Skip to content

Commit b3d9e87

Browse files
Hayden-IOHayden-IO
committed
Change default CLI upload type to hashedrekord
This change sets the default `--type` flag to `hashedrekord` in rekor-cli, along with changing the default `--pkiFormat` flag to x509 (which is certificates and public keys). This is done in a backwards compatible way, in that a client can continue to pass an artifact via --artifact and it will automatically be hashed if the type is hashedrekord. While the PKI flag change is a breaking change, I doubt anyone was using pgp, which was the default. Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>
1 parent 0a635ec commit b3d9e87

10 files changed

Lines changed: 88 additions & 15 deletions

‎cmd/rekor-cli/app/pflag_groups.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,22 @@
1616
package app
1717

1818
import (
19+
"context"
20+
"crypto/sha256"
1921
"encoding/base64"
22+
"encoding/hex"
2023
"errors"
2124
"fmt"
25+
"io"
2226
"net/url"
27+
"os"
28+
"path/filepath"
2329
"strings"
2430

31+
"github.com/sigstore/rekor/pkg/log"
2532
"github.com/sigstore/rekor/pkg/pki"
2633
"github.com/sigstore/rekor/pkg/types"
34+
"github.com/sigstore/rekor/pkg/util"
2735
"github.com/spf13/cobra"
2836
"github.com/spf13/viper"
2937
)
@@ -132,6 +140,30 @@ func CreatePropsFromPflags() *types.ArtifactProperties {
132140
}
133141

134142
props.ArtifactHash = viper.GetString("artifact-hash")
143+
typeStr := viper.GetString("type")
144+
if props.ArtifactHash == "" && strings.HasPrefix(typeStr, "hashedrekord") {
145+
if props.ArtifactPath != nil {
146+
var artifactReader io.ReadCloser
147+
var err error
148+
if props.ArtifactPath.IsAbs() {
149+
artifactReader, err = util.FileOrURLReadCloser(context.Background(), props.ArtifactPath.String(), nil)
150+
} else {
151+
artifactReader, err = os.Open(filepath.Clean(props.ArtifactPath.Path))
152+
}
153+
if err == nil {
154+
defer artifactReader.Close()
155+
artifactBytes, err := io.ReadAll(artifactReader)
156+
if err == nil {
157+
h := sha256.Sum256(artifactBytes)
158+
props.ArtifactHash = hex.EncodeToString(h[:])
159+
} else {
160+
log.CliLogger.Fatalf("error reading artifact file: %v", err)
161+
}
162+
} else {
163+
log.CliLogger.Fatalf("error opening artifact file: %v", err)
164+
}
165+
}
166+
}
135167

136168
signatureString := viper.GetString("signature")
137169
if signatureString != "" {

‎cmd/rekor-cli/app/pflags.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,11 +120,11 @@ func initializePFlagMap() {
120120
}
121121
return nil
122122
}
123-
return valueFactory(pkiFormatFlag, pkiFormatValidator, "pgp")
123+
return valueFactory(pkiFormatFlag, pkiFormatValidator, "x509")
124124
},
125125
typeFlag: func() pflag.Value {
126126
// this ensures the type of the log entry matches a type supported in the CLI
127-
return valueFactory(typeFlag, validateTypeFlag, "rekord")
127+
return valueFactory(typeFlag, validateTypeFlag, "hashedrekord")
128128
},
129129
fileFlag: func() pflag.Value {
130130
// this validates that the file exists and can be opened by the current uid

‎cmd/rekor-cli/app/pflags_test.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ func TestArtifactPFlags(t *testing.T) {
3838
artifact string
3939
signature string
4040
publicKey string
41+
pkiFormat string
4142
multiPublicKey []string
4243
uuid string
4344
aad string
@@ -91,12 +92,14 @@ func TestArtifactPFlags(t *testing.T) {
9192
tests := []test{
9293
{
9394
caseDesc: "valid rekord file",
95+
typeStr: "rekord",
9496
entry: "tests/rekor.json",
9597
expectParseSuccess: true,
9698
expectValidateSuccess: true,
9799
},
98100
{
99101
caseDesc: "valid rekord URL",
102+
typeStr: "rekord",
100103
entry: testServer.URL + "/rekord",
101104
expectParseSuccess: true,
102105
expectValidateSuccess: true,
@@ -146,21 +149,35 @@ func TestArtifactPFlags(t *testing.T) {
146149
},
147150
{
148151
caseDesc: "non-existent rekord file",
152+
typeStr: "rekord",
149153
entry: "tests/not_there.json",
150154
expectParseSuccess: false,
151155
expectValidateSuccess: false,
152156
},
153157
{
154158
caseDesc: "non-existent rekord url",
159+
typeStr: "rekord",
155160
entry: testServer.URL + "/not_found",
156161
expectParseSuccess: true,
157162
expectValidateSuccess: false,
158163
},
159164
{
160165
caseDesc: "valid rekord - local artifact with required flags",
166+
typeStr: "rekord",
161167
artifact: "tests/test_file.txt",
162168
signature: "tests/test_file.sig",
163169
publicKey: "tests/test_public_key.key",
170+
pkiFormat: "pgp",
171+
expectParseSuccess: true,
172+
expectValidateSuccess: true,
173+
},
174+
{
175+
caseDesc: "valid hashedrekord - local artifact without hash flag",
176+
typeStr: "hashedrekord",
177+
artifact: "tests/test_x509_artifact.txt",
178+
signature: "tests/test_x509.sig",
179+
publicKey: "tests/test_x509_public_key.pem",
180+
pkiFormat: "x509",
164181
expectParseSuccess: true,
165182
expectValidateSuccess: true,
166183
},
@@ -252,9 +269,11 @@ func TestArtifactPFlags(t *testing.T) {
252269
},
253270
{
254271
caseDesc: "valid rekord - remote artifact with required flags",
272+
typeStr: "rekord",
255273
artifact: testServer.URL + "/artifact",
256274
signature: "tests/test_file.sig",
257275
publicKey: "tests/test_public_key.key",
276+
pkiFormat: "pgp",
258277
expectParseSuccess: true,
259278
expectValidateSuccess: true,
260279
},
@@ -423,6 +442,9 @@ func TestArtifactPFlags(t *testing.T) {
423442
if tc.publicKey != "" {
424443
args = append(args, "--public-key", tc.publicKey)
425444
}
445+
if tc.pkiFormat != "" {
446+
args = append(args, "--pki-format", tc.pkiFormat)
447+
}
426448
if len(tc.multiPublicKey) > 0 {
427449
for _, key := range tc.multiPublicKey {
428450
args = append(args, "--public-key", key)

‎cmd/rekor-cli/app/tests/test_x509.sig‎

512 Bytes
Binary file not shown.

‎cmd/rekor-cli/app/tests/test_x509_artifact.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
hello world

‎cmd/rekor-cli/app/tests/test_x509_public_key.pem‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAmMjFy9JE4YyBRGkljhPK
3+
Q/6OWz+b5wS2mKhhHBuXHxzLkuBbPte2UOV7dbg11He1koaw1P4BXhiP2qUQNsWp
4+
IzFEDvQyumCkoq3/2ojF5Y/752xXc1JDvawlCANWwqMcxQn6bWOUOq8TOMYj26rJ
5+
CvSIPGNPHAbSs8WB62OZDvwp9WCgRLAR3OBmkbLoNyPSpm/bfbQ/rz8omxoZRFhC
6+
gSi6a5/JWpsSWwexe9VYtPfjIGfnIRy+JEa8U+fdEAVqJgx7+2+Gfg7y1NvCz0z3
7+
0TPAGJPKJlM+KtkcdSoNCxGEMZKqWqdVaRkKWO9NEiFIFoPdYu9h9vl9IY0xamjL
8+
cahd151y/E93Fs4VKCM5tspJnZq8S7LI4R+FQHaOnoXLpi0djzOoqmzXWzPsZw8a
9+
6prWPFk/AmpD00EEj3/pkWuocdb+9ugW+2xPuOhTlc8NjbCEhJaehxAOH3oIQH5q
10+
wSbaoKbaw8dhBTInd0vOKMqzaofBa41tGiKUmY2a5j1VLAoqtQfcITR1FvUVOacR
11+
BWcOx4BZ57omBLhtpuaYeogHD2fa6DFL2llEg9K1RSRR/12uGZf/Zb+UXDS3VoIm
12+
4kaNQAeHlCXtOSPvFfO/042QGDI/W/m0ldClty0OwJr9ePqvj+UURRYEgZcDSOx0
13+
J/np1UhM0F4VszzqPx5Q0GsCAwEAAQ==
14+
-----END PUBLIC KEY-----

‎tests/cleanup-index-test.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ make_entries() {
3838
echo test${i} > $testdir/blob${i}
3939
minisign -S -s $testdir/mini${i}.key -m $testdir/blob${i}
4040
rekor-cli --rekor_server $REKOR_ADDRESS upload \
41+
--type=rekord \
4142
--artifact $testdir/blob${i} \
4243
--pki-format=minisign \
4344
--public-key $testdir/mini${i}.pub \
@@ -51,6 +52,7 @@ make_entries() {
5152
set -e
5253
minisign -S -s $testdir/mini${key_index}.key -m $testdir/blob${i}
5354
rekor-cli --rekor_server $REKOR_ADDRESS upload \
55+
--type=rekord \
5456
--artifact $testdir/blob${i} \
5557
--pki-format=minisign \
5658
--public-key $testdir/mini${key_index}.pub \

‎tests/e2e_test.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -127,16 +127,16 @@ func TestDuplicates(t *testing.T) {
127127
}
128128

129129
// Now upload to rekor!
130-
out := runCli(t, "upload", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
130+
out := runCli(t, "upload", "--type=rekord", "--pki-format=pgp", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
131131
outputContains(t, out, "Created entry at")
132132

133133
// Now upload the same one again, we should get a dupe entry.
134-
out = runCli(t, "upload", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
134+
out = runCli(t, "upload", "--type=rekord", "--pki-format=pgp", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
135135
outputContains(t, out, "Entry already exists")
136136

137137
// Now do a new one, we should get a new entry
138138
createdPGPSignedArtifact(t, artifactPath, sigPath)
139-
out = runCli(t, "upload", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
139+
out = runCli(t, "upload", "--type=rekord", "--pki-format=pgp", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
140140
outputContains(t, out, "Created entry at")
141141
}
142142

@@ -160,7 +160,7 @@ func TestGetCLI(t *testing.T) {
160160
if err := ioutil.WriteFile(pubPath, []byte(publicKey), 0644); err != nil {
161161
t.Fatal(err)
162162
}
163-
out := runCli(t, "upload", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
163+
out := runCli(t, "upload", "--type=rekord", "--pki-format=pgp", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
164164
outputContains(t, out, "Created entry at")
165165

166166
uuid, err := sharding.GetUUIDFromIDString(getUUIDFromUploadOutput(t, out))
@@ -189,7 +189,7 @@ func TestGetCLI(t *testing.T) {
189189
out = runCli(t, "search", "--artifact", artifactPath)
190190
outputContains(t, out, uuid)
191191

192-
out = runCli(t, "search", "--public-key", pubPath)
192+
out = runCli(t, "search", "--pki-format=pgp", "--public-key", pubPath)
193193
outputContains(t, out, uuid)
194194

195195
artifactBytes, err := ioutil.ReadFile(artifactPath)
@@ -752,7 +752,7 @@ func TestSearchValidateTreeID(t *testing.T) {
752752
if err := ioutil.WriteFile(pubPath, []byte(publicKey), 0644); err != nil {
753753
t.Fatal(err)
754754
}
755-
out := runCli(t, "upload", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
755+
out := runCli(t, "upload", "--type=rekord", "--pki-format=pgp", "--artifact", artifactPath, "--signature", sigPath, "--public-key", pubPath)
756756
outputContains(t, out, "Created entry at")
757757

758758
uuid, err := sharding.GetUUIDFromIDString(getUUIDFromUploadOutput(t, out))
@@ -857,8 +857,8 @@ func TestSearchLogQuerySingleShard(t *testing.T) {
857857
}
858858

859859
// Now upload them to rekor!
860-
firstOut := runCli(t, "upload", "--artifact", firstArtifactPath, "--signature", firstSigPath, "--public-key", pubPath)
861-
secondOut := runCli(t, "upload", "--artifact", secondArtifactPath, "--signature", secondSigPath, "--public-key", pubPath)
860+
firstOut := runCli(t, "upload", "--type=rekord", "--pki-format=pgp", "--artifact", firstArtifactPath, "--signature", firstSigPath, "--public-key", pubPath)
861+
secondOut := runCli(t, "upload", "--type=rekord", "--pki-format=pgp", "--artifact", secondArtifactPath, "--signature", secondSigPath, "--public-key", pubPath)
862862

863863
firstEntryID := getUUIDFromUploadOutput(t, firstOut)
864864
firstUUID, _ := sharding.GetUUIDFromIDString(firstEntryID)

‎tests/index-test-utils.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ make_entries() {
2727
echo test${i} > $testdir/blob${i}
2828
minisign -S -s $testdir/mini${i}.key -m $testdir/blob${i}
2929
local rekor_out=$(rekor-cli --rekor_server $REKOR_ADDRESS upload \
30+
--type=rekord \
3031
--artifact $testdir/blob${i} \
3132
--pki-format=minisign \
3233
--public-key $testdir/mini${i}.pub \
@@ -43,6 +44,7 @@ make_entries() {
4344
set -e
4445
minisign -S -s $testdir/mini${key_index}.key -m $testdir/blob${i}
4546
rekor_out=$(rekor-cli --rekor_server $REKOR_ADDRESS upload \
47+
--type=rekord \
4648
--artifact $testdir/blob${i} \
4749
--pki-format=minisign \
4850
--public-key $testdir/mini${key_index}.pub \

‎tests/sharding-e2e-test.sh‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -118,16 +118,16 @@ waitForRekorServer
118118

119119
# Add some things to the tlog :)
120120
pushd tests
121-
$REKOR_CLI upload --artifact test_file.txt --signature test_file.sig --public-key test_public_key.key --rekor_server http://localhost:3000
121+
$REKOR_CLI upload --type=rekord --pki-format=pgp --artifact test_file.txt --signature test_file.sig --public-key test_public_key.key --rekor_server http://localhost:3000
122122
popd
123123

124124
# Make sure we can prove consistency
125125
$REKOR_CLI loginfo --rekor_server http://localhost:3000
126126

127127
# Add 2 more entries to the log
128128
pushd tests/sharding-testdata
129-
$REKOR_CLI upload --artifact file1 --signature file1.sig --pki-format=x509 --public-key=ec_public.pem --rekor_server http://localhost:3000
130-
$REKOR_CLI upload --artifact file2 --signature file2.sig --pki-format=x509 --public-key=ec_public.pem --rekor_server http://localhost:3000
129+
$REKOR_CLI upload --type=rekord --artifact file1 --signature file1.sig --pki-format=x509 --public-key=ec_public.pem --rekor_server http://localhost:3000
130+
$REKOR_CLI upload --type=rekord --artifact file2 --signature file2.sig --pki-format=x509 --public-key=ec_public.pem --rekor_server http://localhost:3000
131131
popd
132132

133133

@@ -219,7 +219,7 @@ check_log_index 2
219219

220220
# Add in a new entry to this shard
221221
pushd tests/sharding-testdata
222-
$REKOR_CLI upload --artifact file2 --signature file2.sig --pki-format=x509 --public-key=ec_public.pem --rekor_server http://localhost:3000
222+
$REKOR_CLI upload --type=rekord --artifact file2 --signature file2.sig --pki-format=x509 --public-key=ec_public.pem --rekor_server http://localhost:3000
223223
popd
224224
# Pass in the universal log_index & make sure it resolves
225225
check_log_index 3
@@ -266,7 +266,7 @@ stringsMatch $NUM_ELEMENTS "1"
266266

267267
# Make sure we can verify the entry we entered into the now-inactive shard
268268
pushd tests
269-
$REKOR_CLI verify --artifact test_file.txt --signature test_file.sig --public-key test_public_key.key --rekor_server http://localhost:3000
269+
$REKOR_CLI verify --type=rekord --pki-format=pgp --artifact test_file.txt --signature test_file.sig --public-key test_public_key.key --rekor_server http://localhost:3000
270270
popd
271271

272272
# -f makes sure we exit on failure

0 commit comments

Comments
 (0)