Repository: sigstore/fulcio
Pull request #1815 (2024-09-25 18:40:07)

Update Tink library to v2
Now hosted in another org as well.

<!--
Thanks for opening a pull request! Please do not just delete this text.  The three fields below are mandatory.

Please remember to:
- This PR requires an issue. If it is a new feature, the issue should proceed the PR and will have allowed sufficient time for discussions to take place. Please use
issue tags such as "Closes #XYZ" or "Resolves sigstore/repo-name#XYZ".
  [documentation](https://docs.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)
- ensure your commits are signed-off, as sigstore uses the [DCO](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin) using `git commit -s`, or `git commit -s --amend` if you want to amend already existing commits
- lastly, ensure there are no merge commits!

Thank you :)
-->

#### Summary
<!--
 Explain the **motivation** for making this change. What existing problem does the pull request solve? How can reviewers test this PR?
-->

#### Release Note
<!--
Add a release note for each of the following conditions:

* Config changes (additions, deletions, updates)
* API additions—new endpoint, new response fields, or newly accepted request parameters
* Database changes (any)
* Websocket additions or changes
* Anything noteworthy to an administrator running private sigstore instances (err on the side of over-communicating)
* New features and improvements, including behavioural changes, UI changes and CLI changes
* Bug fixes and fixes of previous known issues
* Deprecation warnings, breaking changes, or compatibility notes

If no release notes are required write NONE. Use past-tense.

-->

#### Documentation
<!--

Does this change require an update to documentation? How will users implement your new feature?

Please reference a PR within https://docs.sigstore.dev

-->



Patch:
diff --git a/cmd/create_tink_keyset/create_tink_keyset.go b/cmd/create_tink_keyset/create_tink_keyset.go
index 99e1423..e115175 100644
--- a/cmd/create_tink_keyset/create_tink_keyset.go
+++ b/cmd/create_tink_keyset/create_tink_keyset.go
@@ -21,9 +21,9 @@ import (
 	"log"
 	"os"
 
-	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/signature"
 	"github.com/sigstore/fulcio/pkg/ca/tinkca"
+	"github.com/tink-crypto/tink-go/v2/keyset"
+	"github.com/tink-crypto/tink-go/v2/signature"
 )
 
 /*
diff --git a/cmd/fetch_ca_cert/fetch_ca_cert.go b/cmd/fetch_ca_cert/fetch_ca_cert.go
index 914ce5d..05b7912 100644
--- a/cmd/fetch_ca_cert/fetch_ca_cert.go
+++ b/cmd/fetch_ca_cert/fetch_ca_cert.go
@@ -28,9 +28,9 @@ import (
 
 	privateca "cloud.google.com/go/security/privateca/apiv1"
 	"cloud.google.com/go/security/privateca/apiv1/privatecapb"
-	"github.com/google/tink/go/keyset"
 	"github.com/sigstore/fulcio/pkg/ca/tinkca"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
+	"github.com/tink-crypto/tink-go/v2/keyset"
 	"google.golang.org/protobuf/types/known/durationpb"
 
 	// Register the provider-specific plugins
diff --git a/docs/how-certificate-issuing-works.md b/docs/how-certificate-issuing-works.md
index e305e8e..60fb718 100644
--- a/docs/how-certificate-issuing-works.md
+++ b/docs/how-certificate-issuing-works.md
@@ -76,7 +76,7 @@ certificate to the certificate authority root certificate.
 Fulcio supports several signing backends to sign certificates:
 
 - KMS: A KMS key hosted on GCP, AWS, Azure or Hashicorp
-- [Tink](https://github.com/google/tink): A secure KMS-encrypted Tink keyset created with [tinkey](https://github.com/google/tink/blob/master/docs/TINKEY.md)
+- [Tink](https://github.com/tink-crypto/): A secure KMS-encrypted Tink keyset created with [tinkey](https://github.com/tink-crypto/tink-tinkey)
 - PKCS#11: This works with any PKCS#11 devices including AWS CloudHSM,
   [softHSM](https://www.opendnssec.org/softhsm/) and others
 - [Google CA Service](https://cloud.google.com/certificate-authority-service/docs): A GCP-hosted certificate authority
diff --git a/go.mod b/go.mod
index 1da1aa7..cf96adf 100644
--- a/go.mod
+++ b/go.mod
@@ -13,10 +13,8 @@ require (
 	github.com/fsnotify/fsnotify v1.7.0
 	github.com/go-jose/go-jose/v4 v4.0.4
 	github.com/goadesign/goa v2.2.5+incompatible
-	github.com/golang/protobuf v1.5.4
 	github.com/google/certificate-transparency-go v1.2.1
 	github.com/google/go-cmp v0.6.0
-	github.com/google/tink/go v1.7.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.1-0.20210315223345-82c243799c99
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0
@@ -35,6 +33,9 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.19.0
 	github.com/spiffe/go-spiffe/v2 v2.3.0
+	github.com/tink-crypto/tink-go-awskms/v2 v2.1.0
+	github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0
+	github.com/tink-crypto/tink-go/v2 v2.2.0
 	go.step.sm/crypto v0.51.1
 	go.uber.org/zap v1.27.0
 	google.golang.org/api v0.195.0
@@ -88,6 +89,7 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-containerregistry v0.20.2 // indirect
 	github.com/google/s2a-go v0.1.8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
diff --git a/go.sum b/go.sum
index 1546188..fb3bf2f 100644
--- a/go.sum
+++ b/go.sum
@@ -166,8 +166,6 @@ github.com/google/go-containerregistry v0.20.2 h1:B1wPJ1SN/S7pB+ZAimcciVD+r+yV/l
 github.com/google/go-containerregistry v0.20.2/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
 github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
 github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
-github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
-github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -347,6 +345,12 @@ github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gtvVDbmPg=
 github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
+github.com/tink-crypto/tink-go-awskms/v2 v2.1.0 h1:N9UxlsOzu5mttdjhxkDLbzwtEecuXmlxZVo/ds7JKJI=
+github.com/tink-crypto/tink-go-awskms/v2 v2.1.0/go.mod h1:PxSp9GlOkKL9rlybW804uspnHuO9nbD98V/fDX4uSis=
+github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0 h1:3B9i6XBXNTRspfkTC0asN5W0K6GhOSgcujNiECNRNb0=
+github.com/tink-crypto/tink-go-gcpkms/v2 v2.2.0/go.mod h1:jY5YN2BqD/KSCHM9SqZPIpJNG/u3zwfLXHgws4x2IRw=
+github.com/tink-crypto/tink-go/v2 v2.2.0 h1:L2Da0F2Udh2agtKztdr69mV/KpnY3/lGTkMgLTVIXlA=
+github.com/tink-crypto/tink-go/v2 v2.2.0/go.mod h1:JJ6PomeNPF3cJpfWC0lgyTES6zpJILkAX0cJNwlS3xU=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
 github.com/ysmood/fetchup v0.2.3 h1:ulX+SonA0Vma5zUFXtv52Kzip/xe7aj4vqT5AJwQ+ZQ=
diff --git a/pkg/ca/tinkca/signer.go b/pkg/ca/tinkca/signer.go
index 2bb92e5..0a35d30 100644
--- a/pkg/ca/tinkca/signer.go
+++ b/pkg/ca/tinkca/signer.go
@@ -22,16 +22,15 @@ import (
 	"fmt"
 	"math/big"
 
-	signatureSubtle "github.com/google/tink/go/signature/subtle"
-	"github.com/google/tink/go/subtle"
-
-	"github.com/golang/protobuf/proto" //lint:ignore SA1019 needed for unmarshalling
-	"github.com/google/tink/go/insecurecleartextkeyset"
-	"github.com/google/tink/go/keyset"
-	commonpb "github.com/google/tink/go/proto/common_go_proto"
-	ecdsapb "github.com/google/tink/go/proto/ecdsa_go_proto"
-	ed25519pb "github.com/google/tink/go/proto/ed25519_go_proto"
-	tinkpb "github.com/google/tink/go/proto/tink_go_proto"
+	"github.com/tink-crypto/tink-go/v2/insecurecleartextkeyset"
+	"github.com/tink-crypto/tink-go/v2/keyset"
+	commonpb "github.com/tink-crypto/tink-go/v2/proto/common_go_proto"
+	ecdsapb "github.com/tink-crypto/tink-go/v2/proto/ecdsa_go_proto"
+	ed25519pb "github.com/tink-crypto/tink-go/v2/proto/ed25519_go_proto"
+	tinkpb "github.com/tink-crypto/tink-go/v2/proto/tink_go_proto"
+	signatureSubtle "github.com/tink-crypto/tink-go/v2/signature/subtle"
+	"github.com/tink-crypto/tink-go/v2/subtle"
+	"google.golang.org/protobuf/proto"
 )
 
 var (
@@ -54,7 +53,7 @@ func KeyHandleToSigner(kh *keyset.Handle) (crypto.Signer, error) {
 
 	switch k.GetTypeUrl() {
 	case ecdsaSignerTypeURL:
-		// https://github.com/google/tink/blob/9753ffddd4d04aa56e0605ff4a0db46f2fb80529/go/signature/ecdsa_signer_key_manager.go#L48
+		// https://github.com/tink-crypto/tink-go/blob/0aadc94a816408c4bdf95885b3c9860ecfd55fc0/signature/ecdsa/signer_key_manager.go#L48
 		privKey := new(ecdsapb.EcdsaPrivateKey)
 		if err := proto.Unmarshal(k.GetValue(), privKey); err != nil {
 			return nil, fmt.Errorf("error unmarshalling ecdsa private key: %w", err)
@@ -62,16 +61,19 @@ func KeyHandleToSigner(kh *keyset.Handle) (crypto.Signer, error) {
 		if err := validateEcdsaPrivKey(privKey); err != nil {
 			return nil, fmt.Errorf("error validating ecdsa private key: %w", err)
 		}
-		// https://github.com/google/tink/blob/9753ffddd4d04aa56e0605ff4a0db46f2fb80529/go/signature/subtle/ecdsa_signer.go#L39
+		// https://github.com/tink-crypto/tink-go/blob/0aadc94a816408c4bdf95885b3c9860ecfd55fc0/signature/subtle/ecdsa_signer.go#L37
 		_, curve, _ := getECDSAParamNames(privKey.PublicKey.Params)
 		p := new(ecdsa.PrivateKey)
 		c := subtle.GetCurve(curve)
+		if c == nil {
+			return nil, errors.New("tink ecdsa signer: invalid curve")
+		}
 		p.PublicKey.Curve = c
 		p.D = new(big.Int).SetBytes(privKey.GetKeyValue())
 		p.PublicKey.X, p.PublicKey.Y = c.ScalarBaseMult(privKey.GetKeyValue())
 		return p, nil
 	case ed25519SignerTypeURL:
-		// https://github.com/google/tink/blob/9753ffddd4d04aa56e0605ff4a0db46f2fb80529/go/signature/ed25519_signer_key_manager.go#L47
+		// https://github.com/tink-crypto/tink-go/blob/0aadc94a816408c4bdf95885b3c9860ecfd55fc0/signature/ed25519/signer_key_manager.go#L47
 		privKey := new(ed25519pb.Ed25519PrivateKey)
 		if err := proto.Unmarshal(k.GetValue(), privKey); err != nil {
 			return nil, fmt.Errorf("error unmarshalling ed25519 private key: %w", err)
@@ -79,7 +81,7 @@ func KeyHandleToSigner(kh *keyset.Handle) (crypto.Signer, error) {
 		if err := validateEd25519PrivKey(privKey); err != nil {
 			return nil, fmt.Errorf("error validating ed25519 private key: %w", err)
 		}
-		// https://github.com/google/tink/blob/9753ffddd4d04aa56e0605ff4a0db46f2fb80529/go/signature/subtle/ed25519_signer.go#L29
+		// https://github.com/tink-crypto/tink-go/blob/0aadc94a816408c4bdf95885b3c9860ecfd55fc0/signature/subtle/ed25519_signer.go#L27
 		p := ed25519.NewKeyFromSeed(privKey.GetKeyValue())
 		return p, nil
 	default:
@@ -98,10 +100,13 @@ func getPrimaryKey(ks *tinkpb.Keyset) *tinkpb.KeyData {
 }
 
 // validateEcdsaPrivKey validates the given ECDSAPrivateKey.
-// https://github.com/google/tink/blob/9753ffddd4d04aa56e0605ff4a0db46f2fb80529/go/signature/ecdsa_signer_key_manager.go#L139
+// https://github.com/tink-crypto/tink-go/blob/0aadc94a816408c4bdf95885b3c9860ecfd55fc0/signature/ecdsa/signer_key_manager.go#L151
 func validateEcdsaPrivKey(key *ecdsapb.EcdsaPrivateKey) error {
 	if err := keyset.ValidateKeyVersion(key.Version, uint32(ecdsaSignerKeyVersion)); err != nil {
-		return fmt.Errorf("ecdsa_signer_key_manager: invalid key: %w", err)
+		return fmt.Errorf("ecdsa: invalid key version in key: %s", err)
+	}
+	if err := keyset.ValidateKeyVersion(key.GetPublicKey().GetVersion(), uint32(ecdsaSignerKeyVersion)); err != nil {
+		return fmt.Errorf("ecdsa: invalid public version in key: %s", err)
 	}
 	hash, curve, encoding := getECDSAParamNames(key.PublicKey.Params)
 	return signatureSubtle.ValidateECDSAParams(hash, curve, encoding)
@@ -109,22 +114,22 @@ func validateEcdsaPrivKey(key *ecdsapb.EcdsaPrivateKey) error {
 
 // getECDSAParamNames returns the string representations of each parameter in
 // the given ECDSAParams.
-// https://github.com/google/tink/blob/4cc630dfc711555f6bbbad64f8c573b39b7af500/go/signature/proto.go#L26
+// https://github.com/tink-crypto/tink-go/blob/0aadc94a816408c4bdf95885b3c9860ecfd55fc0/signature/ecdsa/proto.go#L24
 func getECDSAParamNames(params *ecdsapb.EcdsaParams) (string, string, string) {
-	hashName := commonpb.HashType_name[int32(params.HashType)]
-	curveName := commonpb.EllipticCurveType_name[int32(params.Curve)]
-	encodingName := ecdsapb.EcdsaSignatureEncoding_name[int32(params.Encoding)]
+	hashName := commonpb.HashType_name[int32(params.GetHashType())]
+	curveName := commonpb.EllipticCurveType_name[int32(params.GetCurve())]
+	encodingName := ecdsapb.EcdsaSignatureEncoding_name[int32(params.GetEncoding())]
 	return hashName, curveName, encodingName
 }
 
 // validateEd25519PrivKey validates the given ED25519PrivateKey.
-// https://github.com/google/tink/blob/9753ffddd4d04aa56e0605ff4a0db46f2fb80529/go/signature/ed25519_signer_key_manager.go#L132
+// https://github.com/tink-crypto/tink-go/blob/0aadc94a816408c4bdf95885b3c9860ecfd55fc0/signature/ed25519/signer_key_manager.go#L157
 func validateEd25519PrivKey(key *ed25519pb.Ed25519PrivateKey) error {
 	if err := keyset.ValidateKeyVersion(key.Version, uint32(ed25519SignerKeyVersion)); err != nil {
-		return fmt.Errorf("ed25519_signer_key_manager: invalid key: %w", err)
+		return fmt.Errorf("ed25519: invalid key: %w", err)
 	}
 	if len(key.KeyValue) != ed25519.SeedSize {
-		return fmt.Errorf("ed2219_signer_key_manager: invalid key length, got %d", len(key.KeyValue))
+		return fmt.Errorf("ed25519: invalid key length, got %d", len(key.KeyValue))
 	}
 	return nil
 }
diff --git a/pkg/ca/tinkca/tinkca.go b/pkg/ca/tinkca/tinkca.go
index c6ba551..12568ee 100644
--- a/pkg/ca/tinkca/tinkca.go
+++ b/pkg/ca/tinkca/tinkca.go
@@ -26,11 +26,11 @@ import (
 	"github.com/sigstore/fulcio/pkg/ca/baseca"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 
-	"github.com/google/tink/go/core/registry"
-	"github.com/google/tink/go/integration/awskms"
-	"github.com/google/tink/go/integration/gcpkms"
-	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/tink"
+	"github.com/tink-crypto/tink-go-awskms/v2/integration/awskms"
+	"github.com/tink-crypto/tink-go-gcpkms/v2/integration/gcpkms"
+	"github.com/tink-crypto/tink-go/v2/core/registry"
+	"github.com/tink-crypto/tink-go/v2/keyset"
+	"github.com/tink-crypto/tink-go/v2/tink"
 )
 
 type tinkCA struct {
@@ -98,7 +98,7 @@ func GetPrimaryKey(ctx context.Context, kmsKey string) (tink.AEAD, error) {
 		registry.RegisterKMSClient(gcpClient)
 		return gcpClient.GetAEAD(kmsKey)
 	case strings.HasPrefix(kmsKey, "aws-kms://"):
-		awsClient, err := awskms.NewClient(kmsKey)
+		awsClient, err := awskms.NewClientWithOptions(kmsKey)
 		if err != nil {
 			return nil, err
 		}


Test patch:
diff --git a/pkg/ca/tinkca/signer_test.go b/pkg/ca/tinkca/signer_test.go
index fae2f75..dbc956a 100644
--- a/pkg/ca/tinkca/signer_test.go
+++ b/pkg/ca/tinkca/signer_test.go
@@ -23,9 +23,9 @@ import (
 	"hash"
 	"testing"
 
-	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/proto/tink_go_proto"
-	"github.com/google/tink/go/signature"
+	"github.com/tink-crypto/tink-go/v2/keyset"
+	"github.com/tink-crypto/tink-go/v2/proto/tink_go_proto"
+	"github.com/tink-crypto/tink-go/v2/signature"
 )
 
 type TestStruct struct {
diff --git a/pkg/ca/tinkca/tinkca_test.go b/pkg/ca/tinkca/tinkca_test.go
index 4003fff..f111a82 100644
--- a/pkg/ca/tinkca/tinkca_test.go
+++ b/pkg/ca/tinkca/tinkca_test.go
@@ -23,12 +23,12 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/tink/go/aead"
-	"github.com/google/tink/go/keyset"
-	"github.com/google/tink/go/signature"
 	"github.com/sigstore/fulcio/pkg/test"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	_ "github.com/sigstore/sigstore/pkg/signature/kms/fake"
+	"github.com/tink-crypto/tink-go/v2/aead"
+	"github.com/tink-crypto/tink-go/v2/keyset"
+	"github.com/tink-crypto/tink-go/v2/signature"
 )
 
 func TestNewTinkCA(t *testing.T) {