Skip to content

Commit d16e3a0

Browse files
simonbairdsimonbaird
authored
Merge pull request #3218 from SequeI/rekorFix
fix: use TrustedRoot from TUF cache for key-based verification
2 parents 6ce45d2 + f5e7a9c commit d16e3a0

7 files changed

Lines changed: 30 additions & 36 deletions

File tree

‎acceptance/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ require (
8484
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
8585
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
8686
github.com/distribution/reference v0.6.0 // indirect
87-
github.com/docker/cli v29.0.3+incompatible // indirect
87+
github.com/docker/cli v29.3.1+incompatible // indirect
8888
github.com/docker/distribution v2.8.3+incompatible // indirect
8989
github.com/docker/docker v28.3.3+incompatible // indirect
9090
github.com/docker/docker-credential-helpers v0.9.4 // indirect

‎acceptance/go.sum‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -166,8 +166,6 @@ github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMn
166166
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
167167
github.com/cloudevents/sdk-go/v2 v2.15.2 h1:54+I5xQEnI73RBhWHxbI1XJcqOFOVJN85vb41+8mHUc=
168168
github.com/cloudevents/sdk-go/v2 v2.15.2/go.mod h1:lL7kSWAE/V8VI4Wh0jbL2v/jvqsm6tjmaQBSvxcv4uE=
169-
github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
170-
github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
171169
github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
172170
github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
173171
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -226,8 +224,8 @@ github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 h1:lxmTCgmHE1G
226224
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7/go.mod h1:GvWntX9qiTlOud0WkQ6ewFm0LPy5JUR1Xo0Ngbd1w6Y=
227225
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
228226
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
229-
github.com/docker/cli v29.0.3+incompatible h1:8J+PZIcF2xLd6h5sHPsp5pvvJA+Sr2wGQxHkRl53a1E=
230-
github.com/docker/cli v29.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
227+
github.com/docker/cli v29.3.1+incompatible h1:M04FDj2TRehDacrosh7Vlkgc7AuQoWloQkf1PA5hmoI=
228+
github.com/docker/cli v29.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
231229
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
232230
github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
233231
github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
@@ -284,14 +282,10 @@ github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8b
284282
github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
285283
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
286284
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
287-
github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
288-
github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
289285
github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
290286
github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
291287
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
292288
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
293-
github.com/go-git/go-git/v5 v5.16.5 h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s=
294-
github.com/go-git/go-git/v5 v5.16.5/go.mod h1:QOMLpNf1qxuSY4StA/ArOdfFR2TrKEjJiye2kel2m+M=
295289
github.com/go-git/go-git/v5 v5.17.1 h1:WnljyxIzSj9BRRUlnmAU35ohDsjRK0EKmL0evDqi5Jk=
296290
github.com/go-git/go-git/v5 v5.17.1/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
297291
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ require (
182182
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
183183
github.com/dimchansky/utfbom v1.1.1 // indirect
184184
github.com/distribution/reference v0.6.0 // indirect
185-
github.com/docker/cli v29.0.3+incompatible // indirect
185+
github.com/docker/cli v29.3.1+incompatible // indirect
186186
github.com/docker/distribution v2.8.3+incompatible // indirect
187187
github.com/docker/docker-credential-helpers v0.9.4 // indirect
188188
github.com/docker/go-connections v0.5.0 // indirect

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -416,8 +416,8 @@ github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi
416416
github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
417417
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
418418
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
419-
github.com/docker/cli v29.0.3+incompatible h1:8J+PZIcF2xLd6h5sHPsp5pvvJA+Sr2wGQxHkRl53a1E=
420-
github.com/docker/cli v29.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
419+
github.com/docker/cli v29.3.1+incompatible h1:M04FDj2TRehDacrosh7Vlkgc7AuQoWloQkf1PA5hmoI=
420+
github.com/docker/cli v29.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
421421
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
422422
github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
423423
github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=

‎internal/policy/policy.go‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -459,32 +459,32 @@ func checkOpts(ctx context.Context, p *policy) (*cosign.CheckOpts, error) {
459459
log.Debug("Using keyless workflow")
460460
log.Debugf("TUF_ROOT=%s", os.Getenv("TUF_ROOT"))
461461
opts.Identities = []cosign.Identity{p.identity}
462+
}
462463

463-
if !hasSigstoreEnvOverrides() {
464-
if trustedRoot, trErr := cosign.TrustedRoot(); trErr == nil {
465-
log.Debug("Using trusted root from TUF for verification")
466-
opts.TrustedMaterial = trustedRoot
467-
} else {
468-
log.Debugf("Could not fetch trusted_root.json from TUF, falling back to individual targets: %v", trErr)
469-
}
464+
if !hasSigstoreEnvOverrides() {
465+
if trustedRoot, trErr := cosign.TrustedRoot(); trErr == nil {
466+
log.Debug("Using trusted root from TUF for verification")
467+
opts.TrustedMaterial = trustedRoot
470468
} else {
471-
log.Debug("Sigstore env overrides detected, skipping trusted root from TUF")
469+
log.Debugf("Could not fetch trusted_root.json from TUF, falling back to individual targets: %v", trErr)
472470
}
471+
} else {
472+
log.Debug("Sigstore env overrides detected, skipping trusted root from TUF")
473+
}
473474

474-
if opts.TrustedMaterial == nil {
475-
if opts.RootCerts, err = fulcio.GetRoots(); err != nil {
476-
return nil, err
477-
}
478-
log.Debug("Fetched Fulcio root certificates")
479-
if opts.IntermediateCerts, err = fulcio.GetIntermediates(); err != nil {
480-
return nil, err
481-
}
482-
log.Debug("Fetched Fulcio intermediate certificates")
483-
if opts.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx); err != nil {
484-
return nil, err
485-
}
486-
log.Debug("Fetched CT log public keys")
475+
if p.PublicKey == "" && opts.TrustedMaterial == nil {
476+
if opts.RootCerts, err = fulcio.GetRoots(); err != nil {
477+
return nil, err
478+
}
479+
log.Debug("Fetched Fulcio root certificates")
480+
if opts.IntermediateCerts, err = fulcio.GetIntermediates(); err != nil {
481+
return nil, err
482+
}
483+
log.Debug("Fetched Fulcio intermediate certificates")
484+
if opts.CTLogPubKeys, err = cosign.GetCTLogPubs(ctx); err != nil {
485+
return nil, err
487486
}
487+
log.Debug("Fetched CT log public keys")
488488
}
489489

490490
opts.IgnoreTlog = p.ignoreRekor

‎tools/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ require (
177177
github.com/dimchansky/utfbom v1.1.1 // indirect
178178
github.com/distribution/reference v0.6.0 // indirect
179179
github.com/dnephin/pflag v1.0.7 // indirect
180-
github.com/docker/cli v28.2.2+incompatible // indirect
180+
github.com/docker/cli v29.3.1+incompatible // indirect
181181
github.com/docker/distribution v2.8.3+incompatible // indirect
182182
github.com/docker/docker v28.2.2+incompatible // indirect
183183
github.com/docker/docker-credential-helpers v0.9.3 // indirect

‎tools/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -494,8 +494,8 @@ github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxK
494494
github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
495495
github.com/dnephin/pflag v1.0.7 h1:oxONGlWxhmUct0YzKTgrpQv9AUA1wtPBn7zuSjJqptk=
496496
github.com/dnephin/pflag v1.0.7/go.mod h1:uxE91IoWURlOiTUIA8Mq5ZZkAv3dPUfZNaT80Zm7OQE=
497-
github.com/docker/cli v28.2.2+incompatible h1:qzx5BNUDFqlvyq4AHzdNB7gSyVTmU4cgsyN9SdInc1A=
498-
github.com/docker/cli v28.2.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
497+
github.com/docker/cli v29.3.1+incompatible h1:M04FDj2TRehDacrosh7Vlkgc7AuQoWloQkf1PA5hmoI=
498+
github.com/docker/cli v29.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
499499
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
500500
github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
501501
github.com/docker/docker v28.2.2+incompatible h1:CjwRSksz8Yo4+RmQ339Dp/D2tGO5JxwYeqtMOEe0LDw=

0 commit comments

Comments
 (0)