-
Notifications
You must be signed in to change notification settings - Fork 134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Embed SCTs in issued certificates #507
Conversation
If you want to take a look, please only review the second commit! Waiting until we submit #496. |
e988e8c
to
7319579
Compare
Codecov Report
@@ Coverage Diff @@
## main #507 +/- ##
==========================================
+ Coverage 43.32% 43.91% +0.58%
==========================================
Files 18 16 -2
Lines 1221 1273 +52
==========================================
+ Hits 529 559 +30
- Misses 617 633 +16
- Partials 75 81 +6
Continue to review full report at Codecov.
|
7319579
to
8a1ae74
Compare
How will this rollout work? Can cosign support both for awhile? |
#42 (comment) - Cosign will need to be updated to support both. It'll conditionally check if the SCT is embedded or in a header, and verify based on that. Then we can rollout this change, but it'll be a breaking change for anyone who hasn't updated Cosign. It's not possible for the current version of Cosign to successfully verify a certificate with an embedded SCT (because an SCT is signed using the To-Be-Signed portion of a certificate and removing either the poison ext or the SCT ext, and you need to set a flag for the verifier to remove an ext when verifying). |
Cool! OK, so we can change cosign to support both, get a release out with a version bump (1.8?), then deploy this change. |
5e3c6c0
to
54478e8
Compare
This adds support for embedding SCTs in certificates instead of returning a header with a detached SCTs. This is done by implementing an SCT interface for a signer. For example, GCP CA Service will not support embedded SCTs, but KMS will. This heavily leverages the Go CT library. I've removed the custom client in favor of the CT library client, which includes more verification and retry logic. Note that there's a TODO to include the public key of the CT log in Fulcio so that the SCT is checked before returning a response. A certificate is signed twice, which adds an extra remote call to KMS. The first certificate is added to the CT log via AddPreChain instead of AddChain. The Cosign client will need to be updated to support embedded SCTs. Signed-off-by: Hayden Blauzvern <[email protected]>
This is because Cosign expects an AddChainResponse and not an SCT. The new client returns an SCT instead, so we have to manually convert it. Signed-off-by: Hayden Blauzvern <[email protected]>
54478e8
to
0766220
Compare
Do we have an issue or PR in flight to add support to cosign for verifying both? |
sigstore/cosign#1730 for the issue, sigstore/cosign#1731 for the WIP PR - The logic is all there, just working on testing (generating SCTs in tests is fun!) |
Any other comments, or can this be submitted? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
generally LGTM, a couple questions inline
PEM encoding handles adding a newline. Signed-off-by: Hayden Blauzvern <[email protected]>
Signed-off-by: Hayden Blauzvern <[email protected]>
I'll defer on submitting this one to @priyawadhwa and @k4leung4. The code is fine, but if we submit this before the cosign 1.8 release we won't be able to deploy the main branch to prod, making it a bit unsafe. |
We can deploy the main branch to prod, this only affects the intermediate CA implementation, which is not what’s rolled out in prod. The CA Service CA will continue to return detached SCTs. |
Is the plan to switch to the intermediate CA implementation when we migrate clusters in prod? |
I wanted to switch once we cut 1.8. Though if you prefer, I’m happy to do testing in staging first. |
Ahh, got it. |
This can merge now then @bobcallaway can rebase :) |
Summary
This adds support for embedding SCTs in certificates instead of
returning a header with a detached SCTs. This is done by implementing an
SCT interface for a signer. For example, GCP CA Service will not
support embedded SCTs, but KMS will.
This heavily leverages the Go CT library. I've removed the custom
client in favor of the CT library client, which includes more
verification and retry logic. Note that there's a TODO to include the
public key of the CT log in Fulcio so that the SCT is checked before
returning a response.
A certificate is signed twice, which adds an extra remote call to KMS.
The first certificate is added to the CT log via AddPreChain instead of
AddChain.
The Cosign client will need to be updated to support embedded SCTs.
Signed-off-by: Hayden Blauzvern [email protected]
Ticket Link
Fixes #42, #310
Release Note