63 lines
1.6 KiB
Go
63 lines
1.6 KiB
Go
package attestation
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/docker/attest/internal/util"
|
|
"github.com/docker/attest/pkg/tlog"
|
|
"github.com/secure-systems-lab/go-securesystemslib/dsse"
|
|
)
|
|
|
|
// SignDSSE signs a payload with a given signer and uploads the signature to the transparency log
|
|
func SignDSSE(ctx context.Context, payload []byte, payloadType string, signer dsse.SignerVerifier) (*Envelope, error) {
|
|
t := tlog.GetTL(ctx)
|
|
|
|
env := new(Envelope)
|
|
env.Payload = base64Encoding.EncodeToString(payload)
|
|
env.PayloadType = payloadType
|
|
encPayload := dsse.PAE(payloadType, payload)
|
|
|
|
// statement message digest
|
|
hash := util.S256(encPayload)
|
|
|
|
// sign message digest
|
|
sig, err := signer.Sign(ctx, hash)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error signing attestation: %w", err)
|
|
}
|
|
|
|
// get Key ID from signer
|
|
keyId, err := signer.KeyID()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error getting public key ID: %w", err)
|
|
}
|
|
|
|
// upload to TL
|
|
entry, err := t.UploadLogEntry(ctx, keyId, encPayload, sig, signer)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error uploading TL entry: %w", err)
|
|
}
|
|
entryObj, err := t.UnmarshalEntry(entry)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("error unmarshaling tl entry: %w", err)
|
|
}
|
|
|
|
// add signature w/ tl extension to dsse envelope
|
|
env.Signatures = append(env.Signatures, Signature{
|
|
KeyID: keyId,
|
|
Sig: base64Encoding.EncodeToString(sig),
|
|
Extension: Extension{
|
|
Kind: DockerDsseExtKind,
|
|
Ext: DockerDsseExtension{
|
|
Tl: DockerTlExtension{
|
|
Kind: RekorTlExtKind,
|
|
Data: entryObj, // transparency log entry metadata
|
|
},
|
|
},
|
|
},
|
|
})
|
|
|
|
return env, nil
|
|
}
|