cosign

Documentation

Index

• Constants
• func CertToPem(c *x509.Certificate) []byte
• func Descriptors(ref name.Reference) ([]v1.Descriptor, error)
• func DestinationRef(ref name.Reference, img *remote.Descriptor) (name.Reference, error)
• func Experimental() bool
• func FindTlogEntry(rekorClient *client.Rekor, b64Sig string, payload, pubKey []byte) (string, error)
• func GeneratePrivateKey() (*ecdsa.PrivateKey, error)
• func KeyToPem(pub crypto.PublicKey) ([]byte, error)
• func LoadCerts(pemStr string) ([]*x509.Certificate, error)
• func LoadECDSAPrivateKey(key []byte, pass []byte) (signature.ECDSASignerVerifier, error)
• func Munge(desc v1.Descriptor) string
• func PublicKeyPem(ctx context.Context, key signature.PublicKeyProvider) ([]byte, error)
• func TlogServer() string
• func TrustedCert(cert *x509.Certificate, roots *x509.CertPool) error
• func Upload(signature, payload []byte, dstTag name.Reference, cert, chain string) error
• func UploadTLog(signature, payload []byte, pemBytes []byte) (string, error)
• type CheckOpts
• type Keys
  • func GenerateKeyPair(pf PassFunc) (*Keys, error)
• type PassFunc
• type PublicKey
  • func LoadPublicKey(ctx context.Context, keyRef string) (PublicKey, error)
• type PublicKeyProvider
• type SignedPayload
  • func FetchSignatures(ctx context.Context, ref name.Reference) ([]SignedPayload, *v1.Descriptor, error)
  • func FetchSignaturesYaml(ctx context.Context, payloadPath string) ([]SignedPayload, error)
  • func Verify(ctx context.Context, ref name.Reference, co CheckOpts, payloadPath string) ([]SignedPayload, error)
  • func (sp *SignedPayload) TrustedCert(roots *x509.CertPool) error
  • func (sp *SignedPayload) VerifyClaims(d *v1.Descriptor, ss *payload.Simple) error
  • func (sp *SignedPayload) VerifyKey(ctx context.Context, pubKey PublicKey) error
  • func (sp *SignedPayload) VerifyTlog(rc *client.Rekor, publicKeyPem []byte) (string, error)

Constants

const (
	ExperimentalEnv = "COSIGN_EXPERIMENTAL"

	ServerEnv = "REKOR_SERVER"
)

Functions

func CertToPem

func CertToPem(c *x509.Certificate) []byte

func Descriptors

func Descriptors(ref name.Reference) ([]v1.Descriptor, error)

func DestinationRef

func DestinationRef(ref name.Reference, img *remote.Descriptor) (name.Reference, error)

func Experimental

func Experimental() bool

func FindTlogEntry

func FindTlogEntry(rekorClient *client.Rekor, b64Sig string, payload, pubKey []byte) (string, error)

func GeneratePrivateKey

func GeneratePrivateKey() (*ecdsa.PrivateKey, error)

func KeyToPem

func KeyToPem(pub crypto.PublicKey) ([]byte, error)

func LoadCerts

func LoadCerts(pemStr string) ([]*x509.Certificate, error)

func LoadECDSAPrivateKey

func LoadECDSAPrivateKey(key []byte, pass []byte) (signature.ECDSASignerVerifier, error)

func Munge

func Munge(desc v1.Descriptor) string

func PublicKeyPem

func PublicKeyPem(ctx context.Context, key signature.PublicKeyProvider) ([]byte, error)

func TlogServer

func TlogServer() string

tlogServer returns the name of the tlog server, can be overwritten via env var

func TrustedCert

func TrustedCert(cert *x509.Certificate, roots *x509.CertPool) error

func Upload

func Upload(signature, payload []byte, dstTag name.Reference, cert, chain string) error

func UploadTLog

func UploadTLog(signature, payload []byte, pemBytes []byte) (string, error)

Upload will upload the signature, public key and payload to the tlog

Types

type CheckOpts

type CheckOpts struct {
	Annotations map[string]interface{}
	Claims      bool
	Tlog        bool
	PubKey      PublicKey
	Roots       *x509.CertPool
}

There are only payloads. Some have certs, some don't.

type Keys

type Keys struct {
	PrivateBytes []byte
	PublicBytes  []byte
}

func GenerateKeyPair

func GenerateKeyPair(pf PassFunc) (*Keys, error)

type PassFunc

type PassFunc func(bool) ([]byte, error)

type PublicKey

type PublicKey interface {
	signature.Verifier
	signature.PublicKeyProvider
}

func LoadPublicKey

func LoadPublicKey(ctx context.Context, keyRef string) (PublicKey, error)

type PublicKeyProvider

type PublicKeyProvider interface {
	PublicKey(context.Context) (crypto.PublicKey, error)
}

type SignedPayload

type SignedPayload struct {
	Base64Signature string
	Payload         []byte
	Cert            *x509.Certificate
	Chain           []*x509.Certificate
}

func FetchSignatures

func FetchSignatures(ctx context.Context, ref name.Reference) ([]SignedPayload, *v1.Descriptor, error)

func FetchSignaturesYaml

func FetchSignaturesYaml(ctx context.Context, payloadPath string) ([]SignedPayload, error)

func Verify

func Verify(ctx context.Context, ref name.Reference, co CheckOpts, payloadPath string) ([]SignedPayload, error)

Verify does all the main cosign checks in a loop, returning validated payloads. If there were no payloads, we return an error.

func (*SignedPayload) TrustedCert

func (sp *SignedPayload) TrustedCert(roots *x509.CertPool) error

func (*SignedPayload) VerifyClaims

func (sp *SignedPayload) VerifyClaims(d *v1.Descriptor, ss *payload.Simple) error

func (*SignedPayload) VerifyKey

func (sp *SignedPayload) VerifyKey(ctx context.Context, pubKey PublicKey) error

func (*SignedPayload) VerifyTlog

func (sp *SignedPayload) VerifyTlog(rc *client.Rekor, publicKeyPem []byte) (string, error)