Skip to content
This repository was archived by the owner on Dec 3, 2024. It is now read-only.

Commit 9dd9011

Browse files
mrjoelkampmrjoelkamp
authored
Merge pull request #1 from docker/feat-combine-tuf-clients
feat: combine TUF code
2 parents 6f93460 + b7d8403 commit 9dd9011

File tree

56 files changed

+2662
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+2662
-0
lines changed

‎go.mod‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
module github.com/docker/attest
2+
3+
go 1.22.1
4+
5+
require (
6+
github.com/google/go-containerregistry v0.19.1
7+
github.com/stretchr/testify v1.9.0
8+
github.com/testcontainers/testcontainers-go v0.30.0
9+
github.com/testcontainers/testcontainers-go/modules/registry v0.30.0
10+
github.com/theupdateframework/go-tuf/v2 v2.0.0-20240402164131-b2e024ad4752
11+
)
12+
13+
replace github.com/theupdateframework/go-tuf/v2 => github.com/mrjoelkamp/go-tuf/v2 v2.0.1 // for https://github.com/theupdateframework/go-tuf/pull/632
14+
15+
require (
16+
dario.cat/mergo v1.0.0 // indirect
17+
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
18+
github.com/Microsoft/go-winio v0.6.1 // indirect
19+
github.com/Microsoft/hcsshim v0.11.4 // indirect
20+
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
21+
github.com/containerd/containerd v1.7.12 // indirect
22+
github.com/containerd/log v0.1.0 // indirect
23+
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
24+
github.com/cpuguy83/dockercfg v0.3.1 // indirect
25+
github.com/davecgh/go-spew v1.1.1 // indirect
26+
github.com/distribution/reference v0.5.0 // indirect
27+
github.com/docker/cli v24.0.0+incompatible // indirect
28+
github.com/docker/distribution v2.8.2+incompatible // indirect
29+
github.com/docker/docker v25.0.5+incompatible // indirect
30+
github.com/docker/docker-credential-helpers v0.7.0 // indirect
31+
github.com/docker/go-connections v0.5.0 // indirect
32+
github.com/docker/go-units v0.5.0 // indirect
33+
github.com/felixge/httpsnoop v1.0.4 // indirect
34+
github.com/go-logr/logr v1.4.1 // indirect
35+
github.com/go-logr/stdr v1.2.2 // indirect
36+
github.com/go-ole/go-ole v1.2.6 // indirect
37+
github.com/gogo/protobuf v1.3.2 // indirect
38+
github.com/golang/protobuf v1.5.3 // indirect
39+
github.com/google/uuid v1.6.0 // indirect
40+
github.com/klauspost/compress v1.16.5 // indirect
41+
github.com/kr/text v0.2.0 // indirect
42+
github.com/letsencrypt/boulder v0.0.0-20230907030200-6d76a0f91e1e // indirect
43+
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
44+
github.com/magiconair/properties v1.8.7 // indirect
45+
github.com/mitchellh/go-homedir v1.1.0 // indirect
46+
github.com/moby/patternmatcher v0.6.0 // indirect
47+
github.com/moby/sys/sequential v0.5.0 // indirect
48+
github.com/moby/sys/user v0.1.0 // indirect
49+
github.com/moby/term v0.5.0 // indirect
50+
github.com/morikuni/aec v1.0.0 // indirect
51+
github.com/opencontainers/go-digest v1.0.0 // indirect
52+
github.com/opencontainers/image-spec v1.1.0 // indirect
53+
github.com/pkg/errors v0.9.1 // indirect
54+
github.com/pmezard/go-difflib v1.0.0 // indirect
55+
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
56+
github.com/secure-systems-lab/go-securesystemslib v0.8.0 // indirect
57+
github.com/shirou/gopsutil/v3 v3.23.12 // indirect
58+
github.com/shoenig/go-m1cpu v0.1.6 // indirect
59+
github.com/sigstore/sigstore v1.8.3 // indirect
60+
github.com/sirupsen/logrus v1.9.3 // indirect
61+
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
62+
github.com/tklauser/go-sysconf v0.3.12 // indirect
63+
github.com/tklauser/numcpus v0.6.1 // indirect
64+
github.com/vbatts/tar-split v0.11.3 // indirect
65+
github.com/yusufpapurcu/wmi v1.2.3 // indirect
66+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
67+
go.opentelemetry.io/otel v1.24.0 // indirect
68+
go.opentelemetry.io/otel/metric v1.24.0 // indirect
69+
go.opentelemetry.io/otel/trace v1.24.0 // indirect
70+
golang.org/x/crypto v0.21.0 // indirect
71+
golang.org/x/exp v0.0.0-20230510235704-dd950f8aeaea // indirect
72+
golang.org/x/mod v0.16.0 // indirect
73+
golang.org/x/sync v0.3.0 // indirect
74+
golang.org/x/sys v0.18.0 // indirect
75+
golang.org/x/term v0.18.0 // indirect
76+
golang.org/x/tools v0.13.0 // indirect
77+
google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
78+
google.golang.org/grpc v1.58.3 // indirect
79+
google.golang.org/protobuf v1.33.0 // indirect
80+
gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
81+
gopkg.in/yaml.v3 v3.0.1 // indirect
82+
)

‎go.sum‎

Lines changed: 257 additions & 0 deletions
Large diffs are not rendered by default.

‎internal/embed/embedded-roots/1.root-dev.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"signatures": [
3+
{
4+
"keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09",
5+
"sig": "3064023037bbb03c3472b140572a7d5a2895bd80e74435bbcb7053949731f81b104c6d05a0876590cd6a2e94d7ed619426a2f6fa02303adc8c9006fa5506fdd7ea87d2960074a537ad8bf2459f2863e806b47682cbb2f9b01b7502eaf5437a1a68fdaaeac114"
6+
}
7+
],
8+
"signed": {
9+
"_type": "root",
10+
"consistent_snapshot": true,
11+
"expires": "2034-04-02T17:00:22Z",
12+
"keys": {
13+
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3": {
14+
"keytype": "ecdsa",
15+
"keyval": {
16+
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgDpP6O0sEt2R+l84WlfmqPBsFSby\nxJsJ6YmeUVgDk/wk9++8IAR6YBYewaKye56gMnIYjTFbyOI8WomA2NQFBw==\n-----END PUBLIC KEY-----\n"
17+
},
18+
"scheme": "ecdsa-sha2-nistp256",
19+
"x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:175142243308:key/fbd8dab6-5677-4b57-87e6-8369c45b3b61"
20+
},
21+
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09": {
22+
"keytype": "ecdsa",
23+
"keyval": {
24+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n"
25+
},
26+
"scheme": "ecdsa-sha2-nistp384",
27+
"x-tuf-on-ci-keyowner": "@mrjoelkamp"
28+
}
29+
},
30+
"roles": {
31+
"root": {
32+
"keyids": [
33+
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09"
34+
],
35+
"threshold": 1
36+
},
37+
"snapshot": {
38+
"keyids": [
39+
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
40+
],
41+
"threshold": 1,
42+
"x-tuf-on-ci-expiry-period": 3650,
43+
"x-tuf-on-ci-signing-period": 60
44+
},
45+
"targets": {
46+
"keyids": [
47+
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09"
48+
],
49+
"threshold": 1
50+
},
51+
"timestamp": {
52+
"keyids": [
53+
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
54+
],
55+
"threshold": 1,
56+
"x-tuf-on-ci-expiry-period": 3650,
57+
"x-tuf-on-ci-signing-period": 60
58+
}
59+
},
60+
"spec_version": "1.0.31",
61+
"version": 1,
62+
"x-tuf-on-ci-expiry-period": 3650,
63+
"x-tuf-on-ci-signing-period": 60
64+
}
65+
}

‎internal/embed/embedded-roots/1.root-staging.json‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"signatures": [
3+
{
4+
"keyid": "3da0404c531197e1e04622fb6ebcfe67ca462966c16115f856e8bba059b5f1de",
5+
"sig": "30450221008b9de747c24c07586cddf0aa25ecb37dbe9ce4f8cf2d5316fd7a470d42c803db0220715270e40c79b0b4af9858db44b10cec1a2f14ca5c217b1f1f6835f3a1ff843c"
6+
},
7+
{
8+
"keyid": "e642e70171046d6d97efdea76792c373d863c55c054c4287c999c62c6011120f",
9+
"sig": "3046022100c087742a7d10869163be844e4453566af461604cee99ab42560cef3136009cd4022100bedab954a32a693a9da63c2050a8cf4a2bd45e96daf586e489ad0fdd71ada2fd"
10+
}
11+
],
12+
"signed": {
13+
"_type": "root",
14+
"consistent_snapshot": true,
15+
"expires": "2024-11-15T17:56:20Z",
16+
"keys": {
17+
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3": {
18+
"keytype": "ecdsa",
19+
"keyval": {
20+
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgDpP6O0sEt2R+l84WlfmqPBsFSby\nxJsJ6YmeUVgDk/wk9++8IAR6YBYewaKye56gMnIYjTFbyOI8WomA2NQFBw==\n-----END PUBLIC KEY-----\n"
21+
},
22+
"scheme": "ecdsa-sha2-nistp256",
23+
"x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:175142243308:key/fbd8dab6-5677-4b57-87e6-8369c45b3b61"
24+
},
25+
"3da0404c531197e1e04622fb6ebcfe67ca462966c16115f856e8bba059b5f1de": {
26+
"keytype": "ecdsa",
27+
"keyval": {
28+
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEERet/8hs3WHIXyOXNzhLpTOz6DBx\n7zzHnenJgV/TB0dRMAx6j9UVRvlEkh5OcYuktNeqnLpHce1rLjLjpiRPVg==\n-----END PUBLIC KEY-----\n"
29+
},
30+
"scheme": "ecdsa-sha2-nistp256",
31+
"x-tuf-on-ci-keyowner": "@jonnystoten"
32+
},
33+
"e642e70171046d6d97efdea76792c373d863c55c054c4287c999c62c6011120f": {
34+
"keytype": "ecdsa",
35+
"keyval": {
36+
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuMtH9o0x/EHc/Rzoco4RyqmR7UwA\n0sHROw/79CMdbPh3/egmMxci3N+dJl6Re/cNkqR9eQy7joULS2K9Oxgxww==\n-----END PUBLIC KEY-----\n"
37+
},
38+
"scheme": "ecdsa-sha2-nistp256",
39+
"x-tuf-on-ci-keyowner": "@mrjoelkamp"
40+
}
41+
},
42+
"roles": {
43+
"root": {
44+
"keyids": [
45+
"3da0404c531197e1e04622fb6ebcfe67ca462966c16115f856e8bba059b5f1de",
46+
"e642e70171046d6d97efdea76792c373d863c55c054c4287c999c62c6011120f"
47+
],
48+
"threshold": 2
49+
},
50+
"snapshot": {
51+
"keyids": [
52+
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
53+
],
54+
"threshold": 1,
55+
"x-tuf-on-ci-expiry-period": 365,
56+
"x-tuf-on-ci-signing-period": 60
57+
},
58+
"targets": {
59+
"keyids": [
60+
"3da0404c531197e1e04622fb6ebcfe67ca462966c16115f856e8bba059b5f1de",
61+
"e642e70171046d6d97efdea76792c373d863c55c054c4287c999c62c6011120f"
62+
],
63+
"threshold": 2
64+
},
65+
"timestamp": {
66+
"keyids": [
67+
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
68+
],
69+
"threshold": 1,
70+
"x-tuf-on-ci-expiry-period": 2,
71+
"x-tuf-on-ci-signing-period": 1
72+
}
73+
},
74+
"spec_version": "1.0.31",
75+
"version": 1,
76+
"x-tuf-on-ci-expiry-period": 365,
77+
"x-tuf-on-ci-signing-period": 60
78+
}
79+
}

‎internal/embed/root.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package embed
2+
3+
import (
4+
_ "embed"
5+
)
6+
7+
//go:embed embedded-roots/1.root-dev.json
8+
var DevRoot []byte
9+
10+
//go:embed embedded-roots/1.root-staging.json
11+
var StagingRoot []byte
12+
13+
var DefaultRoot = StagingRoot

‎internal/test/test.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package test
2+
3+
import (
4+
"os"
5+
"testing"
6+
)
7+
8+
func CreateTempDir(t *testing.T, dir, pattern string) string {
9+
// Create a temporary directory for output oci layout
10+
tempDir, err := os.MkdirTemp(dir, pattern)
11+
if err != nil {
12+
t.Fatalf("Failed to create temp directory: %v", err)
13+
}
14+
15+
// Register a cleanup function to delete the temp directory when the test exits
16+
t.Cleanup(func() {
17+
if err := os.RemoveAll(tempDir); err != nil {
18+
t.Errorf("Failed to remove temp directory: %v", err)
19+
}
20+
})
21+
return tempDir
22+
}

‎internal/test/testdata/test-repo-oci/metadata/blobs/sha256/1fd0d9781f02486718fcbd7724db0e4c4ba47b649930cec22a3e7e6b6077ba38‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"signatures":[{"keyid":"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3","sig":"3044022039b56cd2e3597df74e57d200a652ba020cdc9a8cd050bd65b5f8e2640d50691d02205e073e4b6fc260acc64327a331e4440601af5b1cbff594ea91cf7b70d5828fb1"}],"signed":{"_type":"snapshot","expires":"2034-04-03T15:59:47Z","meta":{"targets.json":{"version":5},"test-role.json":{"version":3}},"spec_version":"1.0.31","version":6}}

‎internal/test/testdata/test-repo-oci/metadata/blobs/sha256/4c1054844dba3241525cbd71ff9e58becca652fb1ce4a0e6ea55a01c4ec41950‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"signatures":[{"keyid":"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3","sig":"3045022011f2afa9b448fcbbac983c11fc3e264e95d5d7a9c9527b09d83a316ee762635f022100d05197a78ccc7a713ebdb0bccb44844f67a7c5208af8d346e201064b7ce11055"}],"signed":{"_type":"timestamp","expires":"2034-04-03T15:59:47Z","meta":{"snapshot.json":{"version":6}},"spec_version":"1.0.31","version":6}}

‎internal/test/testdata/test-repo-oci/metadata/blobs/sha256/61a98e1e86ae279e59415d927e38beae430d7e6d2bd6207054179429ea9b6763‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"signatures": [
3+
{
4+
"keyid": "b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09",
5+
"sig": "3064023037bbb03c3472b140572a7d5a2895bd80e74435bbcb7053949731f81b104c6d05a0876590cd6a2e94d7ed619426a2f6fa02303adc8c9006fa5506fdd7ea87d2960074a537ad8bf2459f2863e806b47682cbb2f9b01b7502eaf5437a1a68fdaaeac114"
6+
}
7+
],
8+
"signed": {
9+
"_type": "root",
10+
"consistent_snapshot": true,
11+
"expires": "2034-04-02T17:00:22Z",
12+
"keys": {
13+
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3": {
14+
"keytype": "ecdsa",
15+
"keyval": {
16+
"public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgDpP6O0sEt2R+l84WlfmqPBsFSby\nxJsJ6YmeUVgDk/wk9++8IAR6YBYewaKye56gMnIYjTFbyOI8WomA2NQFBw==\n-----END PUBLIC KEY-----\n"
17+
},
18+
"scheme": "ecdsa-sha2-nistp256",
19+
"x-tuf-on-ci-online-uri": "awskms:arn:aws:kms:us-east-1:175142243308:key/fbd8dab6-5677-4b57-87e6-8369c45b3b61"
20+
},
21+
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09": {
22+
"keytype": "ecdsa",
23+
"keyval": {
24+
"public": "-----BEGIN PUBLIC KEY-----\nMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE3+asmp2GD6UijwWvMezwVG/BwFLuQa3o\nT6eRxFvkILGpVDbZ92ZYWidHl9LZ/eJUjhIjuVEkNVKoenw5KjKl8veP3MthZrQA\nSkYytOIwkidZo9Rk2dczbDcFSJvLGsmd\n-----END PUBLIC KEY-----\n"
25+
},
26+
"scheme": "ecdsa-sha2-nistp384",
27+
"x-tuf-on-ci-keyowner": "@mrjoelkamp"
28+
}
29+
},
30+
"roles": {
31+
"root": {
32+
"keyids": [
33+
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09"
34+
],
35+
"threshold": 1
36+
},
37+
"snapshot": {
38+
"keyids": [
39+
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
40+
],
41+
"threshold": 1,
42+
"x-tuf-on-ci-expiry-period": 3650,
43+
"x-tuf-on-ci-signing-period": 60
44+
},
45+
"targets": {
46+
"keyids": [
47+
"b7474a42f2588fa92ed4a2ebea6047a7b1b2f7351f1cfe0912732c0d0fb0fc09"
48+
],
49+
"threshold": 1
50+
},
51+
"timestamp": {
52+
"keyids": [
53+
"198f00ff96ea7cbfa7eac480cc9bfc43ce13bb434b901011ab777856533997d3"
54+
],
55+
"threshold": 1,
56+
"x-tuf-on-ci-expiry-period": 3650,
57+
"x-tuf-on-ci-signing-period": 60
58+
}
59+
},
60+
"spec_version": "1.0.31",
61+
"version": 1,
62+
"x-tuf-on-ci-expiry-period": 3650,
63+
"x-tuf-on-ci-signing-period": 60
64+
}
65+
}

‎internal/test/testdata/test-repo-oci/metadata/blobs/sha256/a152e59e7b58a3a1ec718192b07fbf630d2fe2d80a6f1a9dc09e1321cbd338a7‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","size":669,"digest":"sha256:ad4cacc170229608305ffccd8d09eeb59578fcb72ae394763cf7ef492175b1ee"},"layers":[{"mediaType":"application/vnd.tuf.metadata+json","size":2607,"digest":"sha256:a2e026ce65c198ee68a7ed2df6978ed0287bb38342f6ddb7bf934a456f1d6f87","annotations":{"tuf.io/filename":"2.root.json"}},{"mediaType":"application/vnd.tuf.metadata+json","size":2200,"digest":"sha256:61a98e1e86ae279e59415d927e38beae430d7e6d2bd6207054179429ea9b6763","annotations":{"tuf.io/filename":"1.root.json"}},{"mediaType":"application/vnd.tuf.metadata+json","size":410,"digest":"sha256:1fd0d9781f02486718fcbd7724db0e4c4ba47b649930cec22a3e7e6b6077ba38","annotations":{"tuf.io/filename":"6.snapshot.json"}},{"mediaType":"application/vnd.tuf.metadata+json","size":1683,"digest":"sha256:ea7713eb649ca1a33d79ebdccda9f7f066595b1b2c6e37e52dbfd250f5287260","annotations":{"tuf.io/filename":"5.targets.json"}},{"mediaType":"application/vnd.tuf.metadata+json","size":383,"digest":"sha256:4c1054844dba3241525cbd71ff9e58becca652fb1ce4a0e6ea55a01c4ec41950","annotations":{"tuf.io/filename":"timestamp.json"}}]}

0 commit comments

Comments
 (0)