Skip to content

Commit 3234fa8

Browse files
tri-adamcclerget
tri-adam
authored and
cclerget
committed
fix: corpus image generation
Add OptSignWithoutPGPSignatureSalt, which disables randomization of signature generation, and use that in the corpus to generate images deterministically. Update corpus images and related golden files to reflect the signatures generated by the new version of go-crypto. Signed-off-by: Dave Dykstra <[email protected]>
1 parent e6d1064 commit 3234fa8

File tree

13 files changed

+65
-38
lines changed

13 files changed

+65
-38
lines changed

‎internal/app/siftool/testdata/TestApp_Info/DataSignature.golden

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@
33
Group ID: NONE
44
Linked ID: 1 (G)
55
Offset: 303104
6-
Size: 1054
6+
Size: 1048
77
Hash Type: SHA-256
88
Entity: 12045C8C0B1004D058DE4BEDA20C27EE7FF7BA84

‎internal/app/siftool/testdata/TestApp_List/OneGroupSignedPGP.golden

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ ID |GROUP |LINK |SIF POSITION (start-end) |TYPE
33
------------------------------------------------------------------------------
44
1 |1 |NONE |32768-32772 |FS (Raw/System/386)
55
2 |1 |NONE |36864-40960 |FS (Squashfs/*System/386)
6-
3 |NONE |1 (G) |40960-42014 |Signature (SHA-256)
6+
3 |NONE |1 (G) |40960-42008 |Signature (SHA-256)

‎internal/app/siftool/testdata/TestApp_List/TwoGroupsSignedPGP.golden

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,5 @@ ID |GROUP |LINK |SIF POSITION (start-end) |TYPE
44
1 |1 |NONE |32768-32772 |FS (Raw/System/386)
55
2 |1 |NONE |36864-40960 |FS (Squashfs/*System/386)
66
3 |2 |NONE |40960-303104 |FS (Ext3/System/amd64)
7-
4 |NONE |1 (G) |303104-304158 |Signature (SHA-256)
8-
5 |NONE |2 (G) |304158-305013 |Signature (SHA-256)
7+
4 |NONE |1 (G) |303104-304152 |Signature (SHA-256)
8+
5 |NONE |2 (G) |304152-305001 |Signature (SHA-256)

‎pkg/integrity/clearsign.go

+6-9
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Apptainer a Series of LF Projects LLC.
33
// For website terms of use, trademark policy, privacy policy and other
44
// project policies see https://lfprojects.org/policies
5-
// Copyright (c) 2020-2023, Sylabs Inc. All rights reserved.
5+
// Copyright (c) 2020-2024, Sylabs Inc. All rights reserved.
66
// This software is licensed under a 3-clause BSD license. Please consult the LICENSE.md file
77
// distributed with the sources of this project regarding your rights to use or distribute this
88
// software.
@@ -15,7 +15,6 @@ import (
1515
"crypto"
1616
"errors"
1717
"io"
18-
"time"
1918

2019
"github.com/ProtonMail/go-crypto/openpgp"
2120
"github.com/ProtonMail/go-crypto/openpgp/clearsign"
@@ -29,14 +28,12 @@ type clearsignEncoder struct {
2928
config *packet.Config
3029
}
3130

32-
// newClearsignEncoder returns an encoder that signs messages in clear-sign format using entity e.
33-
// If timeFunc is not nil, it is used to generate signature timestamps.
34-
func newClearsignEncoder(e *openpgp.Entity, timeFunc func() time.Time) *clearsignEncoder {
31+
// newClearsignEncoder returns an encoder that signs messages in clear-sign format using entity e,
32+
// according to config.
33+
func newClearsignEncoder(e *openpgp.Entity, config *packet.Config) *clearsignEncoder {
3534
return &clearsignEncoder{
36-
e: e,
37-
config: &packet.Config{
38-
Time: timeFunc,
39-
},
35+
e: e,
36+
config: config,
4037
}
4138
}
4239

‎pkg/integrity/clearsign_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Apptainer a Series of LF Projects LLC.
33
// For website terms of use, trademark policy, privacy policy and other
44
// project policies see https://lfprojects.org/policies
5-
// Copyright (c) 2020-2023, Sylabs Inc. All rights reserved.
5+
// Copyright (c) 2020-2024, Sylabs Inc. All rights reserved.
66
// This software is licensed under a 3-clause BSD license. Please consult the LICENSE.md file
77
// distributed with the sources of this project regarding your rights to use or distribute this
88
// software.
@@ -43,12 +43,12 @@ func Test_clearsignEncoder_signMessage(t *testing.T) {
4343
}{
4444
{
4545
name: "EncryptedKey",
46-
en: newClearsignEncoder(encrypted, fixedTime),
46+
en: newClearsignEncoder(encrypted, &packet.Config{Time: fixedTime}),
4747
wantErr: true,
4848
},
4949
{
5050
name: "OK",
51-
en: newClearsignEncoder(e, fixedTime),
51+
en: newClearsignEncoder(e, &packet.Config{Time: fixedTime}),
5252
de: newClearsignDecoder(openpgp.EntityList{e}),
5353
wantHash: crypto.SHA256,
5454
},

‎pkg/integrity/sign.go

+24-13
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Apptainer a Series of LF Projects LLC.
33
// For website terms of use, trademark policy, privacy policy and other
44
// project policies see https://lfprojects.org/policies
5-
// Copyright (c) 2020-2023, Sylabs Inc. All rights reserved.
5+
// Copyright (c) 2020-2024, Sylabs Inc. All rights reserved.
66
// This software is licensed under a 3-clause BSD license. Please consult the LICENSE.md file
77
// distributed with the sources of this project regarding your rights to use or distribute this
88
// software.
@@ -21,6 +21,7 @@ import (
2121
"time"
2222

2323
"github.com/ProtonMail/go-crypto/openpgp"
24+
"github.com/ProtonMail/go-crypto/openpgp/packet"
2425
"github.com/apptainer/sif/v2/pkg/sif"
2526
"github.com/sigstore/sigstore/pkg/signature"
2627
)
@@ -183,13 +184,14 @@ func (gs *groupSigner) sign(ctx context.Context) (sif.DescriptorInput, error) {
183184
}
184185

185186
type signOpts struct {
186-
ss []signature.Signer
187-
e *openpgp.Entity
188-
groupIDs []uint32
189-
objectIDs [][]uint32
190-
timeFunc func() time.Time
191-
deterministic bool
192-
ctx context.Context //nolint:containedctx
187+
ss []signature.Signer
188+
e *openpgp.Entity
189+
groupIDs []uint32
190+
objectIDs [][]uint32
191+
timeFunc func() time.Time
192+
deterministic bool
193+
ctx context.Context //nolint:containedctx
194+
withoutPGPSignatureSalt bool
193195
}
194196

195197
// SignerOpt are used to configure so.
@@ -261,6 +263,16 @@ func OptSignWithContext(ctx context.Context) SignerOpt {
261263
}
262264
}
263265

266+
// OptSignWithoutPGPSignatureSalt disables the addition of a salt notation for v4 and v5 PGP keys.
267+
// While this increases determinism, it should be used with caution as the salt notation increases
268+
// protection for certain kinds of attacks.
269+
func OptSignWithoutPGPSignatureSalt() SignerOpt {
270+
return func(so *signOpts) error {
271+
so.withoutPGPSignatureSalt = true
272+
return nil
273+
}
274+
}
275+
264276
// withGroupedObjects splits the objects represented by ids into object groups, and calls fn once
265277
// per object group.
266278
func withGroupedObjects(f *sif.FileImage, ids []uint32, fn func(uint32, []uint32) error) error {
@@ -343,11 +355,10 @@ func NewSigner(f *sif.FileImage, opts ...SignerOpt) (*Signer, error) {
343355
case so.ss != nil:
344356
en = newDSSEEncoder(so.ss)
345357
case so.e != nil:
346-
timeFunc := time.Now
347-
if so.timeFunc != nil {
348-
timeFunc = so.timeFunc
349-
}
350-
en = newClearsignEncoder(so.e, timeFunc)
358+
en = newClearsignEncoder(so.e, &packet.Config{
359+
Time: so.timeFunc,
360+
NonDeterministicSignaturesViaNotation: packet.BoolPointer(!so.withoutPGPSignatureSalt),
361+
})
351362
commonOpts = append(commonOpts, optSignGroupFingerprint(so.e.PrimaryKey.Fingerprint))
352363
default:
353364
return nil, fmt.Errorf("integrity: %w", ErrNoKeyMaterial)

‎pkg/integrity/sign_test.go

+22-4
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Apptainer a Series of LF Projects LLC.
33
// For website terms of use, trademark policy, privacy policy and other
44
// project policies see https://lfprojects.org/policies
5-
// Copyright (c) 2020-2023, Sylabs Inc. All rights reserved.
5+
// Copyright (c) 2020-2024, Sylabs Inc. All rights reserved.
66
// This software is licensed under a 3-clause BSD license. Please consult the LICENSE.md file
77
// distributed with the sources of this project regarding your rights to use or distribute this
88
// software.
@@ -20,6 +20,7 @@ import (
2020
"testing"
2121

2222
"github.com/ProtonMail/go-crypto/openpgp"
23+
"github.com/ProtonMail/go-crypto/openpgp/packet"
2324
"github.com/apptainer/sif/v2/pkg/sif"
2425
)
2526

@@ -199,7 +200,7 @@ func TestNewGroupSigner(t *testing.T) {
199200

200201
for _, tt := range tests {
201202
t.Run(tt.name, func(t *testing.T) {
202-
en := newClearsignEncoder(getTestEntity(t), fixedTime)
203+
en := newClearsignEncoder(getTestEntity(t), &packet.Config{Time: fixedTime})
203204

204205
s, err := newGroupSigner(en, tt.fi, tt.groupID, tt.opts...)
205206
if got, want := err, tt.wantErr; !errors.Is(got, want) {
@@ -258,12 +259,12 @@ func TestGroupSigner_Sign(t *testing.T) {
258259
}
259260

260261
e := getTestEntity(t)
261-
clearsign := newClearsignEncoder(e, fixedTime)
262+
clearsign := newClearsignEncoder(e, &packet.Config{Time: fixedTime})
262263

263264
encrypted := getTestEntity(t)
264265
encrypted.PrivateKey.Encrypted = true
265266

266-
clearsignEncrypted := newClearsignEncoder(encrypted, fixedTime)
267+
clearsignEncrypted := newClearsignEncoder(encrypted, &packet.Config{Time: fixedTime})
267268

268269
tests := []struct {
269270
name string
@@ -453,6 +454,11 @@ func TestNewSigner(t *testing.T) {
453454
},
454455
wantErr: sif.ErrNoObjects,
455456
},
457+
{
458+
name: "NoKeyMaterial",
459+
fi: oneGroupImage,
460+
wantErr: ErrNoKeyMaterial,
461+
},
456462
{
457463
name: "InvalidObjectID",
458464
fi: oneGroupImage,
@@ -824,6 +830,18 @@ func TestSigner_Sign(t *testing.T) {
824830
OptVerifyWithKeyRing(openpgp.EntityList{e}),
825831
},
826832
},
833+
{
834+
name: "OptSignWithoutPGPSignatureSalt",
835+
inputFile: "one-group.sif",
836+
signOpts: []SignerOpt{
837+
OptSignWithEntity(e),
838+
OptSignWithTime(fixedTime),
839+
OptSignWithoutPGPSignatureSalt(),
840+
},
841+
verifyOpts: []VerifierOpt{
842+
OptVerifyWithKeyRing(openpgp.EntityList{e}),
843+
},
844+
},
827845
}
828846

829847
for _, tt := range tests {

‎pkg/siftool/testdata/Test_command_getInfo/Three/out.golden

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@
33
Group ID: NONE
44
Linked ID: 1 (G)
55
Offset: 40960
6-
Size: 1054
6+
Size: 1048
77
Hash Type: SHA-256
88
Entity: 12045C8C0B1004D058DE4BEDA20C27EE7FF7BA84

‎pkg/siftool/testdata/Test_command_getList/OneGroupSignedPGP/out.golden

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ ID |GROUP |LINK |SIF POSITION (start-end) |TYPE
33
------------------------------------------------------------------------------
44
1 |1 |NONE |32768-32772 |FS (Raw/System/386)
55
2 |1 |NONE |36864-40960 |FS (Squashfs/*System/386)
6-
3 |NONE |1 (G) |40960-42014 |Signature (SHA-256)
6+
3 |NONE |1 (G) |40960-42008 |Signature (SHA-256)

‎pkg/siftool/testdata/Test_command_getList/TwoGroupsSignedPGP/out.golden

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,5 @@ ID |GROUP |LINK |SIF POSITION (start-end) |TYPE
44
1 |1 |NONE |32768-32772 |FS (Raw/System/386)
55
2 |1 |NONE |36864-40960 |FS (Squashfs/*System/386)
66
3 |2 |NONE |40960-303104 |FS (Ext3/System/amd64)
7-
4 |NONE |1 (G) |303104-304158 |Signature (SHA-256)
8-
5 |NONE |2 (G) |304158-305013 |Signature (SHA-256)
7+
4 |NONE |1 (G) |303104-304152 |Signature (SHA-256)
8+
5 |NONE |2 (G) |304152-305001 |Signature (SHA-256)

‎test/images/gen_sifs.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Apptainer a Series of LF Projects LLC.
33
// For website terms of use, trademark policy, privacy policy and other
44
// project policies see https://lfprojects.org/policies
5-
// Copyright (c) 2020-2023, Sylabs Inc. All rights reserved.
5+
// Copyright (c) 2020-2024, Sylabs Inc. All rights reserved.
66
// This software is licensed under a 3-clause BSD license. Please consult the LICENSE.md file
77
// distributed with the sources of this project regarding your rights to use or distribute this
88
// software.
@@ -298,6 +298,7 @@ func generateImages() error {
298298
opts = append(opts,
299299
integrity.OptSignWithTime(func() time.Time { return time.Date(2020, 6, 30, 0, 1, 56, 0, time.UTC) }),
300300
integrity.OptSignDeterministic(),
301+
integrity.OptSignWithoutPGPSignatureSalt(),
301302
)
302303

303304
s, err := integrity.NewSigner(f, opts...)

‎test/images/one-group-signed-pgp.sif

-6 Bytes
Binary file not shown.

‎test/images/two-groups-signed-pgp.sif

-12 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)