sigtest

Documentation

Overview

Package sigtest is a miniature Sigstore for tests and demos: a Fulcio-like CA that issues short-lived code-signing certificates carrying the OIDC identity extensions, a Rekor-like key that signs entry timestamps, and an in-memory OCI registry that serves images and their cosign signature manifests. Nothing here is used at runtime.

Index

• func SimpleSigningPayload(ref, digest string) []byte
• type Registry
  • func NewRegistry(auth bool) *Registry
  • func (r *Registry) Close()
  • func (r *Registry) Host() string
  • func (r *Registry) PushImage(path, tag string) string
  • func (r *Registry) PushSignature(path, digest string, sigs ...update.Signature)
• type SignOptions
• type Signer
  • func New() (*Signer, error)
  • func (s *Signer) Sign(payload []byte, o SignOptions) (update.Signature, error)
  • func (s *Signer) TrustRoot() (update.TrustRoot, error)
  • func (s *Signer) WriteTrustRoot(dir string) error

Functions

func SimpleSigningPayload

func SimpleSigningPayload(ref, digest string) []byte

SimpleSigningPayload builds the cosign payload attesting to an image digest.

Types

type Registry

type Registry struct {
	Server *httptest.Server
	Auth   bool
	// contains filtered or unexported fields
}

Registry is an in-memory OCI registry behind httptest with optional bearer-token auth.

func NewRegistry

func NewRegistry(auth bool) *Registry

NewRegistry starts the registry.

func (*Registry) Close

func (r *Registry) Close()

Close stops the server.

func (*Registry) Host

func (r *Registry) Host() string

Host is host:port for image references.

func (*Registry) PushImage

func (r *Registry) PushImage(path, tag string) string

PushImage stores a minimal manifest under path:tag and returns its digest.

func (*Registry) PushSignature

func (r *Registry) PushSignature(path, digest string, sigs ...update.Signature)

PushSignature stores a cosign signature manifest (tag sha256-<hex>.sig) for digest.

type SignOptions

type SignOptions struct {
	Subject, Issuer string
	NotBefore       time.Time // leaf validity start (default: now-5m); valid 10 minutes
	Integrated      time.Time // Rekor time (default: NotBefore+1m)
	NoBundle        bool
	WrongCA         bool // sign the leaf with an unrelated CA
	BadSET          bool // corrupt the signed entry timestamp
}

SignOptions tune one signature (zero values = a good, current signature).

type Signer

type Signer struct {
	RootPEM  []byte
	ChainPEM []byte // intermediate
	RekorPEM []byte
	// contains filtered or unexported fields
}

Signer is the test CA + log.

func New

func New() (*Signer, error)

New creates a root, an intermediate and a Rekor key.

func (*Signer) Sign

func (s *Signer) Sign(payload []byte, o SignOptions) (update.Signature, error)

Sign issues a fresh leaf and signs payload, returning a cosign-shaped signature.

func (*Signer) TrustRoot

func (s *Signer) TrustRoot() (update.TrustRoot, error)

TrustRoot returns the parsed root for update.Verify.

func (*Signer) WriteTrustRoot

func (s *Signer) WriteTrustRoot(dir string) error

WriteTrustRoot writes fulcio.pem and rekor.pub into dir (for `redoubt update --trust-root`).