vendor: github.com/secure-systems-lab/go-securesystemslib v0.9.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

go.mod

@@ -206,7 +206,7 @@ require (
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/sasha-s/go-deadlock v0.3.5 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.6.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/spdx/tools-golang v0.5.5 // indirect
 	github.com/stretchr/testify v1.11.1 // indirect

go.sum

@@ -551,8 +551,8 @@ github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb
 github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/secure-systems-lab/go-securesystemslib v0.6.0 h1:T65atpAVCJQK14UA57LMdZGpHi4QYSH/9FZyNGqMYIA=
-github.com/secure-systems-lab/go-securesystemslib v0.6.0/go.mod h1:8Mtpo9JKks/qhPG4HGZ2LGMvrPbzuxwfz/f/zLfEWkk=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1 h1:nZZaNz4DiERIQguNy0cL5qTdn9lR8XKHf4RUyG1Sx3g=
+github.com/secure-systems-lab/go-securesystemslib v0.9.1/go.mod h1:np53YzT0zXGMv6x4iEWc9Z59uR+x+ndLwCLqPYpLXVU=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=

vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go

@@ -15,29 +15,19 @@ var ErrNoSigners = errors.New("no signers provided")
 
 // EnvelopeSigner creates signed Envelopes.
 type EnvelopeSigner struct {
-	providers []SignerVerifier
+	providers []Signer
 }
 
 /*
 NewEnvelopeSigner creates an EnvelopeSigner that uses 1+ Signer algorithms to
-sign the data. Creates a verifier with threshold=1, at least one of the
-providers must validate signatures successfully.
+sign the data.
 */
-func NewEnvelopeSigner(p ...SignerVerifier) (*EnvelopeSigner, error) {
-	return NewMultiEnvelopeSigner(1, p...)
-}
+func NewEnvelopeSigner(p ...Signer) (*EnvelopeSigner, error) {
+	var providers []Signer
 
-/*
-NewMultiEnvelopeSigner creates an EnvelopeSigner that uses 1+ Signer
-algorithms to sign the data. Creates a verifier with threshold. Threshold
-indicates the amount of providers that must validate the envelope.
-*/
-func NewMultiEnvelopeSigner(threshold int, p ...SignerVerifier) (*EnvelopeSigner, error) {
-	var providers []SignerVerifier
-
-	for _, sv := range p {
-		if sv != nil {
-			providers = append(providers, sv)
+	for _, s := range p {
+		if s != nil {
+			providers = append(providers, s)
 		}
 	}
 
@@ -50,6 +40,17 @@ func NewMultiEnvelopeSigner(threshold int, p ...SignerVerifier) (*EnvelopeSigner
 	}, nil
 }
 
+/*
+NewMultiEnvelopeSigner creates an EnvelopeSigner that uses 1+ Signer
+algorithms to sign the data. The threshold parameter is legacy and is ignored.
+
+Deprecated: This function simply calls NewEnvelopeSigner, and that function should
+be preferred.
+*/
+func NewMultiEnvelopeSigner(threshold int, p ...Signer) (*EnvelopeSigner, error) {
+	return NewEnvelopeSigner(p...)
+}
+
 /*
 SignPayload signs a payload and payload type according to DSSE.
 Returned is an envelope as defined here:

vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go

@@ -43,7 +43,8 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted
 	// If *any* signature is found to be incorrect, it is skipped
 	var acceptedKeys []AcceptedKey
 	usedKeyids := make(map[string]string)
-	unverified_providers := ev.providers
+	unverified_providers := make([]Verifier, len(ev.providers))
+	copy(unverified_providers, ev.providers)
 	for _, s := range e.Signatures {
 		sig, err := b64Decode(s.Sig)
 		if err != nil {

vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go

@@ -11,7 +11,10 @@ import (
 	"os"
 )
 
-const ECDSAKeyType = "ecdsa"
+const (
+	ECDSAKeyType   = "ecdsa"
+	ECDSAKeyScheme = "ecdsa-sha2-nistp256"
+)
 
 // ECDSASignerVerifier is a dsse.SignerVerifier compliant interface to sign and
 // verify signatures using ECDSA keys.
@@ -89,13 +92,18 @@ func (sv *ECDSASignerVerifier) Public() crypto.PublicKey {
 
 // LoadECDSAKeyFromFile returns an SSLibKey instance for an ECDSA key stored in
 // a file in the custom securesystemslib format.
+//
+// Deprecated: use LoadKey(). The custom serialization format has been
+// deprecated. Use
+// https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py
+// to convert your key.
 func LoadECDSAKeyFromFile(path string) (*SSLibKey, error) {
 	contents, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("unable to load ECDSA key from file: %w", err)
 	}
 
-	return loadKeyFromSSLibBytes(contents)
+	return LoadKeyFromSSLibBytes(contents)
 }
 
 func getECDSAHashedData(data []byte, curveSize int) []byte {

vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go

@@ -88,11 +88,16 @@ func (sv *ED25519SignerVerifier) Public() crypto.PublicKey {
 
 // LoadED25519KeyFromFile returns an SSLibKey instance for an ED25519 key stored
 // in a file in the custom securesystemslib format.
+//
+// Deprecated: use LoadKey(). The custom serialization format has been
+// deprecated. Use
+// https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py
+// to convert your key.
 func LoadED25519KeyFromFile(path string) (*SSLibKey, error) {
 	contents, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("unable to load ED25519 key from file: %w", err)
 	}
 
-	return loadKeyFromSSLibBytes(contents)
+	return LoadKeyFromSSLibBytes(contents)
 }

vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go

@@ -94,12 +94,28 @@ func (sv *RSAPSSSignerVerifier) Public() crypto.PublicKey {
 
 // LoadRSAPSSKeyFromFile returns an SSLibKey instance for an RSA key stored in a
 // file.
+//
+// Deprecated: use LoadKey(). The custom serialization format has been
+// deprecated. Use
+// https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py
+// to convert your key.
 func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) {
 	contents, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
 	}
 
+	return LoadRSAPSSKeyFromBytes(contents)
+}
+
+// LoadRSAPSSKeyFromBytes is a function that takes a byte array as input. This
+// byte array should represent a PEM encoded RSA key, as PEM encoding is
+// required.  The function returns an SSLibKey instance, which is a struct that
+// holds the key data.
+//
+// Deprecated: use LoadKey() for all key types, RSA is no longer the only key
+// that uses PEM serialization.
+func LoadRSAPSSKeyFromBytes(contents []byte) (*SSLibKey, error) {
 	pemData, keyObj, err := decodeAndParsePEM(contents)
 	if err != nil {
 		return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
@@ -112,20 +128,13 @@ func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) {
 		KeyVal:              KeyVal{},
 	}
 
-	switch k := keyObj.(type) {
-	case *rsa.PublicKey:
-		pubKeyBytes, err := x509.MarshalPKIXPublicKey(k)
-		if err != nil {
-			return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
-		}
-		key.KeyVal.Public = strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM)))
+	pubKeyBytes, err := marshalAndGeneratePEM(keyObj)
+	if err != nil {
+		return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
+	}
+	key.KeyVal.Public = strings.TrimSpace(string(pubKeyBytes))
 
-	case *rsa.PrivateKey:
-		pubKeyBytes, err := x509.MarshalPKIXPublicKey(k.Public())
-		if err != nil {
-			return nil, fmt.Errorf("unable to load RSA key from file: %w", err)
-		}
-		key.KeyVal.Public = strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM)))
+	if _, ok := keyObj.(*rsa.PrivateKey); ok {
 		key.KeyVal.Private = strings.TrimSpace(string(generatePEMBlock(pemData.Bytes, RSAPrivateKeyPEM)))
 	}
 
@@ -139,3 +148,23 @@ func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) {
 
 	return key, nil
 }
+
+func marshalAndGeneratePEM(key interface{}) ([]byte, error) {
+	var pubKeyBytes []byte
+	var err error
+
+	switch k := key.(type) {
+	case *rsa.PublicKey:
+		pubKeyBytes, err = x509.MarshalPKIXPublicKey(k)
+	case *rsa.PrivateKey:
+		pubKeyBytes, err = x509.MarshalPKIXPublicKey(k.Public())
+	default:
+		return nil, fmt.Errorf("unexpected key type: %T", k)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return generatePEMBlock(pubKeyBytes, PublicKeyPEM), nil
+}

vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/signerverifier.go

@@ -1,7 +1,13 @@
 package signerverifier
 
 import (
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/hex"
 	"errors"
+	"strings"
 )
 
 var KeyIDHashAlgorithms = []string{"sha256", "sha512"}
@@ -12,6 +18,7 @@ var (
 	ErrUnknownKeyType              = errors.New("unknown key type")
 	ErrInvalidThreshold            = errors.New("threshold is either less than 1 or greater than number of provided public keys")
 	ErrInvalidKey                  = errors.New("key object has no value")
+	ErrInvalidPEM                  = errors.New("unable to parse PEM block")
 )
 
 const (
@@ -29,6 +36,111 @@ type SSLibKey struct {
 
 type KeyVal struct {
 	Private     string `json:"private,omitempty"`
-	Public      string `json:"public"`
+	Public      string `json:"public,omitempty"`
 	Certificate string `json:"certificate,omitempty"`
+	Identity    string `json:"identity,omitempty"`
+	Issuer      string `json:"issuer,omitempty"`
+}
+
+// LoadKey returns an SSLibKey object when provided a PEM encoded key.
+// Currently, RSA, ED25519, and ECDSA keys are supported.
+func LoadKey(keyBytes []byte) (*SSLibKey, error) {
+	pemBlock, rawKey, err := decodeAndParsePEM(keyBytes)
+	if err != nil {
+		return nil, err
+	}
+
+	var key *SSLibKey
+	switch k := rawKey.(type) {
+	case *rsa.PublicKey:
+		pubKeyBytes, err := x509.MarshalPKIXPublicKey(k)
+		if err != nil {
+			return nil, err
+		}
+		key = &SSLibKey{
+			KeyIDHashAlgorithms: KeyIDHashAlgorithms,
+			KeyType:             RSAKeyType,
+			KeyVal: KeyVal{
+				Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))),
+			},
+			Scheme: RSAKeyScheme,
+		}
+
+	case *rsa.PrivateKey:
+		pubKeyBytes, err := x509.MarshalPKIXPublicKey(k.Public())
+		if err != nil {
+			return nil, err
+		}
+		key = &SSLibKey{
+			KeyIDHashAlgorithms: KeyIDHashAlgorithms,
+			KeyType:             RSAKeyType,
+			KeyVal: KeyVal{
+				Public:  strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))),
+				Private: strings.TrimSpace(string(generatePEMBlock(pemBlock.Bytes, pemBlock.Type))),
+			},
+			Scheme: RSAKeyScheme,
+		}
+
+	case ed25519.PublicKey:
+		key = &SSLibKey{
+			KeyIDHashAlgorithms: KeyIDHashAlgorithms,
+			KeyType:             ED25519KeyType,
+			KeyVal: KeyVal{
+				Public: strings.TrimSpace(hex.EncodeToString(k)),
+			},
+			Scheme: ED25519KeyType,
+		}
+
+	case ed25519.PrivateKey:
+		pubKeyBytes := k.Public()
+		key = &SSLibKey{
+			KeyIDHashAlgorithms: KeyIDHashAlgorithms,
+			KeyType:             ED25519KeyType,
+			KeyVal: KeyVal{
+				Public:  strings.TrimSpace(hex.EncodeToString(pubKeyBytes.(ed25519.PublicKey))),
+				Private: strings.TrimSpace(hex.EncodeToString(k)),
+			},
+			Scheme: ED25519KeyType,
+		}
+
+	case *ecdsa.PublicKey:
+		pubKeyBytes, err := x509.MarshalPKIXPublicKey(k)
+		if err != nil {
+			return nil, err
+		}
+		key = &SSLibKey{
+			KeyIDHashAlgorithms: KeyIDHashAlgorithms,
+			KeyType:             ECDSAKeyType,
+			KeyVal: KeyVal{
+				Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))),
+			},
+			Scheme: ECDSAKeyScheme,
+		}
+
+	case *ecdsa.PrivateKey:
+		pubKeyBytes, err := x509.MarshalPKIXPublicKey(k.Public())
+		if err != nil {
+			return nil, err
+		}
+		key = &SSLibKey{
+			KeyIDHashAlgorithms: KeyIDHashAlgorithms,
+			KeyType:             ECDSAKeyType,
+			KeyVal: KeyVal{
+				Public:  strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))),
+				Private: strings.TrimSpace(string(generatePEMBlock(pemBlock.Bytes, PrivateKeyPEM))),
+			},
+			Scheme: ECDSAKeyScheme,
+		}
+
+	default:
+		return nil, ErrUnknownKeyType
+	}
+
+	keyID, err := calculateKeyID(key)
+	if err != nil {
+		return nil, err
+	}
+	key.KeyID = keyID
+
+	return key, nil
 }

vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/utils.go

@@ -8,7 +8,6 @@ import (
 	"encoding/pem"
 	"errors"
 	"hash"
-	"testing"
 
 	"github.com/secure-systems-lab/go-securesystemslib/cjson"
 )
@@ -24,15 +23,17 @@ var (
 	ErrFailedPEMParsing = errors.New("failed parsing the PEM block: unsupported PEM type")
 )
 
-// loadKeyFromSSLibBytes returns a pointer to a Key instance created from the
+// LoadKeyFromSSLibBytes returns a pointer to a Key instance created from the
 // contents of the bytes. The key contents are expected to be in the custom
 // securesystemslib format.
-func loadKeyFromSSLibBytes(contents []byte) (*SSLibKey, error) {
+//
+// Deprecated: use LoadKey() for all key types, RSA is no longer the only key
+// that uses PEM serialization.
+func LoadKeyFromSSLibBytes(contents []byte) (*SSLibKey, error) {
 	var key *SSLibKey
 	if err := json.Unmarshal(contents, &key); err != nil {
-		return nil, err
+		return LoadRSAPSSKeyFromBytes(contents)
 	}
-
 	if len(key.KeyID) == 0 {
 		keyID, err := calculateKeyID(key)
 		if err != nil {
@@ -139,12 +140,3 @@ func hashBeforeSigning(data []byte, h hash.Hash) []byte {
 	h.Write(data)
 	return h.Sum(nil)
 }
-
-func hexDecode(t *testing.T, data string) []byte {
-	t.Helper()
-	b, err := hex.DecodeString(data)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return b
-}

vendor/modules.txt

@@ -1228,8 +1228,8 @@ github.com/sasha-s/go-deadlock
 # github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529
 ## explicit
 github.com/sean-/seed
-# github.com/secure-systems-lab/go-securesystemslib v0.6.0
-## explicit; go 1.20
+# github.com/secure-systems-lab/go-securesystemslib v0.9.1
+## explicit; go 1.23.0
 github.com/secure-systems-lab/go-securesystemslib/cjson
 github.com/secure-systems-lab/go-securesystemslib/dsse
 github.com/secure-systems-lab/go-securesystemslib/signerverifier