feat: add tlog and signerverifier

pkg/signerverifier/aws.go

@@ -0,0 +1,27 @@
+package signerverifier
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+	awssigner "github.com/sigstore/sigstore/pkg/signature/kms/aws"
+)
+
+// using AWS KMS
+func GetAWSSigner(ctx context.Context, keyArn string, region string) (dsse.SignerVerifier, error) {
+	keypath := fmt.Sprintf("awskms:///%s", keyArn)
+	sv, err := awssigner.LoadSignerVerifier(ctx, keypath, config.WithRegion(region))
+	if err != nil {
+		return nil, fmt.Errorf("error loading aws signer verifier: %w", err)
+	}
+	cs, _, err := sv.CryptoSigner(context.Background(), func(err error) {})
+	if err != nil {
+		return nil, fmt.Errorf("error getting aws crypto signer: %w", err)
+	}
+	signer := &ECDSA256_SignerVerifier{
+		Signer: cs,
+	}
+	return signer, nil
+}

pkg/signerverifier/common.go

@@ -0,0 +1,56 @@
+package signerverifier
+
+import (
+	"context"
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"fmt"
+
+	"github.com/docker/attest/internal/util"
+	"github.com/secure-systems-lab/go-securesystemslib/dsse"
+)
+
+type ECDSA256_SignerVerifier struct {
+	crypto.Signer
+}
+
+// implement keyid function
+func (s *ECDSA256_SignerVerifier) KeyID() (string, error) {
+	keyid, err := KeyID(s.Signer.Public())
+	if err != nil {
+		return "", fmt.Errorf("error getting keyid: %w", err)
+	}
+	return keyid, nil
+}
+
+func (s *ECDSA256_SignerVerifier) Public() crypto.PublicKey {
+	return s.Signer.Public()
+}
+
+func (s *ECDSA256_SignerVerifier) Sign(ctx context.Context, data []byte) ([]byte, error) {
+	return s.Signer.Sign(rand.Reader, data, crypto.SHA256)
+}
+
+func (s *ECDSA256_SignerVerifier) Verify(ctx context.Context, data []byte, sig []byte) error {
+	pub, ok := s.Signer.Public().(*ecdsa.PublicKey)
+	if !ok {
+		return fmt.Errorf("public key is not ecdsa")
+	}
+	ok = ecdsa.VerifyASN1(pub, util.S256(data), sig)
+	if !ok {
+		return fmt.Errorf("payload signature is not valid")
+	}
+	return nil
+}
+
+func GenKeyPair() (dsse.SignerVerifier, error) {
+	signer, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	return &ECDSA256_SignerVerifier{
+		Signer: signer,
+	}, nil
+}

pkg/signerverifier/keyid.go

@@ -0,0 +1,17 @@
+package signerverifier
+
+import (
+	"crypto"
+	"crypto/x509"
+	"fmt"
+
+	"github.com/docker/attest/internal/util"
+)
+
+func KeyID(pubKey crypto.PublicKey) (string, error) {
+	pub, err := x509.MarshalPKIXPublicKey(pubKey)
+	if err != nil {
+		return "", fmt.Errorf("error marshalling public key: %w", err)
+	}
+	return util.HexHashBytes(pub), nil
+}

pkg/signerverifier/parse.go

@@ -0,0 +1,39 @@
+package signerverifier
+
+import (
+	"crypto/ecdsa"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+)
+
+const pemType = "PUBLIC KEY"
+
+func Parse(pubkeyBytes []byte) (*ecdsa.PublicKey, error) {
+	p, _ := pem.Decode(pubkeyBytes)
+	if p == nil {
+		return nil, fmt.Errorf("pubkey file does not contain any PEM data")
+	}
+	if p.Type != pemType {
+		return nil, fmt.Errorf("pubkey file does not contain a public key")
+	}
+	pubKey, err := x509.ParsePKIXPublicKey(p.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("error failed to parse public key: %w", err)
+	}
+
+	ecdsaPubKey, ok := pubKey.(*ecdsa.PublicKey)
+	if !ok {
+		return nil, fmt.Errorf("error public key is not an ecdsa key: %w", err)
+	}
+	return ecdsaPubKey, nil
+}
+
+func ToPEM(ecdsaPubKey *ecdsa.PublicKey) ([]byte, error) {
+	pubKeyBytes, err := x509.MarshalPKIXPublicKey(ecdsaPubKey)
+	if err != nil {
+		return nil, fmt.Errorf("error failed to marshal public key: %w", err)
+	}
+
+	return pem.EncodeToMemory(&pem.Block{Type: pemType, Bytes: pubKeyBytes}), nil
+}