fetch Rekor before cosign validation

Signed-off-by: Matthias Bertschy <[email protected]>
RalphHightower · Jan 15, 2024 · 6a6e418 · 6a6e418
1 parent 5e41d7d
commit 6a6e418
Show file tree

Hide file tree

Showing 2 changed files with 60 additions and 41 deletions.
diff --git a/core/pkg/opaprocessor/cosign_verify.go b/core/pkg/opaprocessor/cosign_verify.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"crypto"
 	"fmt"
-
 	"github.com/google/go-containerregistry/pkg/name"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/options"
 	"github.com/sigstore/cosign/v2/cmd/cosign/cli/sign"
@@ -67,6 +66,11 @@ func verify(img string, key string) (bool, error) {
 		return false, fmt.Errorf("resolving attachment type %s for image %s: %w", attachment, img, err)
 	}
 
+	co.RekorPubKeys, err = cosign.GetRekorPubs(context.Background())
+	if err != nil {
+		return false, fmt.Errorf("getting Rekor public keys: %w", err)
+	}
+
 	_, _, err = cosign.VerifyImageSignatures(context.TODO(), ref, co)
 	if err != nil {
 		return false, fmt.Errorf("verifying signature: %w", err)

diff --git a/core/pkg/opaprocessor/cosign_verify_test.go b/core/pkg/opaprocessor/cosign_verify_test.go
@@ -1,42 +1,57 @@
 package opaprocessor
 
-// func Test_verify(t *testing.T) {
-// 	type args struct {
-// 		img string
-// 		key string
-// 	}
-// 	tests := []struct {
-// 		name    string
-// 		args    args
-// 		want    bool
-// 		wantErr assert.ErrorAssertionFunc
-// 	}{
-// 		{
-// 			"valid signature",
-// 			args{
-// 				img: "hisu/cosign-tests:signed",
-// 				key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGnMCUU0jGe6r4mPsPuyTXf61PE4e\nNwB/31SvUMmnoyd/1UxSqd+MRPXPU6pcub4k6E9G9SprVCuf6Sydcbyiqw==\n-----END PUBLIC KEY-----",
-// 			},
-// 			true,
-// 			assert.NoError,
-// 		},
-// 		{
-// 			"no signature",
-// 			args{
-// 				img: "hisu/cosign-tests:unsigned",
-// 				key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGnMCUU0jGe6r4mPsPuyTXf61PE4e\nNwB/31SvUMmnoyd/1UxSqd+MRPXPU6pcub4k6E9G9SprVCuf6Sydcbyiqw==\n-----END PUBLIC KEY-----",
-// 			},
-// 			false,
-// 			assert.Error,
-// 		},
-// 	}
-// 	for _, tt := range tests {
-// 		t.Run(tt.name, func(t *testing.T) {
-// 			got, err := verify(tt.args.img, tt.args.key)
-// 			if !tt.wantErr(t, err, fmt.Sprintf("verify(%v, %v)", tt.args.img, tt.args.key)) {
-// 				return
-// 			}
-// 			assert.Equalf(t, tt.want, got, "verify(%v, %v)", tt.args.img, tt.args.key)
-// 		})
-// 	}
-// }
+import (
+	"fmt"
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+func Test_verify(t *testing.T) {
+	type args struct {
+		img string
+		key string
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    bool
+		wantErr assert.ErrorAssertionFunc
+	}{
+		{
+			"valid signature",
+			args{
+				img: "quay.io/kubescape/kubescape:v3.0.3",
+				key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbgIMZrMTTlEFDLEeZXz+4R/908BG\nEeO70x6oMN7E4JQgzgbCB5rinqhK5t7dB61saVKQTb4P2NGtjPjXVbSTwQ==\n-----END PUBLIC KEY-----\n",
+			},
+			true,
+			assert.NoError,
+		},
+		{
+			"wrong signature",
+			args{
+				img: "quay.io/kubescape/kubescape:v2.9.2",
+				key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbgIMZrMTTlEFDLEeZXz+4R/908BG\nEeO70x6oMN7E4JQgzgbCB5rinqhK5t7dB61saVKQTb4P2NGtjPjXVbSTwQ==\n-----END PUBLIC KEY-----\n",
+			},
+			false,
+			assert.Error,
+		},
+		{
+			"no matching signature",
+			args{
+				img: "quay.io/kubescape/kubescape:v2.0.171",
+				key: "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbgIMZrMTTlEFDLEeZXz+4R/908BG\nEeO70x6oMN7E4JQgzgbCB5rinqhK5t7dB61saVKQTb4P2NGtjPjXVbSTwQ==\n-----END PUBLIC KEY-----\n",
+			},
+			false,
+			assert.Error,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := verify(tt.args.img, tt.args.key)
+			if !tt.wantErr(t, err, fmt.Sprintf("verify(%v, %v)", tt.args.img, tt.args.key)) {
+				return
+			}
+			assert.Equalf(t, tt.want, got, "verify(%v, %v)", tt.args.img, tt.args.key)
+		})
+	}
+}