Skip to content

Commit

Permalink
Merge pull request #1 from mutantmonkey/native_verify_attestation
Browse files Browse the repository at this point in the history 
autosign: implement native Go attestation check
  • Loading branch information
@mutantmonkey
mutantmonkey authored Nov 23, 2024
2 parents 7c93a7e + db39427 commit fc5fd95
Show file tree
Hide file tree
Showing 7 changed files with 700 additions and 35 deletions.
11 changes: 5 additions & 6 deletions autosign/cmd/autosign-receiver/process.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,10 @@ import (
"os/exec"
"path/filepath"

"github.com/google/go-github/v66/github"
"github.com/minio/minio-go/v7"
"github.com/minio/minio-go/v7/pkg/credentials"
"mutantmonkey.in/code/geschenkerbauer/autosign/internal/attestation"
"mutantmonkey.in/code/geschenkerbauer/autosign/internal/fshelpers"
)

Expand Down Expand Up @@ -55,7 +57,6 @@ func ProcessIncoming(config Config) error {
}
}

repo := fmt.Sprintf("%s/%s", config.GitHub.Owner, config.GitHub.Repo)
fileSystem := os.DirFS(config.IncomingDir)

files, err := fs.Glob(fileSystem, "*.pkg.tar.zst")
Expand All @@ -80,10 +81,8 @@ func ProcessIncoming(config Config) error {
}

// verify attestation
cmd := exec.Command("gh", "attestation", "verify", incomingFilepath, "-R", repo)
cmd.Env = os.Environ()
cmd.Env = append(cmd.Env, fmt.Sprintf("GH_TOKEN=%s", config.GitHub.AuthToken))
if err := cmd.Run(); err != nil {
client := github.NewClient(nil).WithAuthToken(config.GitHub.AuthToken)
if _, err := attestation.VerifyAttestation(incomingFilepath, client, config.GitHub.Owner, config.GitHub.Repo); err != nil {
return fmt.Errorf("error validating attestation: %v", err)
}

Expand All @@ -98,7 +97,7 @@ func ProcessIncoming(config Config) error {
}

// add new packages to repository database
cmd = exec.Command("repo-add", config.DbName, filename)
cmd := exec.Command("repo-add", config.DbName, filename)
cmd.Dir = config.RepoDir
if err := cmd.Run(); err != nil {
return fmt.Errorf("error adding package to repository database: %v", err)
Expand Down
2 changes: 1 addition & 1 deletion autosign/cmd/autosign/main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import (

"git.sr.ht/~emersion/go-smee"
"github.com/BurntSushi/toml"
"github.com/google/go-github/v63/github"
"github.com/google/go-github/v66/github"
"mutantmonkey.in/code/geschenkerbauer/autosign/internal/configs"
)

Expand Down
15 changes: 5 additions & 10 deletions autosign/cmd/autosign/process.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,8 @@ import (
"strings"
"time"

"github.com/google/go-github/v63/github"
"github.com/google/go-github/v66/github"
"mutantmonkey.in/code/geschenkerbauer/autosign/internal/attestation"
"mutantmonkey.in/code/geschenkerbauer/autosign/internal/fshelpers"
)

Expand Down Expand Up @@ -49,17 +50,15 @@ func processWorkflowRun(client *github.Client, run *github.WorkflowRun, config C
return fmt.Errorf("could not write to destination file: %v", err)
}

if err := processArtifact(f.Name(), config); err != nil {
if err := processArtifact(f.Name(), client, config); err != nil {
return fmt.Errorf("could not process artifact: %v", err)
}
}

return nil
}

func processArtifact(filename string, config Config) error {
repo := fmt.Sprintf("%s/%s", config.GitHub.Owner, config.GitHub.Repo)

func processArtifact(filename string, client *github.Client, config Config) error {
// create temporary destination directory
dir, err := os.MkdirTemp("", "geschenkerbauer")
if err != nil {
Expand Down Expand Up @@ -125,11 +124,7 @@ func processArtifact(filename string, config Config) error {

// verify attestation
if !config.SkipAttestationCheck {
// TODO: when go-github supports this, do this in pure Go instead
cmd := exec.Command("gh", "attestation", "verify", destFilepath, "-R", repo)
cmd.Env = os.Environ()
cmd.Env = append(cmd.Env, fmt.Sprintf("GH_TOKEN=%s", config.GitHub.AuthToken))
if err := cmd.Run(); err != nil {
if _, err := attestation.VerifyAttestation(destFilepath, client, config.GitHub.Owner, config.GitHub.Repo); err != nil {
return fmt.Errorf("error validating attestation: %v", err)
}
}
Expand Down
84 changes: 79 additions & 5 deletions autosign/go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,25 +7,99 @@ require (
github.com/BurntSushi/toml v1.4.0
github.com/ProtonMail/go-crypto v1.0.0
github.com/ProtonMail/gopenpgp/v2 v2.7.5
github.com/google/go-github/v63 v63.0.0
github.com/google/go-github/v66 v66.0.1-0.20241120123633-717e93fa2808
github.com/minio/minio-go/v7 v7.0.75
github.com/sigstore/sigstore-go v0.6.2
)

require (
github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
github.com/cloudflare/circl v1.3.9 // indirect
github.com/cyberphone/json-canonicalization v0.0.0-20220623050100-57a0ce2678a7 // indirect
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/go-chi/chi v4.1.2+incompatible // indirect
github.com/go-ini/ini v1.67.0 // indirect
github.com/go-jose/go-jose/v4 v4.0.2 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/analysis v0.23.0 // indirect
github.com/go-openapi/errors v0.22.0 // indirect
github.com/go-openapi/jsonpointer v0.21.0 // indirect
github.com/go-openapi/jsonreference v0.21.0 // indirect
github.com/go-openapi/loads v0.22.0 // indirect
github.com/go-openapi/runtime v0.28.0 // indirect
github.com/go-openapi/spec v0.21.0 // indirect
github.com/go-openapi/strfmt v0.23.0 // indirect
github.com/go-openapi/swag v0.23.0 // indirect
github.com/go-openapi/validate v0.24.0 // indirect
github.com/goccy/go-json v0.10.3 // indirect
github.com/google/certificate-transparency-go v1.2.1 // indirect
github.com/google/go-containerregistry v0.20.2 // indirect
github.com/google/go-querystring v1.1.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
github.com/in-toto/attestation v1.1.0 // indirect
github.com/in-toto/in-toto-golang v0.9.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/klauspost/compress v1.17.9 // indirect
github.com/klauspost/cpuid/v2 v2.2.8 // indirect
github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
github.com/magiconair/properties v1.8.7 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/minio/md5-simd v1.1.2 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opentracing/opentracing-go v1.2.0 // indirect
github.com/pelletier/go-toml/v2 v2.1.0 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/rs/xid v1.5.0 // indirect
golang.org/x/crypto v0.24.0 // indirect
golang.org/x/net v0.26.0 // indirect
golang.org/x/sys v0.21.0 // indirect
golang.org/x/text v0.16.0 // indirect
github.com/sagikazarmark/locafero v0.4.0 // indirect
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
github.com/sassoftware/relic v7.2.1+incompatible // indirect
github.com/secure-systems-lab/go-securesystemslib v0.8.0 // indirect
github.com/shibumi/go-pathspec v1.3.0 // indirect
github.com/sigstore/protobuf-specs v0.3.2 // indirect
github.com/sigstore/rekor v1.3.6 // indirect
github.com/sigstore/sigstore v1.8.9 // indirect
github.com/sigstore/timestamp-authority v1.2.2 // indirect
github.com/sourcegraph/conc v0.3.0 // indirect
github.com/spf13/afero v1.11.0 // indirect
github.com/spf13/cast v1.6.0 // indirect
github.com/spf13/cobra v1.8.1 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/spf13/viper v1.18.2 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
github.com/theupdateframework/go-tuf v0.7.0 // indirect
github.com/theupdateframework/go-tuf/v2 v2.0.0 // indirect
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
github.com/transparency-dev/merkle v0.0.2 // indirect
go.mongodb.org/mongo-driver v1.14.0 // indirect
go.opentelemetry.io/otel v1.27.0 // indirect
go.opentelemetry.io/otel/metric v1.27.0 // indirect
go.opentelemetry.io/otel/trace v1.27.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
golang.org/x/crypto v0.27.0 // indirect
golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
golang.org/x/mod v0.20.0 // indirect
golang.org/x/net v0.27.0 // indirect
golang.org/x/sync v0.8.0 // indirect
golang.org/x/sys v0.25.0 // indirect
golang.org/x/term v0.24.0 // indirect
golang.org/x/text v0.18.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
google.golang.org/protobuf v1.34.2 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/klog/v2 v2.120.1 // indirect
)
Loading

0 comments on commit fc5fd95

Please sign in to comment.