refactor! remove pkg directory (#145)

* refactor!: remove pkg directory

* chore: include breaking changes in draft

signerverifier/README.md

@@ -0,0 +1,2 @@
+## signerverifier
+This package implements methods to sign and verify attestation envelopes.

signerverifier/aws.go

@@ -0,0 +1,27 @@
+package signerverifier
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+	awssigner "github.com/sigstore/sigstore/pkg/signature/kms/aws"
+)
+
+// using AWS KMS.
+func GetAWSSigner(ctx context.Context, keyARN string, region string) (dsse.SignerVerifier, error) {
+	keyPath := fmt.Sprintf("awskms:///%s", keyARN)
+	sv, err := awssigner.LoadSignerVerifier(ctx, keyPath, config.WithRegion(region))
+	if err != nil {
+		return nil, fmt.Errorf("error loading aws signer verifier: %w", err)
+	}
+	cs, _, err := sv.CryptoSigner(context.Background(), func(_ error) {})
+	if err != nil {
+		return nil, fmt.Errorf("error getting aws crypto signer: %w", err)
+	}
+	signer := &ECDSA256SignerVerifier{
+		Signer: cs,
+	}
+	return signer, nil
+}

signerverifier/common.go

@@ -0,0 +1,84 @@
+package signerverifier
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+
+	"github.com/docker/attest/internal/util"
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+)
+
+type ECDSA256SignerVerifier struct {
+	crypto.Signer
+}
+
+// implement keyid function.
+func (s *ECDSA256SignerVerifier) KeyID() (string, error) {
+	keyid, err := KeyID(s.Signer.Public())
+	if err != nil {
+		return "", fmt.Errorf("error getting keyid: %w", err)
+	}
+	return keyid, nil
+}
+
+func (s *ECDSA256SignerVerifier) Public() crypto.PublicKey {
+	return s.Signer.Public()
+}
+
+func (s *ECDSA256SignerVerifier) Sign(_ context.Context, data []byte) ([]byte, error) {
+	return s.Signer.Sign(rand.Reader, data, crypto.SHA256)
+}
+
+func (s *ECDSA256SignerVerifier) Verify(_ context.Context, data []byte, sig []byte) error {
+	pub, ok := s.Signer.Public().(*ecdsa.PublicKey)
+	if !ok {
+		return fmt.Errorf("public key is not ecdsa")
+	}
+	ok = ecdsa.VerifyASN1(pub, util.SHA256(data), sig)
+	if !ok {
+		return fmt.Errorf("payload signature is not valid")
+	}
+	return nil
+}
+
+func LoadKeyPair(priv []byte) (dsse.SignerVerifier, error) {
+	privateKey, err := parsePriv(priv)
+	if err != nil {
+		return nil, err
+	}
+	return &ECDSA256SignerVerifier{
+		Signer: privateKey,
+	}, nil
+}
+
+func parsePriv(privkeyBytes []byte) (*ecdsa.PrivateKey, error) {
+	p, _ := pem.Decode(privkeyBytes)
+	if p == nil {
+		return nil, fmt.Errorf("privkey file does not contain any PEM data")
+	}
+	if p.Type != "EC PRIVATE KEY" {
+		return nil, fmt.Errorf("privkey file does not contain a priavte key")
+	}
+	privKey, err := x509.ParseECPrivateKey(p.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("error failed to parse public key: %w", err)
+	}
+
+	return privKey, nil
+}
+
+func GenKeyPair() (dsse.SignerVerifier, error) {
+	signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	return &ECDSA256SignerVerifier{
+		Signer: signer,
+	}, nil
+}

signerverifier/gcp.go

@@ -0,0 +1,28 @@
+package signerverifier
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+	gcpsigner "github.com/sigstore/sigstore/pkg/signature/kms/gcp"
+	"google.golang.org/api/option"
+)
+
+// using GCP KMS
+// reference should be in the format projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEY_RING]/cryptoKeys/[KEY]/cryptoKeyVersions/[VERSION].
+func GetGCPSigner(ctx context.Context, reference string, opts ...option.ClientOption) (dsse.SignerVerifier, error) {
+	reference = fmt.Sprintf("gcpkms://%s", reference)
+	sv, err := gcpsigner.LoadSignerVerifier(ctx, reference, opts...)
+	if err != nil {
+		return nil, fmt.Errorf("error loading gcp signer verifier: %w", err)
+	}
+	cs, _, err := sv.CryptoSigner(ctx, func(_ error) {})
+	if err != nil {
+		return nil, fmt.Errorf("error getting gcp crypto signer: %w", err)
+	}
+	signer := &ECDSA256SignerVerifier{
+		Signer: cs,
+	}
+	return signer, nil
+}

signerverifier/gcp_test.go

@@ -0,0 +1,45 @@
+//go:build e2e
+
+package signerverifier
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"testing"
+
+	"github.com/docker/attest/internal/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const publicKeyPEM = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuMswW3iu7PR/rWTQjlhVmUsPK7rF
+k2s4SO3XbQ2GG2alm289SUUpmBAuVxvT8muYQ8HC/QzixzyTACTXsBDjQg==
+-----END PUBLIC KEY-----`
+
+// to run locally, we need to impersonate the GCP service account
+// gcloud auth application-default login --impersonate-service-account attest-kms-test@attest-kms-test.iam.gserviceaccount.com
+
+func TestGCPKMS_Signer(t *testing.T) {
+	// create a new signer
+	ctx := context.TODO()
+	ref := "projects/attest-kms-test/locations/us-west1/keyRings/attest-kms-test/cryptoKeys/test-signing-key/cryptoKeyVersions/1"
+	signer, err := GetGCPSigner(ctx, ref)
+	require.NoError(t, err)
+	msg := []byte("hello world")
+	hash := util.SHA256(msg)
+
+	// sign message digest
+	sig, err := signer.Sign(ctx, hash)
+	require.NoError(t, err)
+	assert.NotEmpty(t, sig)
+	// get Key ID from signer
+	keyId, err := signer.KeyID()
+	require.NoError(t, err)
+	assert.NotEmpty(t, keyId)
+	publicKey, err := ParsePublicKey([]byte(publicKeyPEM))
+	require.NoError(t, err)
+	// verify payload ecdsa signature
+	ok := ecdsa.VerifyASN1(publicKey, hash, sig)
+	assert.True(t, ok)
+}

signerverifier/keyid.go

@@ -0,0 +1,17 @@
+package signerverifier
+
+import (
+	"crypto"
+	"crypto/x509"
+	"fmt"
+
+	"github.com/docker/attest/internal/util"
+)
+
+func KeyID(pubKey crypto.PublicKey) (string, error) {
+	pub, err := x509.MarshalPKIXPublicKey(pubKey)
+	if err != nil {
+		return "", fmt.Errorf("error marshaling public key: %w", err)
+	}
+	return util.SHA256Hex(pub), nil
+}

signerverifier/parse.go

@@ -0,0 +1,39 @@
+package signerverifier
+
+import (
+	"crypto/ecdsa"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+)
+
+const pemType = "PUBLIC KEY"
+
+func ParsePublicKey(pubkeyBytes []byte) (*ecdsa.PublicKey, error) {
+	p, _ := pem.Decode(pubkeyBytes)
+	if p == nil {
+		return nil, fmt.Errorf("pubkey file does not contain any PEM data")
+	}
+	if p.Type != pemType {
+		return nil, fmt.Errorf("pubkey file does not contain a public key")
+	}
+	pubKey, err := x509.ParsePKIXPublicKey(p.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("error failed to parse public key: %w", err)
+	}
+
+	ecdsaPubKey, ok := pubKey.(*ecdsa.PublicKey)
+	if !ok {
+		return nil, fmt.Errorf("error public key is not an ecdsa key: %w", err)
+	}
+	return ecdsaPubKey, nil
+}
+
+func ConvertToPEM(ecdsaPubKey *ecdsa.PublicKey) ([]byte, error) {
+	pubKeyBytes, err := x509.MarshalPKIXPublicKey(ecdsaPubKey)
+	if err != nil {
+		return nil, fmt.Errorf("error failed to marshal public key: %w", err)
+	}
+
+	return pem.EncodeToMemory(&pem.Block{Type: pemType, Bytes: pubKeyBytes}), nil
+}