Skip to content

Commit 830edf8

Browse files
rdimitrovkommendorkapten
rdimitrov
and
kommendorkapten
authored
Use the correct verifier for RSA PSS scheme keys (#625)
* Explicitly use LoadRSAPSSVerifier for RSASSA_PSS_SHA256 keys Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * Update the basic_repository.go example to work with RSA PSS key scheme Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * added a simple tool that can resign test metadata and updated signatures to be pss and not pkcs1 v1.5 Signed-off-by: Fredrik Skogman <kommendorkapten@github.com> * Fixed failing unit tests Signed-off-by: Fredrik Skogman <kommendorkapten@github.com> --------- Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> Signed-off-by: Fredrik Skogman <kommendorkapten@github.com> Co-authored-by: Fredrik Skogman <kommendorkapten@github.com>
1 parent 58fd627 commit 830edf8

File tree

10 files changed

+475
-206
lines changed

10 files changed

+475
-206
lines changed

‎examples/repository/basic_repository.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -499,7 +499,9 @@ func main() {
499499

500500
// Use a mixture of key types
501501
// ==========================
502-
// Create an RSA key
502+
// Create an RSA key.
503+
// Note TUF should use an RSA PSS key scheme, not RSA PKCS1v15.
504+
// Reference: https://theupdateframework.github.io/specification/latest/#file-formats-keys
503505
anotherRootKeyRSA, _ := rsa.GenerateKey(rand.Reader, 2048)
504506
if err != nil {
505507
panic(fmt.Sprintln("basic_repository.go:", "RSA key generation failed", err))
@@ -549,7 +551,7 @@ func main() {
549551
}
550552

551553
// Sign root with the new RSA and ECDSA keys
552-
outofbandSignerRSA, err := signature.LoadSigner(anotherRootKeyRSA, crypto.SHA256)
554+
outofbandSignerRSA, err := signature.LoadRSAPSSSigner(anotherRootKeyRSA, crypto.SHA256, &rsa.PSSOptions{Hash: crypto.SHA256})
553555
if err != nil {
554556
panic(fmt.Sprintln("basic_repository.go:", "loading RSA signer failed", err))
555557
}

‎internal/testutils/repository_data/repository/metadata/root.json

Lines changed: 69 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,71 @@
11
{
2-
"signatures": [
3-
{
4-
"keyid": "74b58be26a6ff00ab2eec9b14da29038591a69c212223033f4efdf24489913f2",
5-
"sig": "d0283ac0653e324ce132e47a518f8a1539b59430efe5cdec58ec53f824bec28628b57dd5fb2452bde83fc8f5d11ab0b7350a9bbcbefc7acc6c447785545fa1e36f1352c9e20dd1ebcc3ab16a2a7ff702e32e481ceba88e0f348dc2cddd26ca577445d00c7194e8656d901fd2382c479555af93a64eef48cf79cdff6ecdcd7cb7"
6-
}
7-
],
8-
"signed": {
9-
"_type": "root",
10-
"consistent_snapshot": true,
11-
"expires": "2030-08-15T14:30:45.0000001Z",
12-
"keys": {
13-
"142919f8e933d7045abff3be450070057814da36331d7a22ccade8b35a9e3946": {
14-
"keytype": "rsa",
15-
"keyval": {
16-
"public": "-----BEGIN PUBLIC KEY-----\nMIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgHXjYnWGuCIOh5T3XGmgG/RsXWHP\nTbyu7OImP6O+uHg8hui8C1nY/mcJdFdxqgl1vKEco/Nwebh2T8L6XbNfcgV9VVst\nWpeCalZYWi55lZSLe9KixQIAyg15rNdhN9pcD3OuLmFvslgTx+dTbZ3ZoYMbcb4C\n5yqvqzcOoCTQMeWbAgMBAAE=\n-----END PUBLIC KEY-----\n"
17-
},
18-
"scheme": "rsassa-pss-sha256"
19-
},
20-
"282612f348dcd7fe3f19e0f890e89fad48d45335deeb91deef92873934e6fe6d": {
21-
"keytype": "rsa",
22-
"keyval": {
23-
"public": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjm6HPktvTGsygQ8Gvmu+zydTN\ne1zqoxLxV7mVRbmsCI4kn7JTHc4fmWZwvo7f/Wbto6Xj5HqGJFSlYIGZuTwZqPg3\nw8wqv8cuPxbmsFSxMoHfzBBIuJe0FlwXFysojbdhrSUqNL84tlwTFXEhePYrpTNM\nDn+9T55B0WJYT/VPxwIDAQAB\n-----END PUBLIC KEY-----\n"
24-
},
25-
"scheme": "rsassa-pss-sha256"
26-
},
27-
"74b58be26a6ff00ab2eec9b14da29038591a69c212223033f4efdf24489913f2": {
28-
"keytype": "rsa",
29-
"keyval": {
30-
"public": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDydf/VEpxBOCDoxpM6IVhq9i67\nP9BiVv2zwZSUO/M0RTToAvFvNgDKXwtnp8LyjVk++wMA1aceMa+pS7vYrKvPIJa7\nWIT+mwy86/fIdnllJDMw5tmLr2mE3oBMxOhpEiD2tO+liGacklFNk6nHHorX9S91\niqpdRVa3zJw5ALvLdwIDAQAB\n-----END PUBLIC KEY-----\n"
31-
},
32-
"scheme": "rsassa-pss-sha256"
33-
},
34-
"8a14f637b21578cc292a67899df0e46cc160d7fd56e9beae898adb666f4fd9d6": {
35-
"keytype": "rsa",
36-
"keyval": {
37-
"public": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCPQoHresXRRRGoinN3bNn+BI23\nKolXdXLGqYkTvr9AjemUQJxbqmvZXHboQMAYw8OuBrRNt5Fz20wjsrJwOBEU5U3n\nHSJI4zYPGckYci0/0Eo2Kjws5BmIj38qgIfhsH4zyZ4FZZ+GLRn+W3i3wl6SfRMC\n/HCg0DDwi75faC0vGQIDAQAB\n-----END PUBLIC KEY-----\n"
38-
},
39-
"scheme": "rsassa-pss-sha256"
40-
}
41-
},
42-
"roles": {
43-
"root": {
44-
"keyids": [
45-
"74b58be26a6ff00ab2eec9b14da29038591a69c212223033f4efdf24489913f2"
46-
],
47-
"threshold": 1
48-
},
49-
"snapshot": {
50-
"keyids": [
51-
"8a14f637b21578cc292a67899df0e46cc160d7fd56e9beae898adb666f4fd9d6"
52-
],
53-
"threshold": 1
54-
},
55-
"targets": {
56-
"keyids": [
57-
"282612f348dcd7fe3f19e0f890e89fad48d45335deeb91deef92873934e6fe6d"
58-
],
59-
"threshold": 1
60-
},
61-
"timestamp": {
62-
"keyids": [
63-
"142919f8e933d7045abff3be450070057814da36331d7a22ccade8b35a9e3946"
64-
],
65-
"threshold": 1
66-
}
67-
},
68-
"spec_version": "1.0.31",
69-
"version": 1
70-
}
2+
"signatures": [
3+
{
4+
"keyid": "74b58be26a6ff00ab2eec9b14da29038591a69c212223033f4efdf24489913f2",
5+
"sig": "60d502a798f44577a76a1d7656a60099cd3a995d3d71a0a234aadbd16e38c14611920b8aef9ed78ca4ac0c02277cd72a6fc5ef484a3d66a6c70a61199e462681eb2e667046d4fbc2be1e50cf9fe00fda8fcd6534599eddc91716bf38e7fbbf375524fdb702c74076fd37dcd401d5263783150e851bdba9ef6f9c9a08adf6b289"
6+
}
7+
],
8+
"signed": {
9+
"_type": "root",
10+
"consistent_snapshot": true,
11+
"expires": "2030-08-15T14:30:45.0000001Z",
12+
"keys": {
13+
"142919f8e933d7045abff3be450070057814da36331d7a22ccade8b35a9e3946": {
14+
"keytype": "rsa",
15+
"keyval": {
16+
"public": "-----BEGIN PUBLIC KEY-----\nMIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgHXjYnWGuCIOh5T3XGmgG/RsXWHP\nTbyu7OImP6O+uHg8hui8C1nY/mcJdFdxqgl1vKEco/Nwebh2T8L6XbNfcgV9VVst\nWpeCalZYWi55lZSLe9KixQIAyg15rNdhN9pcD3OuLmFvslgTx+dTbZ3ZoYMbcb4C\n5yqvqzcOoCTQMeWbAgMBAAE=\n-----END PUBLIC KEY-----\n"
17+
},
18+
"scheme": "rsassa-pss-sha256"
19+
},
20+
"282612f348dcd7fe3f19e0f890e89fad48d45335deeb91deef92873934e6fe6d": {
21+
"keytype": "rsa",
22+
"keyval": {
23+
"public": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjm6HPktvTGsygQ8Gvmu+zydTN\ne1zqoxLxV7mVRbmsCI4kn7JTHc4fmWZwvo7f/Wbto6Xj5HqGJFSlYIGZuTwZqPg3\nw8wqv8cuPxbmsFSxMoHfzBBIuJe0FlwXFysojbdhrSUqNL84tlwTFXEhePYrpTNM\nDn+9T55B0WJYT/VPxwIDAQAB\n-----END PUBLIC KEY-----\n"
24+
},
25+
"scheme": "rsassa-pss-sha256"
26+
},
27+
"74b58be26a6ff00ab2eec9b14da29038591a69c212223033f4efdf24489913f2": {
28+
"keytype": "rsa",
29+
"keyval": {
30+
"public": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDydf/VEpxBOCDoxpM6IVhq9i67\nP9BiVv2zwZSUO/M0RTToAvFvNgDKXwtnp8LyjVk++wMA1aceMa+pS7vYrKvPIJa7\nWIT+mwy86/fIdnllJDMw5tmLr2mE3oBMxOhpEiD2tO+liGacklFNk6nHHorX9S91\niqpdRVa3zJw5ALvLdwIDAQAB\n-----END PUBLIC KEY-----\n"
31+
},
32+
"scheme": "rsassa-pss-sha256"
33+
},
34+
"8a14f637b21578cc292a67899df0e46cc160d7fd56e9beae898adb666f4fd9d6": {
35+
"keytype": "rsa",
36+
"keyval": {
37+
"public": "-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCPQoHresXRRRGoinN3bNn+BI23\nKolXdXLGqYkTvr9AjemUQJxbqmvZXHboQMAYw8OuBrRNt5Fz20wjsrJwOBEU5U3n\nHSJI4zYPGckYci0/0Eo2Kjws5BmIj38qgIfhsH4zyZ4FZZ+GLRn+W3i3wl6SfRMC\n/HCg0DDwi75faC0vGQIDAQAB\n-----END PUBLIC KEY-----\n"
38+
},
39+
"scheme": "rsassa-pss-sha256"
40+
}
41+
},
42+
"roles": {
43+
"root": {
44+
"keyids": [
45+
"74b58be26a6ff00ab2eec9b14da29038591a69c212223033f4efdf24489913f2"
46+
],
47+
"threshold": 1
48+
},
49+
"snapshot": {
50+
"keyids": [
51+
"8a14f637b21578cc292a67899df0e46cc160d7fd56e9beae898adb666f4fd9d6"
52+
],
53+
"threshold": 1
54+
},
55+
"targets": {
56+
"keyids": [
57+
"282612f348dcd7fe3f19e0f890e89fad48d45335deeb91deef92873934e6fe6d"
58+
],
59+
"threshold": 1
60+
},
61+
"timestamp": {
62+
"keyids": [
63+
"142919f8e933d7045abff3be450070057814da36331d7a22ccade8b35a9e3946"
64+
],
65+
"threshold": 1
66+
}
67+
},
68+
"spec_version": "1.0.31",
69+
"version": 1
70+
}
7171
}

‎internal/testutils/repository_data/repository/metadata/snapshot.json

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
11
{
2-
"signatures": [
3-
{
4-
"keyid": "8a14f637b21578cc292a67899df0e46cc160d7fd56e9beae898adb666f4fd9d6",
5-
"sig": "3075fe9ef3008603eb0531500a93101b8f7eb52b07ce63fb71abaffd5eb20784bcab888abfca8041798b13dd35c6e18ff4a64d536161c4d5e7535f006edec3a46c71684a632269222da82d50bf380e20eb477032e45df0b44af9e1dc46f25cd72f9901b4fc41b90869649b6257a66188b61b83c7295baf16f113e9cc4d39b3a6"
6-
}
7-
],
8-
"signed": {
9-
"_type": "snapshot",
10-
"expires": "2030-08-15T14:30:45.0000001Z",
11-
"meta": {
12-
"role1.json": {
13-
"version": 1
14-
},
15-
"role2.json": {
16-
"version": 1
17-
},
18-
"targets.json": {
19-
"version": 1
20-
}
21-
},
22-
"spec_version": "1.0.31",
23-
"version": 1
24-
}
2+
"signatures": [
3+
{
4+
"keyid": "8a14f637b21578cc292a67899df0e46cc160d7fd56e9beae898adb666f4fd9d6",
5+
"sig": "1fdc41488f58482d8af1dad681b9076d54c61b3f5e11bd6cf3c8102b2863471f82c0be2cccd978a9bb6afb43e07dd7e806028a883eaeafd32d5f5277d6419363ecb1475286a61996a4bb4b325b703d3bd60381227af0a3826f7f119a451086bcb5b13a525184d1b2a941ab9a270d2c9c8e584162c5857b138a38c33892e2a921"
6+
}
7+
],
8+
"signed": {
9+
"_type": "snapshot",
10+
"expires": "2030-08-15T14:30:45.0000001Z",
11+
"meta": {
12+
"role1.json": {
13+
"version": 1
14+
},
15+
"role2.json": {
16+
"version": 1
17+
},
18+
"targets.json": {
19+
"version": 1
20+
}
21+
},
22+
"spec_version": "1.0.31",
23+
"version": 1
24+
}
2525
}

‎internal/testutils/repository_data/repository/metadata/targets.json

Lines changed: 48 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,50 @@
11
{
2-
"signatures": [
3-
{
4-
"keyid": "282612f348dcd7fe3f19e0f890e89fad48d45335deeb91deef92873934e6fe6d",
5-
"sig": "80cd125a4b128c9508df8bc6f71ad2ed9896a9e7afccd53fca9e7dbc2f02db69c3ae712234d3730c929d891fa035bdf059736e7debf62cbac6f0e8d22ab0c5de3b3e47b249eb0d41dea66d9fda9588893cde824a95614129263b6fed72fafb21cd7114e603fe3a30e3871e9eb5b5029e3e9a8353190f1bcb332a81ec211a93eb"
6-
}
7-
],
8-
"signed": {
9-
"_type": "targets",
10-
"delegations": {
11-
"keys": {
12-
"c8022fa1e9b9cb239a6b362bbdffa9649e61ad2cb699d2e4bc4fdf7930a0e64a": {
13-
"keyid_hash_algorithms": [
14-
"sha256",
15-
"sha512"
16-
],
17-
"keytype": "ed25519",
18-
"keyval": {
19-
"public": "fcf224e55fa226056adf113ef1eb3d55e308b75b321c8c8316999d8c4fd9e0d9"
20-
},
21-
"scheme": "ed25519"
22-
}
23-
},
24-
"roles": [
25-
{
26-
"keyids": [
27-
"c8022fa1e9b9cb239a6b362bbdffa9649e61ad2cb699d2e4bc4fdf7930a0e64a"
28-
],
29-
"name": "role1",
30-
"paths": [
31-
"file3.txt"
32-
],
33-
"terminating": false,
34-
"threshold": 1
35-
}
36-
]
37-
},
38-
"expires": "2030-08-15T14:30:45.0000001Z",
39-
"spec_version": "1.0.31",
40-
"targets": {
41-
"file1.txt": {
42-
"hashes": {
43-
"sha256": "65b8c67f51c993d898250f40aa57a317d854900b3a04895464313e48785440da"
44-
},
45-
"length": 31
46-
}
47-
},
48-
"version": 1
49-
}
2+
"signatures": [
3+
{
4+
"keyid": "282612f348dcd7fe3f19e0f890e89fad48d45335deeb91deef92873934e6fe6d",
5+
"sig": "699c0c762032f6471fceabfd2d61b80f352ad6bf2ba5fd7b114fd0b9b1ab8d94f1482776b3fef43c53183a9c9cd7f5de671cbdafdd5032bbe2c42273e953bf3ce9f99c2d46dac8802d6155082e10313e22c4886af2be113b626f2a8af930e01ed41df50a5dbe6ca4cedf5f5d2a7f3b7e7090abacc8aebd6e021ad021d3580cad"
6+
}
7+
],
8+
"signed": {
9+
"_type": "targets",
10+
"delegations": {
11+
"keys": {
12+
"c8022fa1e9b9cb239a6b362bbdffa9649e61ad2cb699d2e4bc4fdf7930a0e64a": {
13+
"keyid_hash_algorithms": [
14+
"sha256",
15+
"sha512"
16+
],
17+
"keytype": "ed25519",
18+
"keyval": {
19+
"public": "fcf224e55fa226056adf113ef1eb3d55e308b75b321c8c8316999d8c4fd9e0d9"
20+
},
21+
"scheme": "ed25519"
22+
}
23+
},
24+
"roles": [
25+
{
26+
"keyids": [
27+
"c8022fa1e9b9cb239a6b362bbdffa9649e61ad2cb699d2e4bc4fdf7930a0e64a"
28+
],
29+
"name": "role1",
30+
"paths": [
31+
"file3.txt"
32+
],
33+
"terminating": false,
34+
"threshold": 1
35+
}
36+
]
37+
},
38+
"expires": "2030-08-15T14:30:45.0000001Z",
39+
"spec_version": "1.0.31",
40+
"targets": {
41+
"file1.txt": {
42+
"hashes": {
43+
"sha256": "65b8c67f51c993d898250f40aa57a317d854900b3a04895464313e48785440da"
44+
},
45+
"length": 31
46+
}
47+
},
48+
"version": 1
49+
}
5050
}

‎internal/testutils/repository_data/repository/metadata/timestamp.json

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
{
2-
"signatures": [
3-
{
4-
"keyid": "142919f8e933d7045abff3be450070057814da36331d7a22ccade8b35a9e3946",
5-
"sig": "639c9ce3dbb705265b5e9ad6d67fea2b38780c48ff7917e372adace8e50a7a2f054383d5960457a113059be521b8ce7e6d8a5787c600c4850b8c0ed1ae17a931a6bfe794476e7824c6f53df5232561e0a2e146b11dde7889b397c6f8136e2105bbb21b4b59b5addc032a0e755d97e531255f3b458d474184168541e542626e81"
6-
}
7-
],
8-
"signed": {
9-
"_type": "timestamp",
10-
"expires": "2030-08-15T14:30:45.0000001Z",
11-
"meta": {
12-
"snapshot.json": {
13-
"version": 1
14-
}
15-
},
16-
"spec_version": "1.0.31",
17-
"version": 1
18-
}
2+
"signatures": [
3+
{
4+
"keyid": "142919f8e933d7045abff3be450070057814da36331d7a22ccade8b35a9e3946",
5+
"sig": "043b312da9ee1444e3ef539d943891b2690a8d75624c0f05ec148790fd698a7eb1501428167872794857e9669a451619cc796658782b1d46ecc59d1aca0db7233416e81074ef4f54fd845ad8e4216b4cd5163d815be9ecbf73f34aacd25b60c99da88cf641ba5715c37f34a6bc036061c05a42066f554714ee8647c47ae5c16e"
6+
}
7+
],
8+
"signed": {
9+
"_type": "timestamp",
10+
"expires": "2030-08-15T14:30:45.0000001Z",
11+
"meta": {
12+
"snapshot.json": {
13+
"version": 1
14+
}
15+
},
16+
"spec_version": "1.0.31",
17+
"version": 1
18+
}
1919
}

‎internal/testutils/rsapss/signer.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
package rsapss
2+
3+
import (
4+
"crypto"
5+
"crypto/rsa"
6+
"crypto/x509"
7+
"encoding/pem"
8+
"errors"
9+
"os"
10+
11+
"github.com/sigstore/sigstore/pkg/signature"
12+
"github.com/sigstore/sigstore/pkg/signature/options"
13+
)
14+
15+
func LoadRSAPSSSignerFromPEMFile(p string) (signature.Signer, error) {
16+
var b []byte
17+
var block *pem.Block
18+
var pk any
19+
var err error
20+
21+
if b, err = os.ReadFile(p); err != nil {
22+
return nil, err
23+
}
24+
25+
if block, _ = pem.Decode(b); len(block.Bytes) == 0 {
26+
return nil, errors.New("empty PEM block")
27+
}
28+
29+
if pk, err = x509.ParsePKCS1PrivateKey(block.Bytes); err != nil {
30+
return nil, err
31+
}
32+
var pssOpt = rsa.PSSOptions{Hash: crypto.SHA256}
33+
34+
return signature.LoadSignerWithOpts(pk, options.WithRSAPSS(&pssOpt))
35+
}

0 commit comments

Comments
 (0)