Repository: cli/cli
File: pkg/cmd/attestation/verification/sigstore.go (Go)

Code before:
	Verify(attestations []*api.Attestation, policy verify.PolicyBuilder) ([]*AttestationProcessingResult, error)
}

type LiveSigstoreVerifier struct {
	config SigstoreConfig
}

var ErrNoAttestationsVerified = errors.New("no attestations were verified")

// NewLiveSigstoreVerifier creates a new LiveSigstoreVerifier struct
// that is used to verify artifacts and attestations against the
// Public Good, GitHub, or a custom trusted root.
func NewLiveSigstoreVerifier(config SigstoreConfig) *LiveSigstoreVerifier {
	return &LiveSigstoreVerifier{
		config: config,
	}
}

func (v *LiveSigstoreVerifier) chooseVerifier(b *bundle.Bundle) (*verify.SignedEntityVerifier, string, error) {
	if !b.MinVersion("0.2") {
		return nil, "", fmt.Errorf("unsupported bundle version: %s", b.MediaType)
	}
	verifyContent, err := b.VerificationContent()
	if err != nil {
		return nil, "", fmt.Errorf("failed to get bundle verification content: %v", err)
	}
	leafCert := verifyContent.GetCertificate()
	if leafCert == nil {
		return nil, "", fmt.Errorf("leaf cert not found")
	}
	if len(leafCert.Issuer.Organization) != 1 {
		return nil, "", fmt.Errorf("expected the leaf certificate issuer to only have one organization")
	}
	issuer := leafCert.Issuer.Organization[0]

	if v.config.TrustedRoot != "" {
		customTrustRoots, err := os.ReadFile(v.config.TrustedRoot)
		if err != nil {
			return nil, "", fmt.Errorf("unable to read file %s: %v", v.config.TrustedRoot, err)
		}

		reader := bufio.NewReader(bytes.NewReader(customTrustRoots))
		var line []byte
		var readError error
		line, readError = reader.ReadBytes('\n')
		for readError == nil {
			// Load each trusted root
			trustedRoot, err := root.NewTrustedRootFromJSON(line)
			if err != nil {
				return nil, "", fmt.Errorf("failed to create custom verifier: %v", err)
			}

Review comment (refactor):
This logic was originally inside of the `chooseVerifier` method. I moved it out so we could parse the bundle's issuer separately. This allowed me to clean up `chooseVerifier` a bit.

Code after:
	Verify(attestations []*api.Attestation, policy verify.PolicyBuilder) ([]*AttestationProcessingResult, error)
}

type LiveSigstoreVerifier struct {
	TrustedRoot  string
	Logger       *io.Handler
	NoPublicGood bool
	// If tenancy mode is not used, trust domain is empty
	TrustDomain string
}

var ErrNoAttestationsVerified = errors.New("no attestations were verified")

// NewLiveSigstoreVerifier creates a new LiveSigstoreVerifier struct
// that is used to verify artifacts and attestations against the
// Public Good, GitHub, or a custom trusted root.
func NewLiveSigstoreVerifier(config SigstoreConfig) *LiveSigstoreVerifier {
	return &LiveSigstoreVerifier{
		TrustedRoot:  config.TrustedRoot,
		Logger:       config.Logger,
		NoPublicGood: config.NoPublicGood,
		TrustDomain:  config.TrustDomain,
	}
}

func getBundleIssuer(b *bundle.Bundle) (string, error) {
	if !b.MinVersion("0.2") {
		return "", fmt.Errorf("unsupported bundle version: %s", b.MediaType)
	}
	verifyContent, err := b.VerificationContent()
	if err != nil {
		return "", fmt.Errorf("failed to get bundle verification content: %v", err)
	}
	leafCert := verifyContent.GetCertificate()
	if leafCert == nil {
		return "", fmt.Errorf("leaf cert not found")
	}
	if len(leafCert.Issuer.Organization) != 1 {
		return "", fmt.Errorf("expected the leaf certificate issuer to only have one organization")
	}
	return leafCert.Issuer.Organization[0], nil
}

func (v *LiveSigstoreVerifier) chooseVerifier(issuer string) (*verify.SignedEntityVerifier, error) {
	// if no custom trusted root is set, attempt to create a Public Good or
	// GitHub Sigstore verifier
	if v.TrustedRoot == "" {
		switch issuer {
		case PublicGoodIssuerOrg:
			if v.NoPublicGood {
				return nil, fmt.Errorf("detected public good instance but requested verification without public good instance")