected]",
         "issuer": "https://github.com/login/oauth"
      }
   },
   "verifiedTimestamps": [
      {
         "type": "Tlog",
         "uri": "https://rekor.sigstage.dev",
         "timestamp": "2025-04-25T09:37:19+03:00"
      },
      {
         "type": "TimestampAuthority",
         "uri": "https://timestamp.sigstage.dev/api/v1/timestamp",
         "timestamp": "2025-04-25T06:37:19Z"
      }
   ],
   "verifiedIdentity": {
      "subjectAlternativeName": {
         "subjectAlternativeName": "[email protected]"
      },
      "issuer": {
         "issuer": "https://github.com/login/oauth"
      }
   },
   "statement": {}
}

I think even the fact that verify and sign examples worked differently (one succeeds and one fails loudly) is understandable:

verify found a rekorv1 entry with a SET: that's enough "timestamps"
signing specifically checks for the timestamp authority timestamp because it knows one was added

This is similar to trustedroot in verify example. Note that if --signing-config is given, the default --trusted-root is not used: that would not make sense. So the verification at the end only happens if --trusted-root is also pased Signed-off-by: Jussi Kukkonen <[email protected]>

jku · 2025-04-25T08:21:50Z

rebased on main since #465 was merged: ready for review

codysoyland

LGTM!

jku requested a review from a team as a code owner April 16, 2025 16:36

jku commented Apr 16, 2025

View reviewed changes

examples/sigstore-go-signing/main.go Outdated Show resolved Hide resolved

jku marked this pull request as draft April 16, 2025 16:37

jku force-pushed the signing-example-improvements branch from fcace43 to 7cd89f3 Compare April 16, 2025 16:43

This comment was marked as outdated.

Sign in to view

jku commented Apr 16, 2025

View reviewed changes

pkg/root/signing_config_test.go Outdated Show resolved Hide resolved

jku marked this pull request as ready for review April 16, 2025 17:42

This comment was marked as outdated.

Sign in to view

jku mentioned this pull request Apr 17, 2025

Signing event: sign/add-timestamp sigstore/root-signing-staging#244

Open

jku commented Apr 17, 2025

View reviewed changes

examples/sigstore-go-signing/main.go Show resolved Hide resolved

haydentherapper reviewed Apr 17, 2025

View reviewed changes

jku force-pushed the signing-example-improvements branch from 0e5a85f to cb65bf0 Compare April 17, 2025 16:49

jku marked this pull request as draft April 22, 2025 15:59

jku force-pushed the signing-example-improvements branch 2 times, most recently from eacdcbc to 040d5bc Compare April 24, 2025 12:35

This comment was marked as outdated.

Sign in to view

jku force-pushed the signing-example-improvements branch from 040d5bc to 54c3463 Compare April 25, 2025 08:21

jku marked this pull request as ready for review April 25, 2025 08:21

codysoyland approved these changes Apr 25, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Signing example improvements #458

Signing example improvements #458

jku commented Apr 16, 2025 •

edited

Loading

This comment was marked as outdated.

This comment was marked as outdated.

jku commented Apr 22, 2025

jku commented Apr 24, 2025 •

edited

Loading

jku commented Apr 24, 2025 •

edited

Loading

jku commented Apr 24, 2025

This comment was marked as outdated.

jku commented Apr 24, 2025

loosebazooka commented Apr 24, 2025 •

edited

Loading

jku commented Apr 25, 2025

jku commented Apr 25, 2025

codysoyland left a comment

Signing example improvements #458

Are you sure you want to change the base?

Signing example improvements #458

Conversation

jku commented Apr 16, 2025 • edited Loading

This comment was marked as outdated.

This comment was marked as outdated.

jku commented Apr 22, 2025

jku commented Apr 24, 2025 • edited Loading

jku commented Apr 24, 2025 • edited Loading

jku commented Apr 24, 2025

This comment was marked as outdated.

jku commented Apr 24, 2025

loosebazooka commented Apr 24, 2025 • edited Loading

jku commented Apr 25, 2025

jku commented Apr 25, 2025

codysoyland left a comment

Choose a reason for hiding this comment

jku commented Apr 16, 2025 •

edited

Loading

jku commented Apr 24, 2025 •

edited

Loading

jku commented Apr 24, 2025 •

edited

Loading

loosebazooka commented Apr 24, 2025 •

edited

Loading