Skip to content

Commit 7e1d9c1

Browse files
bobcallawaybobcallaway
authored
pin public key used for verification (#169)
* pin public key used for verification Signed-off-by: Bob Callaway <bcallaway@google.com> * don't test on macos-latest as we didn't publish arm64 in cosign-0.5.0 Signed-off-by: Bob Callaway <bcallaway@google.com> * add explicit failure flag to curl to ensure we bail on a non-200 response Signed-off-by: Bob Callaway <bcallaway@google.com> --------- Signed-off-by: Bob Callaway <bcallaway@google.com>
1 parent cc23fe1 commit 7e1d9c1

2 files changed

Lines changed: 40 additions & 5 deletions

File tree

‎.github/workflows/test-action.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,31 @@ jobs:
7878
fi
7979
shell: bash
8080

81+
test_cosign_action_0_5_0:
82+
runs-on: ${{ matrix.os }}
83+
strategy:
84+
matrix:
85+
os: [ubuntu-latest, windows-latest]
86+
permissions: {}
87+
name: Install Cosign v0.5.0 and test presence in path
88+
steps:
89+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
90+
- name: Install Cosign
91+
uses: ./
92+
with:
93+
cosign-release: 'v0.5.0'
94+
- name: Check install!
95+
run: cosign version
96+
- name: Check root directory
97+
run: |
98+
if [[ $(git diff --stat) != '' ]]; then
99+
echo 'should be clean'
100+
exit 1
101+
else
102+
exit 0
103+
fi
104+
shell: bash
105+
81106
test_cosign_action_0_6_0:
82107
runs-on: ${{ matrix.os }}
83108
strategy:

‎action.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ runs:
182182
183183
expected_bootstrap_version_digest=${bootstrap_sha}
184184
log_info "Downloading bootstrap version '${bootstrap_version}' of cosign to verify version to be installed...\n https://github.com/sigstore/cosign/releases/download/${bootstrap_version}/${bootstrap_filename}"
185-
$SUDO curl -sL https://github.com/sigstore/cosign/releases/download/${bootstrap_version}/${bootstrap_filename} -o ${cosign_executable_name}
185+
$SUDO curl -fsL https://github.com/sigstore/cosign/releases/download/${bootstrap_version}/${bootstrap_filename} -o ${cosign_executable_name}
186186
shaBootstrap=$(shaprog ${cosign_executable_name});
187187
if [[ $shaBootstrap != ${expected_bootstrap_version_digest} ]]; then
188188
log_error "Unable to validate cosign version: '${{ inputs.cosign-release }}'"
@@ -206,7 +206,7 @@ runs:
206206
207207
# Download custom cosign
208208
log_info "Downloading platform-specific version '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}"
209-
$SUDO curl -sL https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename} -o cosign_${{ inputs.cosign-release }}
209+
$SUDO curl -fsL https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename} -o cosign_${{ inputs.cosign-release }}
210210
shaCustom=$(shaprog cosign_${{ inputs.cosign-release }});
211211
212212
# same hash means it is the same release
@@ -228,22 +228,32 @@ runs:
228228
229229
if [[ ${{ inputs.cosign-release }} == 'v0.6.0' ]]; then
230230
log_info "Downloading detached signature for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_v060_signature}"
231-
$SUDO curl -sL https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_v060_signature} -o ${desired_cosign_filename}.sig
231+
$SUDO curl -fsL https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_v060_signature} -o ${desired_cosign_filename}.sig
232232
else
233233
log_info "Downloading detached signature for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}.sig"
234-
$SUDO curl -sLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}.sig
234+
$SUDO curl -fsLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}.sig
235235
fi
236236
237237
if [[ ${{ inputs.cosign-release }} < 'v0.6.0' ]]; then
238238
log_info "Downloading cosign public key '${{ inputs.cosign-release }}' of cosign...\n https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/.github/workflows/cosign.pub"
239239
RELEASE_COSIGN_PUB_KEY=https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/.github/workflows/cosign.pub
240+
RELEASE_COSIGN_PUB_KEY_SHA='4aa4bd19530a4929d758a9896255aef2c82f1a3a9f4b000034c6df4307c14f9e'
240241
else
241242
log_info "Downloading cosign public key '${{ inputs.cosign-release }}' of cosign...\n https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/release/release-cosign.pub"
242243
RELEASE_COSIGN_PUB_KEY=https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/release/release-cosign.pub
244+
RELEASE_COSIGN_PUB_KEY_SHA='f4cea466e5e887a45da5031757fa1d32655d83420639dc1758749b744179f126'
245+
fi
246+
247+
log_info "Verifying public key matches expected value"
248+
$SUDO curl -fsL $RELEASE_COSIGN_PUB_KEY -o public.key
249+
sha_fetched_key=$(shaprog public.key)
250+
if [[ $sha_fetched_key != $RELEASE_COSIGN_PUB_KEY_SHA ]]; then
251+
log_error "Fetched public key does not match expected digest, exiting"
252+
exit 1
243253
fi
244254
245255
log_info "Using bootstrap cosign to verify signature of desired cosign version"
246-
./cosign verify-blob --insecure-ignore-tlog --key $RELEASE_COSIGN_PUB_KEY --signature ${desired_cosign_filename}.sig cosign_${{ inputs.cosign-release }}
256+
./cosign verify-blob --insecure-ignore-tlog --key public.key --signature ${desired_cosign_filename}.sig cosign_${{ inputs.cosign-release }}
247257
248258
$SUDO rm cosign
249259
$SUDO mv cosign_${{ inputs.cosign-release }} ${cosign_executable_name}

0 commit comments

Comments
 (0)
⚡