CVE-2023-47122: Improper Verification of Cryptographic Signature (CWE-347)
value: Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via the Rekor API, instead of through the local TUF client. If the upstream Rekor server happened to be compromised, gitsign clients could potentially be tricked into trusting incorrect signatures. There is no known compromise the default public good instance (`rekor.sigstore.dev`) - anyone using this instance is unaffected. This issue was fixed in v0.8.0. No known workarounds are available.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 5.3
Published: 2023-11-10T22:15Z
Repository: https://github.com/sigstore/gitsign
Language: Go
Files changed: internal/commands/root/sign.go, internal/gitsign/gitsign.go, internal/rekor/client.go, pkg/rekor/option.go, pkg/rekor/rekor.go
Commit date: 2023-11-09 17:19:56 -0500
Commit message: Add options for Rekor client, make public key fetcher configurable. (#399)

Also makes the default public key fetcher match the behavior of cosign,
which also fixes a bug where verify was getting keys from Rekor
directly.

Signed-off-by: Billy Lynch <billy@chainguard.dev>
Diff: diff --git a/internal/commands/root/sign.go b/internal/commands/root/sign.go
index d1ff55a..1e9f3ec 100644
--- a/internal/commands/root/sign.go
+++ b/internal/commands/root/sign.go
@@ -71,11 +71,11 @@ func commandSign(o *options, s *gsio.Streams, args ...string) error {
 	dataBuf := new(bytes.Buffer)
 	if _, err = io.Copy(dataBuf, f); err != nil {
 		return fmt.Errorf("failed to read message from stdin: %w", err)
 	}
 
-	rekor, err := rekor.NewClient(o.Config.Rekor)
+	rekor, err := rekor.NewClientContext(ctx, o.Config.Rekor)
 	if err != nil {
 		return fmt.Errorf("failed to create rekor client: %w", err)
 	}
 
 	opts := signature.SignOptions{
diff --git a/internal/gitsign/gitsign.go b/internal/gitsign/gitsign.go
index fbf7b6f..b881bf0 100644
--- a/internal/gitsign/gitsign.go
+++ b/internal/gitsign/gitsign.go
@@ -72,11 +72,11 @@ func NewVerifierWithCosignOpts(ctx context.Context, cfg *config.Config, opts *co
 	)
 	if err != nil {
 		return nil, fmt.Errorf("error creating Git verifier: %w", err)
 	}
 
-	rekor, err := rekorinternal.NewClient(cfg.Rekor)
+	rekor, err := rekorinternal.NewClientContext(ctx, cfg.Rekor)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create rekor client: %w", err)
 	}
 
 	// Optionally include cert.Verifier.
diff --git a/internal/rekor/client.go b/internal/rekor/client.go
index 604ddc7..3d52fc2 100644
--- a/internal/rekor/client.go
+++ b/internal/rekor/client.go
@@ -13,13 +13,21 @@
 // limitations under the License.
 
 package rekor
 
 import (
+	"context"
+
 	gitrekor "github.com/sigstore/gitsign/pkg/rekor"
 	rekor "github.com/sigstore/rekor/pkg/client"
 )
 
 // NewClient returns a new Rekor client with common client options set.
+// Deprecated: Use NewClientContext instead.
 func NewClient(url string) (*gitrekor.Client, error) {
-	return gitrekor.New(url, rekor.WithUserAgent("gitsign"))
+	return NewClientContext(context.TODO(), url)
+}
+
+// NewClientContext returns a new Rekor client with common client options set.
+func NewClientContext(ctx context.Context, url string) (*gitrekor.Client, error) {
+	return gitrekor.NewWithOptions(ctx, url, gitrekor.WithClientOption(rekor.WithUserAgent("gitsign")))
 }
diff --git a/pkg/rekor/option.go b/pkg/rekor/option.go
new file mode 100644
index 0000000..36d3b12
--- /dev/null
+++ b/pkg/rekor/option.go
@@ -0,0 +1,45 @@
+//
+// Copyright 2023 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rekor
+
+import (
+	"context"
+
+	"github.com/sigstore/cosign/v2/pkg/cosign"
+	"github.com/sigstore/rekor/pkg/client"
+)
+
+type Option func(*options)
+
+type options struct {
+	rekorPublicKeys CosignRekorKeyProvider
+	clientOpts      []client.Option
+}
+
+// CosignRekorKeyProvider is a function that returns the Rekor public keys in cosign's specialized format.
+type CosignRekorKeyProvider func(ctx context.Context) (*cosign.TrustedTransparencyLogPubKeys, error)
+
+func WithCosignRekorKeyProvider(f CosignRekorKeyProvider) Option {
+	return func(o *options) {
+		o.rekorPublicKeys = f
+	}
+}
+
+func WithClientOption(opts ...client.Option) Option {
+	return func(o *options) {
+		o.clientOpts = opts
+	}
+}
diff --git a/pkg/rekor/rekor.go b/pkg/rekor/rekor.go
index 6d5a39e..d6bcdaa 100644
--- a/pkg/rekor/rekor.go
+++ b/pkg/rekor/rekor.go
@@ -41,11 +41,10 @@ import (
 	"github.com/sigstore/rekor/pkg/sharding"
 	"github.com/sigstore/rekor/pkg/types"
 	hashedrekord_v001 "github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1"
 	rekord_v001 "github.com/sigstore/rekor/pkg/types/rekord/v0.0.1"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
-	"github.com/sigstore/sigstore/pkg/tuf"
 )
 
 // Verifier represents a mechanism to get and verify Rekor entries for the given Git data.
 type Verifier interface {
 	Verify(ctx context.Context, commitSHA string, cert *x509.Certificate) (*models.LogEntryAnon, error)
@@ -62,16 +61,30 @@ type Writer interface {
 type Client struct {
 	*client.Rekor
 	publicKeys *cosign.TrustedTransparencyLogPubKeys
 }
 
+// Deprecated: Use NewWithOptions instead.
 func New(url string, opts ...rekor.Option) (*Client, error) {
-	c, err := rekor.GetRekorClient(url, opts...)
+	return NewWithOptions(context.TODO(), url, WithClientOption(opts...))
+}
+
+func NewWithOptions(ctx context.Context, url string, opts ...Option) (*Client, error) {
+	// Defaults
+	o := &options{
+		rekorPublicKeys: cosign.GetRekorPubs,
+	}
+	for _, f := range opts {
+		f(o)
+	}
+
+	c, err := rekor.GetRekorClient(url, o.clientOpts...)
 	if err != nil {
 		return nil, err
 	}
-	pubs, err := rekorPubsFromClient(c)
+
+	pubs, err := o.rekorPublicKeys(ctx)
 	if err != nil {
 		return nil, err
 	}
 	return &Client{
 		Rekor:      c,
@@ -156,25 +169,10 @@ func (c *Client) findTLogEntriesByPayloadAndPK(ctx context.Context, payload, pub
 		return nil, err
 	}
 	return searchIndex.GetPayload(), nil
 }
 
-// rekorPubsFromClient returns a RekorPubKey keyed by the log ID from the Rekor client.
-// NOTE: This **must not** be used in the verification path, but may be used in the
-// sign path to validate return responses are consistent from Rekor.
-func rekorPubsFromClient(rekorClient *client.Rekor) (*cosign.TrustedTransparencyLogPubKeys, error) {
-	publicKeys := cosign.NewTrustedTransparencyLogPubKeys()
-	pubOK, err := rekorClient.Pubkey.GetPublicKey(nil)
-	if err != nil {
-		return nil, fmt.Errorf("unable to fetch rekor public key from rekor: %w", err)
-	}
-	if err := publicKeys.AddTransparencyLogPubKey([]byte(pubOK.Payload), tuf.Active); err != nil {
-		return nil, fmt.Errorf("constructRekorPubKey: %w", err)
-	}
-	return &publicKeys, nil
-}
-
 // Verify verifies a commit using online verification.
 //
 // This is done by:
 // 1. Searching Rekor for an entry matching the commit SHA + cert.
 // 2. Use the same cert to verify the commit content.

Vulnerable code: 	rekor, err := rekor.NewClient(o.Config.Rekor)
	rekor, err := rekorinternal.NewClient(cfg.Rekor)
	return gitrekor.New(url, rekor.WithUserAgent("gitsign"))
	"github.com/sigstore/sigstore/pkg/tuf"
	c, err := rekor.GetRekorClient(url, opts...)
	pubs, err := rekorPubsFromClient(c)
// rekorPubsFromClient returns a RekorPubKey keyed by the log ID from the Rekor client.
// NOTE: This **must not** be used in the verification path, but may be used in the
// sign path to validate return responses are consistent from Rekor.
func rekorPubsFromClient(rekorClient *client.Rekor) (*cosign.TrustedTransparencyLogPubKeys, error) {
	publicKeys := cosign.NewTrustedTransparencyLogPubKeys()
	pubOK, err := rekorClient.Pubkey.GetPublicKey(nil)
	if err != nil {
		return nil, fmt.Errorf("unable to fetch rekor public key from rekor: %w", err)
	}
	if err := publicKeys.AddTransparencyLogPubKey([]byte(pubOK.Payload), tuf.Active); err != nil {
		return nil, fmt.Errorf("constructRekorPubKey: %w", err)
	}
	return &publicKeys, nil
}

Fixed code: 	rekor, err := rekor.NewClientContext(ctx, o.Config.Rekor)
	rekor, err := rekorinternal.NewClientContext(ctx, cfg.Rekor)
	"context"

// Deprecated: Use NewClientContext instead.
	return NewClientContext(context.TODO(), url)
}

// NewClientContext returns a new Rekor client with common client options set.
func NewClientContext(ctx context.Context, url string) (*gitrekor.Client, error) {
	return gitrekor.NewWithOptions(ctx, url, gitrekor.WithClientOption(rekor.WithUserAgent("gitsign")))
//
// Copyright 2023 The Sigstore Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package rekor

import (
	"context"

	"github.com/sigstore/cosign/v2/pkg/cosign"
	"github.com/sigstore/rekor/pkg/client"
)

type Option func(*options)

type options struct {
	rekorPublicKeys CosignRekorKeyProvider
	clientOpts      []client.Option
}

// CosignRekorKeyProvider is a function that returns the Rekor public keys in cosign's specialized format.
type CosignRekorKeyProvider func(ctx context.Context) (*cosign.TrustedTransparencyLogPubKeys, error)

func WithCosignRekorKeyProvider(f CosignRekorKeyProvider) Option {
	return func(o *options) {
		o.rekorPublicKeys = f
	}
}

func WithClientOption(opts ...client.Option) Option {
	return func(o *options) {
		o.clientOpts = opts
	}
}
// Deprecated: Use NewWithOptions instead.
	return NewWithOptions(context.TODO(), url, WithClientOption(opts...))
}

func NewWithOptions(ctx context.Context, url string, opts ...Option) (*Client, error) {
	// Defaults
	o := &options{
		rekorPublicKeys: cosign.GetRekorPubs,
	}
	for _, f := range opts {
		f(o)
	}

	c, err := rekor.GetRekorClient(url, o.clientOpts...)

	pubs, err := o.rekorPublicKeys(ctx)