8000 trust: Provide methods to load TrustConfig from tuf · jku/sigstore-python@750547d · GitHub
[go: up one dir, main page]
Skip to content

Commit 750547d

Browse files
jkujku
committed
trust: Provide methods to load TrustConfig from tuf
We have previously done this for TrustedRoot but doing this for the whole TrustConfig makes sense. The only complication is that production instance does not have the SigningConfig component yet so we need to provide a fallback for that. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
1 parent 2c9a4ff commit 750547d

File tree

3 files changed

+120
-1
lines changed

3 files changed

+120
-1
lines changed

‎sigstore/_internal/trust.py

Lines changed: 59 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,9 @@
6262
PublicKey,
6363
key_id,
6464
load_der_public_key,
65+
read_embedded,
6566
)
66-
from sigstore.errors import Error, MetadataError, VerificationError
67+
from sigstore.errors import Error, MetadataError, TUFError, VerificationError
6768

6869

6970
def _is_timerange_valid(period: TimeRange | None, *, allow_expired: bool) -> bool:
@@ -559,6 +560,63 @@ def from_json(cls, raw: str) -> ClientTrustConfig:
559560
inner = _ClientTrustConfig().from_json(raw)
560561
return cls(inner)
561562

563+
@classmethod
564+
def production(
565 8000 +
cls,
566+
offline: bool = False,
567+
) -> ClientTrustConfig:
568+
"""Create new trust config from Sigstore production TUF repository.
569+
570+
If `offline`, will use data in local TUF cache. Otherwise will
571+
update the data from remote TUF repository.
572+
"""
573+
return cls.from_tuf(DEFAULT_TUF_URL, offline)
574+
575+
@classmethod
576+
def staging(
577+
cls,
578+
offline: bool = False,
579+
) -> ClientTrustConfig:
580+
"""Create new trust config from Sigstore staging TUF repository.
581+
582+
If `offline`, will use data in local TUF cache. Otherwise will
583+
update the data from remote TUF repository.
584+
"""
585+
return cls.from_tuf(STAGING_TUF_URL, offline)
586+
587+
@classmethod
588+
def from_tuf(
589+
cls,
590+
url: str,
591+
offline: bool = False,
592+
) -> ClientTrustConfig:
593+
"""Create a new trust config from a TUF repository.
594+
595+
If `offline`, will use data in local TUF cache. Otherwise will
596+
update the trust config from remote TUF repository.
597+
"""
598+
updater = TrustUpdater(url, offline)
599+
600+
tr_path = updater.get_trusted_root_path()
601+
inner_tr = _TrustedRoot().from_json(Path(tr_path).read_bytes())
602+
603+
try:
604+
sc_path = updater.get_signing_config_path()
605+
inner_sc = _SigningConfig().from_json(Path(sc_path).read_bytes())
606+
except TUFError as e:
607+
# TUF repo may not have signing config yet: hard code values for prod:
608+
if url == DEFAULT_TUF_URL:
609+
embedded = read_embedded("signing_config.v0.2.json", "prod")
610+
inner_sc = _SigningConfig().from_json(embedded)
611+
else:
612+
raise e
613+
614+
return _ClientTrustConfig(
615+
ClientTrustConfig.ClientTrustConfigType.CONFIG_0_1,
616+
inner_tr,
617+
inner_sc,
618+
)
619+
562620
def __init__(self, inner: _ClientTrustConfig) -> None:
563621
"""
564622
@api private

‎sigstore/_internal/tuf.py

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,3 +148,26 @@ def get_trusted_root_path(self) -> str:
148148

149149
_logger.debug("Found and verified trusted root")
150150
return path
151+
152+
@lru_cache()
153+
def get_signing_config_path(self) -> str:
154+
"""Return local path to currently valid signing config file"""
155+
if not self._updater:
156+
_logger.debug("Using unverified signing config from cache")
157+
return str(self._targets_dir / "signing_config.v0.2.json")
158+
159+
root_info = self._updater.get_targetinfo("signing_config.v0.2.json")
160+
if root_info is None:
161+
raise TUFError("Unsupported TUF configuration: no signing config")
162+
path = self._updater.find_cached_target(root_info)
163+
if path is None:
164+
try:
165+
path = self._updater.download_target(root_info)
166+
except (
167+
TUFExceptions.DownloadError,
168+
TUFExceptions.RepositoryError,
169+
) as e:
170+
raise TUFError("Failed to download trusted key bundle") from e
171+
172+
_logger.debug("Found and verified signing config")
173+
return path

‎sigstore/_store/prod/signing_config.v0.2.json

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"mediaType": "application/vnd.dev.sigstore.signingconfig.v0.2+json",
3+
"caUrls": [
4+
{
5+
"url": "https://fulcio.sigstore.dev",
6+
"majorApiVersion": 1,
7+
"validFor": {
8+
"start": "2022-04-13T20:06:15.000Z"
9+
}
10+
}
11+
],
12+
"oidcUrls": [
13+
{
14+
"url": "https://oauth2.sigstore.dev/auth",
15+
"majorApiVersion": 1,
16+
"validFor": {
17+
"start": "2025-04-30T00:00:00Z"
18+
}
19+
}
20+
],
21+
"rekorTlogUrls": [
22+
{
23+
"url": "https://rekor.sigstore.dev",
24+
"majorApiVersion": 1,
25+
"validFor": {
26+
"start": "2021-01-12T11:53:27.000Z"
27+
}
28+
}
29+
],
30+
"tsaUrls": [
31+
],
32+
"rekorTlogConfig": {
33+
"selector": "ANY"
34+
},
35+
"tsaConfig": {
36+
"selector": "ANY"
37+
}
38+
}

0 commit comments

Comments
 (0)
0