diff --git a/go.mod b/go.mod index a71a91dd96..a23ce47706 100644 --- a/go.mod +++ b/go.mod @@ -206,7 +206,7 @@ require ( github.com/prometheus/procfs v0.16.1 // indirect github.com/sasha-s/go-deadlock v0.3.5 // indirect github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect - github.com/secure-systems-lab/go-securesystemslib v0.6.0 // indirect + github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect github.com/shibumi/go-pathspec v1.3.0 // indirect github.com/spdx/tools-golang v0.5.5 // indirect github.com/stretchr/testify v1.11.1 // indirect diff --git a/go.sum b/go.sum index e372e3a1ef..cda23cc18e 100644 --- a/go.sum +++ b/go.sum @@ -551,8 +551,8 @@ github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U= github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I= github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc= -github.com/secure-systems-lab/go-securesystemslib v0.6.0 h1:T65atpAVCJQK14UA57LMdZGpHi4QYSH/9FZyNGqMYIA= -github.com/secure-systems-lab/go-securesystemslib v0.6.0/go.mod h1:8Mtpo9JKks/qhPG4HGZ2LGMvrPbzuxwfz/f/zLfEWkk= +github.com/secure-systems-lab/go-securesystemslib v0.9.1 h1:nZZaNz4DiERIQguNy0cL5qTdn9lR8XKHf4RUyG1Sx3g= +github.com/secure-systems-lab/go-securesystemslib v0.9.1/go.mod h1:np53YzT0zXGMv6x4iEWc9Z59uR+x+ndLwCLqPYpLXVU= github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI= github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE= github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go index 85aed102d4..244a806774 100644 --- a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go +++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/sign.go @@ -15,29 +15,19 @@ var ErrNoSigners = errors.New("no signers provided") // EnvelopeSigner creates signed Envelopes. type EnvelopeSigner struct { - providers []SignerVerifier + providers []Signer } /* NewEnvelopeSigner creates an EnvelopeSigner that uses 1+ Signer algorithms to -sign the data. Creates a verifier with threshold=1, at least one of the -providers must validate signatures successfully. +sign the data. */ -func NewEnvelopeSigner(p ...SignerVerifier) (*EnvelopeSigner, error) { - return NewMultiEnvelopeSigner(1, p...) -} +func NewEnvelopeSigner(p ...Signer) (*EnvelopeSigner, error) { + var providers []Signer -/* -NewMultiEnvelopeSigner creates an EnvelopeSigner that uses 1+ Signer -algorithms to sign the data. Creates a verifier with threshold. Threshold -indicates the amount of providers that must validate the envelope. -*/ -func NewMultiEnvelopeSigner(threshold int, p ...SignerVerifier) (*EnvelopeSigner, error) { - var providers []SignerVerifier - - for _, sv := range p { - if sv != nil { - providers = append(providers, sv) + for _, s := range p { + if s != nil { + providers = append(providers, s) } } @@ -50,6 +40,17 @@ func NewMultiEnvelopeSigner(threshold int, p ...SignerVerifier) (*EnvelopeSigner }, nil } +/* +NewMultiEnvelopeSigner creates an EnvelopeSigner that uses 1+ Signer +algorithms to sign the data. The threshold parameter is legacy and is ignored. + +Deprecated: This function simply calls NewEnvelopeSigner, and that function should +be preferred. +*/ +func NewMultiEnvelopeSigner(threshold int, p ...Signer) (*EnvelopeSigner, error) { + return NewEnvelopeSigner(p...) +} + /* SignPayload signs a payload and payload type according to DSSE. Returned is an envelope as defined here: diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go index a36146b82a..d04246747c 100644 --- a/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go +++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/dsse/verify.go @@ -43,7 +43,8 @@ func (ev *EnvelopeVerifier) Verify(ctx context.Context, e *Envelope) ([]Accepted // If *any* signature is found to be incorrect, it is skipped var acceptedKeys []AcceptedKey usedKeyids := make(map[string]string) - unverified_providers := ev.providers + unverified_providers := make([]Verifier, len(ev.providers)) + copy(unverified_providers, ev.providers) for _, s := range e.Signatures { sig, err := b64Decode(s.Sig) if err != nil { diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go index 578d6a5483..691091af99 100644 --- a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go +++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ecdsa.go @@ -11,7 +11,10 @@ import ( "os" ) -const ECDSAKeyType = "ecdsa" +const ( + ECDSAKeyType = "ecdsa" + ECDSAKeyScheme = "ecdsa-sha2-nistp256" +) // ECDSASignerVerifier is a dsse.SignerVerifier compliant interface to sign and // verify signatures using ECDSA keys. @@ -89,13 +92,18 @@ func (sv *ECDSASignerVerifier) Public() crypto.PublicKey { // LoadECDSAKeyFromFile returns an SSLibKey instance for an ECDSA key stored in // a file in the custom securesystemslib format. +// +// Deprecated: use LoadKey(). The custom serialization format has been +// deprecated. Use +// https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py +// to convert your key. func LoadECDSAKeyFromFile(path string) (*SSLibKey, error) { contents, err := os.ReadFile(path) if err != nil { return nil, fmt.Errorf("unable to load ECDSA key from file: %w", err) } - return loadKeyFromSSLibBytes(contents) + return LoadKeyFromSSLibBytes(contents) } func getECDSAHashedData(data []byte, curveSize int) []byte { diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go index c71d313a75..d954e14b74 100644 --- a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go +++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/ed25519.go @@ -88,11 +88,16 @@ func (sv *ED25519SignerVerifier) Public() crypto.PublicKey { // LoadED25519KeyFromFile returns an SSLibKey instance for an ED25519 key stored // in a file in the custom securesystemslib format. +// +// Deprecated: use LoadKey(). The custom serialization format has been +// deprecated. Use +// https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py +// to convert your key. func LoadED25519KeyFromFile(path string) (*SSLibKey, error) { contents, err := os.ReadFile(path) if err != nil { return nil, fmt.Errorf("unable to load ED25519 key from file: %w", err) } - return loadKeyFromSSLibBytes(contents) + return LoadKeyFromSSLibBytes(contents) } diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go index 3612f28a4b..2abfcb27c4 100644 --- a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go +++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/rsa.go @@ -94,12 +94,28 @@ func (sv *RSAPSSSignerVerifier) Public() crypto.PublicKey { // LoadRSAPSSKeyFromFile returns an SSLibKey instance for an RSA key stored in a // file. +// +// Deprecated: use LoadKey(). The custom serialization format has been +// deprecated. Use +// https://github.com/secure-systems-lab/securesystemslib/blob/main/docs/migrate_key.py +// to convert your key. func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) { contents, err := os.ReadFile(path) if err != nil { return nil, fmt.Errorf("unable to load RSA key from file: %w", err) } + return LoadRSAPSSKeyFromBytes(contents) +} + +// LoadRSAPSSKeyFromBytes is a function that takes a byte array as input. This +// byte array should represent a PEM encoded RSA key, as PEM encoding is +// required. The function returns an SSLibKey instance, which is a struct that +// holds the key data. +// +// Deprecated: use LoadKey() for all key types, RSA is no longer the only key +// that uses PEM serialization. +func LoadRSAPSSKeyFromBytes(contents []byte) (*SSLibKey, error) { pemData, keyObj, err := decodeAndParsePEM(contents) if err != nil { return nil, fmt.Errorf("unable to load RSA key from file: %w", err) @@ -112,20 +128,13 @@ func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) { KeyVal: KeyVal{}, } - switch k := keyObj.(type) { - case *rsa.PublicKey: - pubKeyBytes, err := x509.MarshalPKIXPublicKey(k) - if err != nil { - return nil, fmt.Errorf("unable to load RSA key from file: %w", err) - } - key.KeyVal.Public = strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))) + pubKeyBytes, err := marshalAndGeneratePEM(keyObj) + if err != nil { + return nil, fmt.Errorf("unable to load RSA key from file: %w", err) + } + key.KeyVal.Public = strings.TrimSpace(string(pubKeyBytes)) - case *rsa.PrivateKey: - pubKeyBytes, err := x509.MarshalPKIXPublicKey(k.Public()) - if err != nil { - return nil, fmt.Errorf("unable to load RSA key from file: %w", err) - } - key.KeyVal.Public = strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))) + if _, ok := keyObj.(*rsa.PrivateKey); ok { key.KeyVal.Private = strings.TrimSpace(string(generatePEMBlock(pemData.Bytes, RSAPrivateKeyPEM))) } @@ -139,3 +148,23 @@ func LoadRSAPSSKeyFromFile(path string) (*SSLibKey, error) { return key, nil } + +func marshalAndGeneratePEM(key interface{}) ([]byte, error) { + var pubKeyBytes []byte + var err error + + switch k := key.(type) { + case *rsa.PublicKey: + pubKeyBytes, err = x509.MarshalPKIXPublicKey(k) + case *rsa.PrivateKey: + pubKeyBytes, err = x509.MarshalPKIXPublicKey(k.Public()) + default: + return nil, fmt.Errorf("unexpected key type: %T", k) + } + + if err != nil { + return nil, err + } + + return generatePEMBlock(pubKeyBytes, PublicKeyPEM), nil +} diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/signerverifier.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/signerverifier.go index 5f510f7be5..3a8259dfda 100644 --- a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/signerverifier.go +++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/signerverifier.go @@ -1,7 +1,13 @@ package signerverifier import ( + "crypto/ecdsa" + "crypto/ed25519" + "crypto/rsa" + "crypto/x509" + "encoding/hex" "errors" + "strings" ) var KeyIDHashAlgorithms = []string{"sha256", "sha512"} @@ -12,6 +18,7 @@ var ( ErrUnknownKeyType = errors.New("unknown key type") ErrInvalidThreshold = errors.New("threshold is either less than 1 or greater than number of provided public keys") ErrInvalidKey = errors.New("key object has no value") + ErrInvalidPEM = errors.New("unable to parse PEM block") ) const ( @@ -29,6 +36,111 @@ type SSLibKey struct { type KeyVal struct { Private string `json:"private,omitempty"` - Public string `json:"public"` + Public string `json:"public,omitempty"` Certificate string `json:"certificate,omitempty"` + Identity string `json:"identity,omitempty"` + Issuer string `json:"issuer,omitempty"` +} + +// LoadKey returns an SSLibKey object when provided a PEM encoded key. +// Currently, RSA, ED25519, and ECDSA keys are supported. +func LoadKey(keyBytes []byte) (*SSLibKey, error) { + pemBlock, rawKey, err := decodeAndParsePEM(keyBytes) + if err != nil { + return nil, err + } + + var key *SSLibKey + switch k := rawKey.(type) { + case *rsa.PublicKey: + pubKeyBytes, err := x509.MarshalPKIXPublicKey(k) + if err != nil { + return nil, err + } + key = &SSLibKey{ + KeyIDHashAlgorithms: KeyIDHashAlgorithms, + KeyType: RSAKeyType, + KeyVal: KeyVal{ + Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))), + }, + Scheme: RSAKeyScheme, + } + + case *rsa.PrivateKey: + pubKeyBytes, err := x509.MarshalPKIXPublicKey(k.Public()) + if err != nil { + return nil, err + } + key = &SSLibKey{ + KeyIDHashAlgorithms: KeyIDHashAlgorithms, + KeyType: RSAKeyType, + KeyVal: KeyVal{ + Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))), + Private: strings.TrimSpace(string(generatePEMBlock(pemBlock.Bytes, pemBlock.Type))), + }, + Scheme: RSAKeyScheme, + } + + case ed25519.PublicKey: + key = &SSLibKey{ + KeyIDHashAlgorithms: KeyIDHashAlgorithms, + KeyType: ED25519KeyType, + KeyVal: KeyVal{ + Public: strings.TrimSpace(hex.EncodeToString(k)), + }, + Scheme: ED25519KeyType, + } + + case ed25519.PrivateKey: + pubKeyBytes := k.Public() + key = &SSLibKey{ + KeyIDHashAlgorithms: KeyIDHashAlgorithms, + KeyType: ED25519KeyType, + KeyVal: KeyVal{ + Public: strings.TrimSpace(hex.EncodeToString(pubKeyBytes.(ed25519.PublicKey))), + Private: strings.TrimSpace(hex.EncodeToString(k)), + }, + Scheme: ED25519KeyType, + } + + case *ecdsa.PublicKey: + pubKeyBytes, err := x509.MarshalPKIXPublicKey(k) + if err != nil { + return nil, err + } + key = &SSLibKey{ + KeyIDHashAlgorithms: KeyIDHashAlgorithms, + KeyType: ECDSAKeyType, + KeyVal: KeyVal{ + Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))), + }, + Scheme: ECDSAKeyScheme, + } + + case *ecdsa.PrivateKey: + pubKeyBytes, err := x509.MarshalPKIXPublicKey(k.Public()) + if err != nil { + return nil, err + } + key = &SSLibKey{ + KeyIDHashAlgorithms: KeyIDHashAlgorithms, + KeyType: ECDSAKeyType, + KeyVal: KeyVal{ + Public: strings.TrimSpace(string(generatePEMBlock(pubKeyBytes, PublicKeyPEM))), + Private: strings.TrimSpace(string(generatePEMBlock(pemBlock.Bytes, PrivateKeyPEM))), + }, + Scheme: ECDSAKeyScheme, + } + + default: + return nil, ErrUnknownKeyType + } + + keyID, err := calculateKeyID(key) + if err != nil { + return nil, err + } + key.KeyID = keyID + + return key, nil } diff --git a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/utils.go b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/utils.go index 73aaa77d46..cc0188be3e 100644 --- a/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/utils.go +++ b/vendor/github.com/secure-systems-lab/go-securesystemslib/signerverifier/utils.go @@ -8,7 +8,6 @@ import ( "encoding/pem" "errors" "hash" - "testing" "github.com/secure-systems-lab/go-securesystemslib/cjson" ) @@ -24,15 +23,17 @@ var ( ErrFailedPEMParsing = errors.New("failed parsing the PEM block: unsupported PEM type") ) -// loadKeyFromSSLibBytes returns a pointer to a Key instance created from the +// LoadKeyFromSSLibBytes returns a pointer to a Key instance created from the // contents of the bytes. The key contents are expected to be in the custom // securesystemslib format. -func loadKeyFromSSLibBytes(contents []byte) (*SSLibKey, error) { +// +// Deprecated: use LoadKey() for all key types, RSA is no longer the only key +// that uses PEM serialization. +func LoadKeyFromSSLibBytes(contents []byte) (*SSLibKey, error) { var key *SSLibKey if err := json.Unmarshal(contents, &key); err != nil { - return nil, err + return LoadRSAPSSKeyFromBytes(contents) } - if len(key.KeyID) == 0 { keyID, err := calculateKeyID(key) if err != nil { @@ -139,12 +140,3 @@ func hashBeforeSigning(data []byte, h hash.Hash) []byte { h.Write(data) return h.Sum(nil) } - -func hexDecode(t *testing.T, data string) []byte { - t.Helper() - b, err := hex.DecodeString(data) - if err != nil { - t.Fatal(err) - } - return b -} diff --git a/vendor/modules.txt b/vendor/modules.txt index 9b93df396b..7d5a838b50 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1228,8 +1228,8 @@ github.com/sasha-s/go-deadlock # github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 ## explicit github.com/sean-/seed -# github.com/secure-systems-lab/go-securesystemslib v0.6.0 -## explicit; go 1.20 +# github.com/secure-systems-lab/go-securesystemslib v0.9.1 +## explicit; go 1.23.0 github.com/secure-systems-lab/go-securesystemslib/cjson github.com/secure-systems-lab/go-securesystemslib/dsse github.com/secure-systems-lab/go-securesystemslib/signerverifier