mirror of
https://github.com/project-zot/zot.git
synced 2025-01-06 22:40:28 -05:00
41b05c60dd
In order to verify signatures, users could upload their certificates and public keys using these routes: -> for public keys: /v2/_zot/ext/mgmt?resource=signatures&tool=cosign -> for certificates: /v2/_zot/ext/mgmt?resource=signatures&tool=notation&truststoreType=ca&truststoreName=name Then the public keys will be stored under $rootdir/_cosign and the certificates will be stored under $rootdir/_notation/truststore/x509/$truststoreType/$truststoreName. Also, for notation case, the "truststores" field of $rootir/_notation/trustpolicy.json file will be updated with a new entry "$truststoreType:$truststoreName". Also based on the uploaded files, the information about the signatures validity will be updated periodically. Signed-off-by: Andreea-Lupu <andreealupu1470@yahoo.com>
60 lines
1.4 KiB
Go
60 lines
1.4 KiB
Go
package signatures
|
|
|
|
import (
|
|
"encoding/json"
|
|
"time"
|
|
|
|
godigest "github.com/opencontainers/go-digest"
|
|
ispec "github.com/opencontainers/image-spec/specs-go/v1"
|
|
|
|
zerr "zotregistry.io/zot/errors"
|
|
)
|
|
|
|
const (
|
|
CosignSignature = "cosign"
|
|
NotationSignature = "notation"
|
|
defaultDirPerms = 0o700
|
|
defaultFilePerms = 0o644
|
|
)
|
|
|
|
func InitCosignAndNotationDirs(rootDir string) error {
|
|
err := InitCosignDir(rootDir)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = InitNotationDir(rootDir)
|
|
|
|
return err
|
|
}
|
|
|
|
func VerifySignature(
|
|
signatureType string, rawSignature []byte, sigKey string, manifestDigest godigest.Digest, manifestContent []byte,
|
|
repo string,
|
|
) (string, time.Time, bool, error) {
|
|
var manifest ispec.Manifest
|
|
if err := json.Unmarshal(manifestContent, &manifest); err != nil {
|
|
return "", time.Time{}, false, err
|
|
}
|
|
|
|
desc := ispec.Descriptor{
|
|
MediaType: manifest.MediaType,
|
|
Digest: manifestDigest,
|
|
Size: int64(len(manifestContent)),
|
|
}
|
|
|
|
if manifestDigest.String() == "" {
|
|
return "", time.Time{}, false, zerr.ErrBadManifestDigest
|
|
}
|
|
|
|
switch signatureType {
|
|
case CosignSignature:
|
|
author, isValid, err := VerifyCosignSignature(repo, manifestDigest, sigKey, rawSignature)
|
|
|
|
return author, time.Time{}, isValid, err
|
|
case NotationSignature:
|
|
return VerifyNotationSignature(desc, manifestDigest.String(), rawSignature, sigKey)
|
|
default:
|
|
return "", time.Time{}, false, zerr.ErrInvalidSignatureType
|
|
}
|
|
}
|