feat: add tlog and signerverifier

2024-04-19 09:08:31 -05:00
parent cfce71f5ba
commit c81a228bf6
10 changed files with 1214 additions and 86 deletions
--- a/pkg/signerverifier/aws.go
+++ b/pkg/signerverifier/aws.go
@@ -0,0 +1,27 @@
+package signerverifier
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+	awssigner "github.com/sigstore/sigstore/pkg/signature/kms/aws"
+)
+
+// using AWS KMS
+func GetAWSSigner(ctx context.Context, keyArn string, region string) (dsse.SignerVerifier, error) {
+	keypath := fmt.Sprintf("awskms:///%s", keyArn)
+	sv, err := awssigner.LoadSignerVerifier(ctx, keypath, config.WithRegion(region))
+	if err != nil {
+		return nil, fmt.Errorf("error loading aws signer verifier: %w", err)
+	}
+	cs, _, err := sv.CryptoSigner(context.Background(), func(err error) {})
+	if err != nil {
+		return nil, fmt.Errorf("error getting aws crypto signer: %w", err)
+	}
+	signer := &ECDSA256_SignerVerifier{
+		Signer: cs,
+	}
+	return signer, nil
+}
--- a/pkg/signerverifier/common.go
+++ b/pkg/signerverifier/common.go
@@ -0,0 +1,56 @@
+package signerverifier
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"fmt"
+
+	"github.com/docker/attest/internal/util"
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+)
+
+type ECDSA256_SignerVerifier struct {
+	crypto.Signer
+}
+
+// implement keyid function
+func (s *ECDSA256_SignerVerifier) KeyID() (string, error) {
+	keyid, err := KeyID(s.Signer.Public())
+	if err != nil {
+		return "", fmt.Errorf("error getting keyid: %w", err)
+	}
+	return keyid, nil
+}
+
+func (s *ECDSA256_SignerVerifier) Public() crypto.PublicKey {
+	return s.Signer.Public()
+}
+
+func (s *ECDSA256_SignerVerifier) Sign(ctx context.Context, data []byte) ([]byte, error) {
+	return s.Signer.Sign(rand.Reader, data, crypto.SHA256)
+}
+
+func (s *ECDSA256_SignerVerifier) Verify(ctx context.Context, data []byte, sig []byte) error {
+	pub, ok := s.Signer.Public().(*ecdsa.PublicKey)
+	if !ok {
+		return fmt.Errorf("public key is not ecdsa")
+	}
+	ok = ecdsa.VerifyASN1(pub, util.S256(data), sig)
+	if !ok {
+		return fmt.Errorf("payload signature is not valid")
+	}
+	return nil
+}
+
+func GenKeyPair() (dsse.SignerVerifier, error) {
+	signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	return &ECDSA256_SignerVerifier{
+		Signer: signer,
+	}, nil
+}
--- a/pkg/signerverifier/keyid.go
+++ b/pkg/signerverifier/keyid.go
@@ -0,0 +1,17 @@
+package signerverifier
+
+import (
+	"crypto"
+	"crypto/x509"
+	"fmt"
+
+	"github.com/docker/attest/internal/util"
+)
+
+func KeyID(pubKey crypto.PublicKey) (string, error) {
+	pub, err := x509.MarshalPKIXPublicKey(pubKey)
+	if err != nil {
+		return "", fmt.Errorf("error marshalling public key: %w", err)
+	}
+	return util.HexHashBytes(pub), nil
+}
--- a/pkg/signerverifier/parse.go
+++ b/pkg/signerverifier/parse.go
@@ -0,0 +1,39 @@
+package signerverifier
+
+import (
+	"crypto/ecdsa"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+)
+
+const pemType = "PUBLIC KEY"
+
+func Parse(pubkeyBytes []byte) (*ecdsa.PublicKey, error) {
+	p, _ := pem.Decode(pubkeyBytes)
+	if p == nil {
+		return nil, fmt.Errorf("pubkey file does not contain any PEM data")
+	}
+	if p.Type != pemType {
+		return nil, fmt.Errorf("pubkey file does not contain a public key")
+	}
+	pubKey, err := x509.ParsePKIXPublicKey(p.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("error failed to parse public key: %w", err)
+	}
+
+	ecdsaPubKey, ok := pubKey.(*ecdsa.PublicKey)
+	if !ok {
+		return nil, fmt.Errorf("error public key is not an ecdsa key: %w", err)
+	}
+	return ecdsaPubKey, nil
+}
+
+func ToPEM(ecdsaPubKey *ecdsa.PublicKey) ([]byte, error) {
+	pubKeyBytes, err := x509.MarshalPKIXPublicKey(ecdsaPubKey)
+	if err != nil {
+		return nil, fmt.Errorf("error failed to marshal public key: %w", err)
+	}
+
+	return pem.EncodeToMemory(&pem.Block{Type: pemType, Bytes: pubKeyBytes}), nil
+}
--- a/pkg/tlog/tl.go
+++ b/pkg/tlog/tl.go
@@ -0,0 +1,267 @@
+package tlog
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"strings"
+	"time"
+
+	"github.com/docker/attest/internal/util"
+	"github.com/docker/attest/pkg/signerverifier"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	rclient "github.com/sigstore/rekor/pkg/client"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
+	hashedrekord_v001 "github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1"
+)
+
+const (
+	DefaultRekorURL = "https://rekor.sigstore.dev"
+)
+
+type tlCtxKeyType struct{}
+
+var TlCtxKey tlCtxKeyType
+
+// sets TL in context
+func WithTL(ctx context.Context, tl TL) context.Context {
+	return context.WithValue(ctx, TlCtxKey, tl)
+}
+
+// gets TL from context, defaults to Rekor TL if not set
+func GetTL(ctx context.Context) TL {
+	t, ok := ctx.Value(TlCtxKey).(TL)
+	if !ok {
+		t = &RekorTL{}
+	}
+	return t
+}
+
+type TlPayload struct {
+	Algorithm string
+	Hash      string
+	Signature string
+	PublicKey string
+}
+
+type TL interface {
+	UploadLogEntry(ctx context.Context, subject string, payload, signature []byte, signer dsse.SignerVerifier) ([]byte, error)
+	VerifyLogEntry(ctx context.Context, entryBytes []byte) (time.Time, error)
+	VerifyEntryPayload(entryBytes, payload, publicKey []byte) error
+	UnmarshalEntry(entryBytes []byte) (any, error)
+}
+
+type MockTL struct {
+	UploadLogEntryFunc     func(ctx context.Context, subject string, payload, signature []byte, signer dsse.SignerVerifier) ([]byte, error)
+	VerifyLogEntryFunc     func(ctx context.Context, entryBytes []byte) (time.Time, error)
+	VerifyEntryPayloadFunc func(entryBytes, payload, publicKey []byte) error
+	UnmarshalEntryFunc     func(entryBytes []byte) (any, error)
+}
+
+func (tl *MockTL) UploadLogEntry(ctx context.Context, subject string, payload, signature []byte, signer dsse.SignerVerifier) ([]byte, error) {
+	if tl.UploadLogEntryFunc != nil {
+		return tl.UploadLogEntryFunc(ctx, subject, payload, signature, signer)
+	}
+	return nil, nil
+}
+
+func (tl *MockTL) VerifyLogEntry(ctx context.Context, entryBytes []byte) (time.Time, error) {
+	if tl.VerifyLogEntryFunc != nil {
+		return tl.VerifyLogEntryFunc(ctx, entryBytes)
+	}
+	return time.Time{}, nil
+}
+
+func (tl *MockTL) VerifyEntryPayload(entryBytes, payload, publicKey []byte) error {
+	if tl.VerifyEntryPayloadFunc != nil {
+		return tl.VerifyEntryPayloadFunc(entryBytes, payload, publicKey)
+	}
+	return nil
+}
+
+func (tl *MockTL) UnmarshalEntry(entryBytes []byte) (any, error) {
+	if tl.UnmarshalEntryFunc != nil {
+		return tl.UnmarshalEntryFunc(entryBytes)
+	}
+	return nil, nil
+}
+
+type RekorTL struct{}
+
+// UploadLogEntry submits a PK token signature to the transparency log
+func (tl *RekorTL) UploadLogEntry(ctx context.Context, subject string, payload, signature []byte, signer dsse.SignerVerifier) ([]byte, error) {
+	// generate self-signed x509 cert
+	pubCert, err := CreateX509Cert(subject, signer)
+	if err != nil {
+		return nil, fmt.Errorf("Error creating x509 cert: %w", err)
+	}
+
+	// generate hash of payload
+	hasher := sha256.New()
+	hasher.Write(payload)
+
+	// upload entry
+	rekorClient, err := rclient.GetRekorClient(DefaultRekorURL)
+	if err != nil {
+		return nil, fmt.Errorf("Error creating rekor client: %w", err)
+	}
+	entry, err := cosign.TLogUpload(ctx, rekorClient, signature, hasher, pubCert)
+	if err != nil {
+		return nil, fmt.Errorf("Error uploading tlog: %w", err)
+	}
+	entryBytes, err := entry.MarshalBinary()
+	if err != nil {
+		return nil, fmt.Errorf("error marshalling TL entry: %w", err)
+	}
+	return entryBytes, nil
+}
+
+// VerifyLogEntry verifies a transparency log entry
+func (tl *RekorTL) VerifyLogEntry(ctx context.Context, entryBytes []byte) (time.Time, error) {
+	zeroTime := time.Time{}
+	entry, err := tl.UnmarshalEntry(entryBytes)
+	if err != nil {
+		return zeroTime, fmt.Errorf("error failed to unmarshal TL entry: %w", err)
+	}
+	le, ok := entry.(*models.LogEntryAnon)
+	if !ok {
+		return zeroTime, fmt.Errorf("expected entry to be of type *models.LogEntryAnon, got %T", entry)
+	}
+	err = le.Validate(strfmt.Default)
+	if err != nil {
+		return zeroTime, fmt.Errorf("TL entry failed validation: %w", err)
+	}
+
+	// TODO: get rekor public keys from TUF (ours or theirs?), and/or embed the public key in the binary
+	rekorPubKeys, err := cosign.GetRekorPubs(ctx)
+	if err != nil {
+		return zeroTime, fmt.Errorf("error failed to get rekor public keys: %w", err)
+	}
+	err = cosign.VerifyTLogEntryOffline(ctx, le, rekorPubKeys)
+	if err != nil {
+		return zeroTime, fmt.Errorf("TL entry failed verification: %w", err)
+	}
+
+	integratedTime := time.Unix(*le.IntegratedTime, 0)
+
+	return integratedTime, nil
+}
+
+// CreateX509Cert generates a self-signed x509 cert for TL submission
+func CreateX509Cert(subject string, signer dsse.SignerVerifier) ([]byte, error) {
+	// encode ephemeral public key
+	ecPub, err := x509.MarshalPKIXPublicKey(signer.Public())
+	if err != nil {
+		return nil, fmt.Errorf("error marshalling public key: %w", err)
+	}
+
+	template := x509.Certificate{
+		SerialNumber:            big.NewInt(1),
+		Subject:                 pkix.Name{CommonName: subject},
+		RawSubjectPublicKeyInfo: ecPub,
+		NotBefore:               time.Now(),
+		NotAfter:                time.Now().Add(365 * 24 * time.Hour), // valid for 1 year
+		KeyUsage:                x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:             []x509.ExtKeyUsage{x509.ExtKeyUsageCodeSigning},
+		BasicConstraintsValid:   true,
+		DNSNames:                []string{subject},
+		IsCA:                    false,
+	}
+
+	// dsse.SignerVerifier doesn't implement cypto.Signer exactly
+
+	csigner, ok := signer.(*signerverifier.ECDSA256_SignerVerifier)
+	if !ok {
+		return nil, fmt.Errorf("expected signer to be of type *signerverifier.ECDSA_SignerVerifier, got %T", signer)
+	}
+	// create a self-signed X.509 certificate
+	certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, signer.Public(), csigner.Signer)
+	if err != nil {
+		return nil, fmt.Errorf("error creating X.509 certificate: %w", err)
+	}
+	certBlock := &pem.Block{Type: "CERTIFICATE", Bytes: certDER}
+	return pem.EncodeToMemory(certBlock), nil
+}
+
+// VerifyEntryPayload checks that the TL entry payload matches envelope payload
+func (tl *RekorTL) VerifyEntryPayload(entryBytes, payload, publicKey []byte) error {
+	entry, err := tl.UnmarshalEntry(entryBytes)
+	if err != nil {
+		return fmt.Errorf("error failed to unmarshal TL entry: %w", err)
+	}
+	le, ok := entry.(*models.LogEntryAnon)
+	if !ok {
+		return fmt.Errorf("expected tl entry to be of type *models.LogEntryAnon, got %T", entry)
+	}
+	tlBody, ok := le.Body.(string)
+	if !ok {
+		return fmt.Errorf("expected tl body to be of type string, got %T", entry)
+	}
+	rekord, err := extractHashedRekord(tlBody)
+	if err != nil {
+		return fmt.Errorf("error extract HashedRekord from TL entry: %w", err)
+	}
+
+	// compare payload hashes
+	payloadHash := hex.EncodeToString(util.S256(payload))
+	if rekord.Hash != payloadHash {
+		return fmt.Errorf("error payload and tl entry hash mismatch")
+	}
+
+	// compare public keys
+	cert, err := base64.StdEncoding.Strict().DecodeString(rekord.PublicKey)
+	if err != nil {
+		return fmt.Errorf("failed to decode public key: %w", err)
+	}
+	p, _ := pem.Decode(cert)
+	result, err := x509.ParseCertificate(p.Bytes)
+	if err != nil {
+		return fmt.Errorf("failed to parse certificate: %w", err)
+	}
+	if string(result.RawSubjectPublicKeyInfo) != string(publicKey) {
+		return fmt.Errorf("error payload and tl entry public key mismatch")
+	}
+	return nil
+}
+
+func (tl *RekorTL) UnmarshalEntry(entry []byte) (any, error) {
+	le := new(models.LogEntryAnon)
+	err := le.UnmarshalBinary(entry)
+	if err != nil {
+		return nil, fmt.Errorf("error failed to unmarshal TL entry: %w", err)
+	}
+	return le, nil
+}
+
+func extractHashedRekord(Body string) (*TlPayload, error) {
+	sig := new(TlPayload)
+	pe, err := models.UnmarshalProposedEntry(base64.NewDecoder(base64.StdEncoding, strings.NewReader(Body)), runtime.JSONConsumer())
+	if err != nil {
+		return nil, err
+	}
+	impl, err := types.UnmarshalEntry(pe)
+	if err != nil {
+		return nil, err
+	}
+	switch entry := impl.(type) {
+	case *hashedrekord_v001.V001Entry:
+		sig.Algorithm = *entry.HashedRekordObj.Data.Hash.Algorithm
+		sig.Hash = *entry.HashedRekordObj.Data.Hash.Value
+		sig.Signature = entry.HashedRekordObj.Signature.Content.String()
+		sig.PublicKey = entry.HashedRekordObj.Signature.PublicKey.Content.String()
+		return sig, nil
+	default:
+		return nil, fmt.Errorf("failed to extract haskedrekord, unsupported type: %T", entry)
+	}
+}
--- a/pkg/tlog/tl_test.go
+++ b/pkg/tlog/tl_test.go
@@ -0,0 +1,97 @@
+package tlog
+
+import (
+	"context"
+	"crypto/x509"
+	"encoding/pem"
+	"testing"
+	"time"
+
+	"github.com/docker/attest/internal/util"
+	"github.com/docker/attest/pkg/signerverifier"
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+	"github.com/stretchr/testify/assert"
+)
+
+const (
+	// test macros
+	USE_MOCK_TL = true
+
+	// test artifacts
+	TestEntry     = `{"body":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI5Zjg2ZDA4MTg4NGM3ZDY1OWEyZmVhYTBjNTVhZDAxNWEzYmY0ZjFiMmIwYjgyMmNkMTVkNmMxNWIwZjAwYTA4In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJQUlyVUZGUzBIYmNzZjc5L08yajVXdHl2R2Vvd1NVSXpZcDlBM2IwWnREVUFpQVQxZU42ZjFyVmVWa011REFlN3dxWkJ2bE5LY2VsajNVVDNmaWhyQjZSY2c9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVSlZla05DSzJGQlJFRm5SVU5CWjBWQ1RVRnZSME5EY1VkVFRUUTVRa0ZOUTAxQk9IaEVWRUZNUW1kT1ZrSkJUVlJDU0ZKc1l6TlJkMGhvWTA0S1RXcE5lRTFxU1ROTlZHdDVUWHBWTlZkb1kwNU5hbEY0VFdwSk1rMVVhM2xOZWxVMVYycEJVRTFSTUhkRGQxbEVWbEZSUkVWM1VqQmFXRTR3VFVacmR3cEZkMWxJUzI5YVNYcHFNRU5CVVZsSlMyOWFTWHBxTUVSQlVXTkVVV2RCUlVRMFZpdFNSV2g0SzJGeFYwZzNlV3hOVFVSSVlXaE9UVzVOVEZOUFNsQXZDamxyUVcwNWJIQXJNMjF4V1ZSQmFGVlNjbUUyVDBRMVVYZzRXbUprSzJWMVVIbFFhemw1SzNjdloxZEhSRUk1ZW00dlNXd3hTMDVIVFVWUmQwUm5XVVFLVmxJd1VFRlJTQzlDUVZGRVFXZGxRVTFDVFVkQk1WVmtTbEZSVFUxQmIwZERRM05IUVZGVlJrSjNUVVJOUVhkSFFURlZaRVYzUlVJdmQxRkRUVUZCZHdwRWQxbEVWbEl3VWtKQlozZENiMGxGWkVkV2VtUkVRVXRDWjJkeGFHdHFUMUJSVVVSQlowNUtRVVJDUjBGcFJVRTNOMjFFTDFSbVJtRlJVemxrWlhRMENqbFhaRk41YURKT1VTOUZiMVJtYVVGdFFtaHVWblpEVTNSUVowTkpVVU1yZDNSdllpOU9iMUp4T0c5cU4wZDNibTVKYUZKVGRDOVJNbmtyVXpoUkwzSUthRkpVYW5GaE9HZExRVDA5Q2kwdExTMHRSVTVFSUVORlVsUkpSa2xEUVZSRkxTMHRMUzBLIn19fX0=","integratedTime":1703705039,"logID":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d","logIndex":59674396,"verification":{"inclusionProof":{"checkpoint":"rekor.sigstore.dev - 2605736670972794746\n55510966\nJCi1O53Xmdi9lXnui4Q5SQ+MJSMnWr1Bxn+Q2Qf22tU=\nTimestamp: 1703705040158839214\n\n— rekor.sigstore.dev wNI9ajBFAiAXgtjFDVqCSgiSP04TQzELrz4+EyBwyYVL2EEULTCy0AIhAI9peLU76ZUD1tvU8qvzBJBo77IYD1rc+A1MPc35AeVK\n","hashes":["fb77ee213b48f4b18dc81c6e634c570abf99b257713561f174f2e0f4c039af67","6cb113bbefadecbbb8b89b1c08232438a6125071790b6a062cff8c1ccfdcb91e","6fbe1424e264e4590ca502d671b7a036c87f7a90d1f57534b98eb781144160bf","077b606720a6478200f6c3ed08a68e9b01b1cae192cb120888ddcc95521601bd","b6f8e8bc21ae0cde82b92422a4b4f37b28a43185821e468a4e65b6c79ed8f5b7","89332533fac54e9bc68c7353c42f6ebb9fe38039f67910332ff95082072068d4","0814d6f707a75fb3334bab14ab5466bd8b9a64ae7be7cd4d53a428c64932bc66","e883e826f10329c63a4a2ed21156037a050df43b9d74079296beac6968ed4150","d79230703257b7e4a8a61b032b6980d1a0bdbc7ae96ca838b525b3751785fe48","2f4a77e5288462cd3b75084d37f1502dcbe0943d18dd95cb247fc1ebbabc0aad","38562c253d3536d0d00e3547c880b6b0251a25ac69605b50c9eaa1a27186cc7a","9dea192350ff8b3c0f5ccda38261cb38ebd61869281c3928912332d1144e0a04","2c4d25ba59aa573ab2c79c2d3cd9e1d74789b10632432724d63112ce50b44874","98c486feb5d87092a78a46c4b5be04868654900affc2e86ffb20074dc73a883a","6969c49bd73f19bf28a5eaeabd331ddd60502defb2cd3d96e17b741c80adec6c"],"logIndex":55510965,"rootHash":"2428b53b9dd799d8bd9579ee8b8439490f8c2523275abd41c67f90d907f6dad5","treeSize":55510966},"signedEntryTimestamp":"MEUCIQCG9PRI8PcvtJyE9pbcculZipze6NEWR1Nk8EYocto3BwIgYu5gqgjW80HMjSjUxUNJLp0wlVTesnJCeByUBySc59w="}}`
+	TestPayload   = "test"
+	TestPublicKey = "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAED4V+REhx+aqWH7ylMMDHahNMnMLS\nOJP/9kAm9lp+3mqYTAhURra6OD5Qx8Zbd+euPyPk9y+w/gWGDB9zn/Il1A==\n-----END PUBLIC KEY-----"
+)
+
+func TestCreateX509Cert(t *testing.T) {
+	// TODO - replace with mock KMS
+	// generate test signing keys
+	signer, err := signerverifier.GenKeyPair()
+	assert.NoError(t, err)
+
+	// create x509 cert
+	cert, err := CreateX509Cert("test", signer)
+	assert.NoError(t, err)
+	p, _ := pem.Decode(cert)
+	result, err := x509.ParseCertificate(p.Bytes)
+	assert.NoError(t, err)
+
+	// test cert RawSubjectPublicKeyInfo field contains ephemeral public key
+	ecPub, err := x509.MarshalPKIXPublicKey(signer.Public())
+	assert.NoError(t, err)
+	assert.Equalf(t, string(result.RawSubjectPublicKeyInfo), string(ecPub), "certificate raw subject public key info does not match ephemeral public key")
+
+	// test cert common name == subject
+	assert.Equalf(t, result.Subject.CommonName, "test", "cert common name does not equal subject id")
+}
+
+func TestUploadAndVerifyLogEntry(t *testing.T) {
+	// message digest
+	payload := []byte("test")
+	hash := util.S256(payload)
+
+	// generate ephemeral keys to sign message digest
+	signer, err := signerverifier.GenKeyPair()
+	assert.NoError(t, err)
+	sig, err := signer.Sign(context.Background(), hash)
+	assert.NoError(t, err)
+
+	var tl TL
+	if USE_MOCK_TL {
+		tl = &MockTL{
+			UploadLogEntryFunc: func(ctx context.Context, subject string, payload []byte, signature []byte, signer dsse.SignerVerifier) ([]byte, error) {
+				return []byte(TestEntry), nil
+			},
+			VerifyLogEntryFunc: func(ctx context.Context, entryBytes []byte) (time.Time, error) {
+				return time.Time{}, nil
+			},
+			VerifyEntryPayloadFunc: func(entryBytes, payload, publicKey []byte) error {
+				return nil
+			},
+		}
+	} else {
+		tl = &RekorTL{}
+	}
+
+	// test upload log entry
+	ctx := WithTL(context.Background(), tl)
+	entry, err := tl.UploadLogEntry(ctx, "test", payload, sig, signer)
+	assert.NoError(t, err)
+
+	// test verify log entry
+	_, err = tl.VerifyLogEntry(ctx, entry)
+	assert.NoError(t, err)
+
+	// verify TL entry payload
+	ecPub, err := x509.MarshalPKIXPublicKey(signer.Public())
+	assert.NoError(t, err)
+	err = tl.VerifyEntryPayload(entry, payload, ecPub)
+	assert.NoError(t, err)
+}
+
+func TestVerifyEntryPayload(t *testing.T) {
+	tl := &RekorTL{}
+	p, _ := pem.Decode([]byte(TestPublicKey))
+	err := tl.VerifyEntryPayload([]byte(TestEntry), []byte(TestPayload), p.Bytes)
+	assert.NoError(t, err)
+}