Skip to content

Commit d7c6718

Browse files
Mikhail Swiftcolek42
authored andcommitted
bug: fix verification fail when policy contains multiple pubkeys
The DSSE code failed early if a verifier failed to successfully verify an envelope. This caused the policy verification code to incorrectly report that the policy failed verification. Signed-off-by: Mikhail Swift <mikhail@testifysec.com>
1 parent 90b2da9 commit d7c6718

13 files changed

Lines changed: 654 additions & 511 deletions

File tree

.github/workflows/golangci-lint.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,4 @@ jobs:
2020
uses: golangci/golangci-lint-action@v2
2121
with:
2222
version: latest
23+
args: --timeout=3m

.github/workflows/release.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ jobs:
44
test:
55
strategy:
66
matrix:
7-
go-version: [ 1.17.x ]
7+
go-version: [ 1.18.x ]
88
os: [ ubuntu-latest ]
99
runs-on: ${{ matrix.os }}
1010
steps:
@@ -47,7 +47,7 @@ jobs:
4747
- name: Set up Go
4848
uses: actions/setup-go@v2
4949
with:
50-
go-version: 1.17
50+
go-version: 1.18
5151
- uses: actions/cache@v2
5252
with:
5353
path: |

.github/workflows/verify-docgen.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,5 @@ jobs:
1313
- uses: actions/checkout@v2
1414
- uses: actions/setup-go@v2
1515
with:
16-
go-version: '1.17.x'
16+
go-version: '1.18.x'
1717
- run: ./docgen/verify.sh

.github/workflows/verify-licence.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
- uses: actions/checkout@v2
1313
- uses: actions/setup-go@v2
1414
with:
15-
go-version: '1.17.x'
15+
go-version: '1.18.x'
1616
- name: Install addlicense
1717
run: go install github.com/google/addlicense@latest
1818
- name: Check license headers

go.mod

Lines changed: 130 additions & 91 deletions
Large diffs are not rendered by default.

go.sum

Lines changed: 392 additions & 407 deletions
Large diffs are not rendered by default.

test/.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
*.attestation.json
2+
policy-signed.json
3+
testapp
4+
testapp.tar.tgz

test/failkey.pem

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN EC PRIVATE KEY-----
2+
MHcCAQEEIEBmgB/Xwk5lvG9MZxMvKDrFlyMhjlzpfd27y0Hp7WgzoAoGCCqGSM49
3+
AwEHoUQDQgAEnE5sMbtWZ7uxSSwVu231xRfaDkLyGRBqCdVRnF+U92EaN3Eu08f4
4+
jTNk8G5nZm/0bEvjswy4MvlYeS9Gzmg26A==
5+
-----END EC PRIVATE KEY-----

test/policy.json

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,44 @@
2828
"publickeyid": "ae2dcc989ea9c109a36e8eba5c4bc16d8fafcfe8e1a614164670d50aedacd647"
2929
}
3030
]
31+
},
32+
"package": {
33+
"name": "package",
34+
"attestations": [
35+
{
36+
"type": "https://witness.dev/attestations/material/v0.1",
37+
"regopolicies": []
38+
},
39+
{
40+
"type": "https://witness.dev/attestations/command-run/v0.1",
41+
"regopolicies": [
42+
{
43+
"name": "expected command",
44+
"module": "cGFja2FnZSBjb21tYW5kcnVuLmNtZAoKZGVueVttc2ddIHsKCWlucHV0LmNtZCAhPSBbInRhciIsICJjemYiLCAiLi90ZXN0YXBwLnRhci50Z3oiLCAiLi90ZXN0YXBwIl0KCW1zZyA6PSAidW5leHBlY3RlZCBjbWQiCn0K"
45+
}
46+
]
47+
},
48+
{
49+
"type": "https://witness.dev/attestations/product/v0.1",
50+
"regopolicies": []
51+
}
52+
],
53+
"functionaries": [
54+
{
55+
"type": "publickey",
56+
"publickeyid": "5e8c57df8ae58fe9a29b29f9993e2fc3b25bd75eb2754f353880bad4b9ebfdb3"
57+
}
58+
]
3159
}
3260
},
3361
"publickeys": {
3462
"ae2dcc989ea9c109a36e8eba5c4bc16d8fafcfe8e1a614164670d50aedacd647": {
3563
"keyid": "ae2dcc989ea9c109a36e8eba5c4bc16d8fafcfe8e1a614164670d50aedacd647",
3664
"key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQWYyOW9QUDhVZ2hCeUc4NTJ1QmRPeHJKS0tuN01NNWhUYlA5ZXNnT1ovazA9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo="
65+
},
66+
"5e8c57df8ae58fe9a29b29f9993e2fc3b25bd75eb2754f353880bad4b9ebfdb3": {
67+
"keyid": "5e8c57df8ae58fe9a29b29f9993e2fc3b25bd75eb2754f353880bad4b9ebfdb3",
68+
"key": "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUFvRTZ6TDdvMG5jY3ZLbjBJVFNEUApSWUFhTnR6ZlYzOVJaUVh1aTVpTXljTWFzU3JWR2Y3bEhKTFR2YWZrQWNMU3huY3RTdWdad3prMlo4a2FjK0FkCksxV2cwemtBd2VocjJzVVZ1cWY5d0ZQTUdueWVJUXJQTnhtY1hGbnp5WjZ3ZTRxQnBVQmhrdGZacWI5bm05cUUKVDA4SmJvUkdVdlpHamx3ckloZmJYR2RTYnA2cG1XQUVqNUdWOUd0bGswTWg4YmFrNUxid3hyZUYzVXZhUE1sSwpWVWdsNDVFYVYxWVpRWjI3NmFVSStpWitnMnh1QjlyTGd5a04vUlZMSUh5VDAyS0xBYXo5K0xONkVhaEQzWHFICkptUlVJZmsyQ0VlZTBiUHJIL0c2Z21HRVoxQ1dLL3dMQ2hsMkVpOU5MYnUvMjIzZSt0TVpmc1MvU0RrR1hlQ3UKR3BTUzgrK3VyYkpFZnkyZEpsUitiOGlCMzV0bldSOVhNUTRzV0MwanBIQW53Rm1ZOXNQTTMweEl2QnJ6TElRdwpHK1FDTXBhRFlDMGhXakJzb09WT0xpbnJCSDFXSGVmTEdWdWRmQ2Y4d1pXNzUrRnpPRHRhMG5lWERYWVRCU2FFCmVDb2NGUStLTTJsaDhlTjFIb1pjTkZ2TzhhTCttWkNQSTFXOTUwMTlzeVFmTWgrekhLeDNZV3VnZjNvbjAycHQKSGV6TlZjQTYrVkQ2WnJpNGVpZEkranBjamdOek16bnRzSWQ4RFpUdWVPRXVHdUZFY1MrTlFnNnhtRzQzVHRtNgpwVmwzakFidEVBbEwzeUpPaTF4b1M1Zm12bFNPTlVEbmhYckxLNkpXTnh6YU04RlBFVndzbXRLcXdoaS84Tk4rCmpCTXpqREtaQmdqOXFuekJXSHdONWxjQ0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo="
3769
}
3870
}
3971
}

test/test.sh

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,25 @@ set -e
1818
DIR="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
1919
. "$DIR/common.sh"
2020

21-
if ! checkprograms make ; then
21+
if ! checkprograms make tar ; then
2222
exit 1
2323
fi
2424

25-
26-
2725
make -C ../ build
28-
rm -f ./test-attestation.demo ./testapp ./policy-signed.json
29-
../bin/witness -c test.yaml run -- go build -o=testapp .
30-
../bin/witness -c test.yaml sign -f policy.json
26+
rm -f ./policy-signed.json ./build.attestation.json ./package.attestation.json ./fail.attestation.json ./testapp ./testapp.tar.tgz
27+
../bin/witness -c test.yaml -l debug sign -f policy.json
28+
29+
# successful test
30+
../bin/witness -c test.yaml run -o build.attestation.json -- go build -o=testapp .
31+
../bin/witness -c test.yaml run -s package -k ./testkey2.pem -o package.attestation.json -- tar czf ./testapp.tar.tgz ./testapp
3132
../bin/witness -c test.yaml verify
33+
34+
# make sure we fail if we run with a key not in the policy
35+
../bin/witness -c test.yaml run -k failkey.pem -o ./fail.attestation.json -- go build -o=testapp .
36+
../bin/witness -c test.yaml run -s package -k ./testkey2.pem -o package.attestation.json -- tar czf ./testapp.tar.tgz ./testapp
37+
set +e
38+
../bin/witness -c test.yaml verify -a ./fail.attestation.json -a ./package.attestation.json
39+
if [ $? -eq 0 ]; then
40+
echo "expected verify to fail"
41+
exit 1
42+
fi

0 commit comments

Comments
 (0)