Skip to content

Require new bundle format for signing and verification #4959

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aaronlew02 wants to merge 12 commits into
base: main
Choose a base branch
from
Open

Require new bundle format for signing and verification #4959

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
28ccd1f
Verify blobs exclusively via sigstore-go
aaronlew02 Jun 25, 2026
d6d0a2f
Require new bundle format for sign-blob
aaronlew02 Jun 25, 2026
a2efab0
Verify blob attestations exclusively via sigstore-go
aaronlew02 Jun 25, 2026
2a70df6
Require new bundle format for attest-blob
aaronlew02 Jun 25, 2026
e3775b5
Verify attestations exclusively via sigstore-go
aaronlew02 Jun 25, 2026
baa6db0
Require new bundle format for attest
aaronlew02 Jun 25, 2026
4f33850
Verify images exclusively via sigstore-go
aaronlew02 Jun 25, 2026
4537ba6
Require new bundle format for sign
aaronlew02 Jun 25, 2026
de506c6
Update shared flags and helper logic
aaronlew02 Jun 25, 2026
d435b3b
Update core logic and delete legacy verification code
aaronlew02 Jun 25, 2026
5ac6312
Update e2e tests
aaronlew02 Jun 26, 2026
6c0cc72
Update docs
aaronlew02 Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
230 changes: 21 additions & 209 deletions cmd/cosign/cli/verify/verify_blob.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,82 +18,53 @@ package verify
import (
"bytes"
"context"
"crypto"
"crypto/x509"
"encoding/base64"
"encoding/hex"
"encoding/json"
"errors"
"fmt"
"io"
"io/fs"
"os"
"path/filepath"
"strings"

"github.com/sigstore/cosign/v3/cmd/cosign/cli/options"
"github.com/sigstore/cosign/v3/internal/ui"
"github.com/sigstore/cosign/v3/pkg/blob"
"github.com/sigstore/cosign/v3/pkg/cosign"
"github.com/sigstore/cosign/v3/pkg/cosign/bundle"
"github.com/sigstore/cosign/v3/pkg/oci/static"
sgbundle "github.com/sigstore/sigstore-go/pkg/bundle"
sgverify "github.com/sigstore/sigstore-go/pkg/verify"

"github.com/sigstore/sigstore/pkg/cryptoutils"
)

func isb64(data []byte) bool {
_, err := base64.StdEncoding.DecodeString(string(data))
return err == nil
}

// nolint
type VerifyBlobCmd struct {
options.KeyOpts
options.CertVerifyOptions
CertRef string
CAIntermediates string
CARoots string
CertChain string
SigRef string
TrustedRootPath string
CertGithubWorkflowTrigger string
CertGithubWorkflowSHA string
CertGithubWorkflowName string
CertGithubWorkflowRepository string
CertGithubWorkflowRef string
IgnoreSCT bool
SCTRef string
Offline bool
UseSignedTimestamps bool
IgnoreTlog bool
HashAlgorithm crypto.Hash

@Hayden-IO Hayden-IO Aug 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To confirm, hash algorithm will now only be determined by the default mapping between signing scheme and hash alg?

@Hayden-IO Hayden-IO Aug 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And, how does this interact with when you parse out the algorithm from the payloadDigest?

AllowCertificateChain bool
}

// nolint
func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
// always default to sha256 if the algorithm hasn't been explicitly set
if c.HashAlgorithm == 0 {
c.HashAlgorithm = crypto.SHA256
}

// Require a certificate/key OR a local bundle file that has the cert.
if options.NOf(c.KeyRef, c.CertRef, c.Sk, c.BundlePath) == 0 {
return fmt.Errorf("provide a key with --key or --sk, a certificate to verify against with --certificate, or a bundle with --bundle")
}

// key and cert identity are mutually exclusive
if options.NOf(c.KeyRef, c.CertIdentity, c.CertIdentityRegexp) > 1 {
return &options.KeyAndIdentityParseError{}
}

// Key, sk, and cert are mutually exclusive.
if options.NOf(c.KeyRef, c.Sk, c.CertRef) > 1 {
// Key and sk are mutually exclusive.
if options.NOf(c.KeyRef, c.Sk) > 1 {
return &options.PubKeyParseError{}
}

if c.BundlePath == "" {
return fmt.Errorf("please specify --bundle")
}

var identities []cosign.Identity
var err error
if c.KeyRef == "" && !c.Sk {
Expand All @@ -113,210 +84,51 @@ func (c *VerifyBlobCmd) Exec(ctx context.Context, blobRef string) error {
Identities: identities,
Offline: c.Offline,
IgnoreTlog: c.IgnoreTlog,
UseSignedTimestamps: c.TSACertChainPath != "" || c.UseSignedTimestamps,
UseSignedTimestamps: c.UseSignedTimestamps,
AllowCertificateChain: c.AllowCertificateChain,
}
co.NewBundleFormat = c.KeyOpts.NewBundleFormat && checkNewBundle(c.BundlePath, co.BundleOptions()...)
vOfflineKey := verifyOfflineWithKey(c.KeyRef, c.CertRef, c.Sk, co)
vOfflineKey := verifyOfflineWithKey(c.KeyRef, c.Sk, co)

// User provides a key or certificate. Otherwise, verification requires a Fulcio certificate
// provided in an attached bundle or OCI annotation.
// User provides a key. Otherwise, verification requires a Fulcio certificate
// provided in an attached bundle.
var closeSV func()
var cert *x509.Certificate
co.SigVerifier, cert, closeSV, err = LoadVerifierFromKeyOrCert(ctx, c.KeyRef, c.Slot, c.CertRef, "", c.HashAlgorithm, c.Sk, true, co)
co.SigVerifier, closeSV, err = LoadVerifierFromKey(ctx, c.KeyRef, c.Slot, c.Sk)
if err != nil {
return fmt.Errorf("loading verifier from key opts: %w", err)
}
defer closeSV()

err = SetTrustedMaterial(ctx, c.TrustedRootPath, c.CertChain, c.CARoots, c.CAIntermediates, c.TSACertChainPath, vOfflineKey, co)
err = SetTrustedMaterial(c.TrustedRootPath, vOfflineKey, co)
if err != nil {
return fmt.Errorf("setting trusted material: %w", err)
}

if err = CheckSigstoreBundleUnsupportedOptions(*c, vOfflineKey, co); err != nil {
return err
}

if co.NewBundleFormat {
bundle, err := sgbundle.LoadJSONFromPath(c.BundlePath, co.BundleOptions()...)
if err != nil {
return err
}

var artifactPolicyOption sgverify.ArtifactPolicyOption
blobBytes, err := payloadBytes(blobRef)
if err != nil {
alg, digest, payloadDigestError := payloadDigest(blobRef)
if payloadDigestError != nil {
return err
}
artifactPolicyOption = sgverify.WithArtifactDigest(alg, digest)
} else {
artifactPolicyOption = sgverify.WithArtifact(bytes.NewReader(blobBytes))
}

_, err = cosign.VerifyNewBundle(ctx, co, artifactPolicyOption, bundle)
if err != nil {
return err
}

ui.Infof(ctx, "Verified OK")
return nil
}

blobBytes, err := payloadBytes(blobRef)
bundle, err := sgbundle.LoadJSONFromPath(c.BundlePath, co.BundleOptions()...)
if err != nil {
return err
}

if c.TrustedRootPath != "" {
return fmt.Errorf("--trusted-root only supported with --new-bundle-format")
}
if c.RFC3161TimestampPath != "" && !co.UseSignedTimestamps {
return fmt.Errorf("when specifying --rfc3161-timestamp-path, you must also specify --use-signed-timestamps or --timestamp-certificate-chain")
} else if c.RFC3161TimestampPath == "" && co.UseSignedTimestamps {
return fmt.Errorf("when specifying --use-signed-timestamps or --timestamp-certificate-chain, you must also specify --rfc3161-timestamp-path")
}

err = SetLegacyClientsAndKeys(ctx, c.IgnoreTlog, shouldVerifySCT(c.IgnoreSCT, c.KeyRef, c.Sk), keylessVerification(c.KeyRef, c.Sk), c.RekorURL, c.TSACertChainPath, c.CertChain, c.CARoots, c.CAIntermediates, co)
var artifactPolicyOption sgverify.ArtifactPolicyOption
blobBytes, err := payloadBytes(blobRef)
if err != nil {
return fmt.Errorf("setting up clients and keys: %w", err)
}

opts := make([]static.Option, 0)
if c.BundlePath != "" {
b, err := cosign.FetchLocalSignedPayloadFromPath(c.BundlePath)
if err != nil {
alg, digest, payloadDigestError := payloadDigest(blobRef)
if payloadDigestError != nil {
return err
}
if b.Cert != "" {
certBytes := []byte(b.Cert)
if isb64(certBytes) {
certBytes, _ = base64.StdEncoding.DecodeString(b.Cert)
}
bundleCert, err := loadCertFromPEM(certBytes)
if err != nil {
return fmt.Errorf("loading verifier certificate from bundle: %w", err)
}
// if a cert was passed in, make sure it matches the cert in the bundle
if cert != nil && !cert.Equal(bundleCert) {
return fmt.Errorf("the cert passed in does not match the cert in the provided bundle")
}
cert = bundleCert
}
// A verifier must come either from a certificate from the bundle,
// or provided via --key, --sk, or --certificate.
if co.SigVerifier == nil && cert == nil {
return fmt.Errorf("bundle does not contain cert for verification, please provide public key")
}

opts = append(opts, static.WithBundle(b.Bundle))
}
if c.RFC3161TimestampPath != "" {
var rfc3161Timestamp bundle.RFC3161Timestamp
ts, err := blob.LoadFileOrURL(c.RFC3161TimestampPath)
if err != nil {
return err
}
if err := json.Unmarshal(ts, &rfc3161Timestamp); err != nil {
return err
}
opts = append(opts, static.WithRFC3161Timestamp(&rfc3161Timestamp))
}
// Set an SCT if provided via the CLI.
if c.SCTRef != "" {
sct, err := os.ReadFile(filepath.Clean(c.SCTRef))
if err != nil {
return fmt.Errorf("reading sct from file: %w", err)
}
co.SCT = sct
}
// Set a cert chain if provided.
var chainPEM []byte
switch {
case c.CertChain != "":
chain, err := loadCertChainFromFileOrURL(c.CertChain)
if err != nil {
return err
}
if chain == nil {
return errors.New("expected certificate chain in --certificate-chain")
}
// Set the last one in the co.RootCerts. This is trusted, as its passed in
// via the CLI.
if co.RootCerts == nil {
co.RootCerts = x509.NewCertPool()
}
co.RootCerts.AddCert(chain[len(chain)-1])
// Use the whole as the cert chain in the signature object.
// The last one is omitted because it is considered the "root".
chainPEM, err = cryptoutils.MarshalCertificatesToPEM(chain)
if err != nil {
return err
}
case c.CARoots != "":
// CA roots + possible intermediates are already loaded into co.RootCerts with the call to
// loadCertsKeylessVerification above.
}

// Gather the cert for the signature and add the cert along with the
// cert chain into the signature object.
var certPEM []byte
if cert != nil {
certPEM, err = cryptoutils.MarshalCertificateToPEM(cert)
if err != nil {
return err
}
opts = append(opts, static.WithCertChain(certPEM, chainPEM))
artifactPolicyOption = sgverify.WithArtifactDigest(alg, digest)
} else {
artifactPolicyOption = sgverify.WithArtifact(bytes.NewReader(blobBytes))
}

sig, err := base64signature(c.SigRef, c.BundlePath)
_, err = cosign.VerifyNewBundle(ctx, co, artifactPolicyOption, bundle)

@Hayden-IO Hayden-IO Aug 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For a later PR - we should implement the change mentioned in

cosign/pkg/cosign/verify_bundle.go

Lines 25 to 29 in 98ff280

func VerifyNewBundle(_ context.Context, co *CheckOpts, artifactPolicyOption verify.ArtifactPolicyOption, bundle verify.SignedEntity) (*verify.VerificationResult, error) {
// Copy co so rekorV2Bundle's UseSignedTimestamps write stays per-call and
// doesn't race a *CheckOpts shared across goroutines.
// TODO(cody)(cosign v4): Consider changing function signature to take a
// non-pointer CheckOpts and avoid this copy.
. We should move the function into an internal package as well when we do. I also think we could drop the first return value since no caller is using it.

if err != nil {
return err
}
signature, err := static.NewSignature(blobBytes, sig, opts...)
if err != nil {
return err
}
if _, err = cosign.VerifyBlobSignature(ctx, signature, co); err != nil {
return err
}

ui.Infof(ctx, "Verified OK")
return nil
}

// base64signature returns the base64 encoded signature
func base64signature(sigRef, bundlePath string) (string, error) {
var targetSig []byte
var err error
switch {
case sigRef != "":
targetSig, err = blob.LoadFileOrURL(sigRef)
if err != nil {
if !errors.Is(err, fs.ErrNotExist) {
// ignore if file does not exist, it can be a base64 encoded string as well
return "", err
}
targetSig = []byte(sigRef)
}
case bundlePath != "":
b, err := cosign.FetchLocalSignedPayloadFromPath(bundlePath)
if err != nil {
return "", err
}
targetSig = []byte(b.Base64Signature)
default:
return "", fmt.Errorf("missing flag '--signature'")
}

if isb64(targetSig) {
return string(targetSig), nil
}
return base64.StdEncoding.EncodeToString(targetSig), nil
}

func payloadBytes(blobRef string) ([]byte, error) {
var blobBytes []byte
var err error
Expand Down
Loading