diff --git a/README.md b/README.md index f4aa9e2f96..328652b13e 100644 --- a/README.md +++ b/README.md @@ -61,8 +61,6 @@ or use the build tags described below to avoid the dependencies (e.g. using `go - `containers_image_openpgp`: Use a Golang-only OpenPGP implementation for signature verification instead of the default cgo/gpgme-based implementation; the primary downside is that creating new signatures with the Golang-only implementation is not supported. - `containers_image_storage_stub`: Don’t import the `containers-storage:` transport in `github.com/containers/image/transports/alltransports`, to decrease the amount of required dependencies. Use a stub which reports that the transport is not supported instead. -- `containers_image_fulcio_stub`: Don't import sigstore/fulcio code, all fulcio operations will return an error code -- `containers_image_rekor_stub`: Don't import sigstore/reckor code, all rekor operations will return an error code ## [Contributing](CONTRIBUTING.md) diff --git a/signature/fulcio_cert.go b/signature/fulcio_cert.go index cce4677486..908dd0fd59 100644 --- a/signature/fulcio_cert.go +++ b/signature/fulcio_cert.go @@ -1,5 +1,3 @@ -//go:build !containers_image_fulcio_stub - package signature import ( diff --git a/signature/fulcio_cert_stub.go b/signature/fulcio_cert_stub.go deleted file mode 100644 index da8e13c1df..0000000000 --- a/signature/fulcio_cert_stub.go +++ /dev/null @@ -1,27 +0,0 @@ -//go:build containers_image_fulcio_stub - -package signature - -import ( - "crypto" - "crypto/ecdsa" - "crypto/x509" - "errors" -) - -type fulcioTrustRoot struct { - caCertificates *x509.CertPool - oidcIssuer string - subjectEmail string -} - -func (f *fulcioTrustRoot) validate() error { - return errors.New("fulcio disabled at compile-time") -} - -func verifyRekorFulcio(rekorPublicKeys []*ecdsa.PublicKey, fulcioTrustRoot *fulcioTrustRoot, untrustedRekorSET []byte, - untrustedCertificateBytes []byte, untrustedIntermediateChainBytes []byte, untrustedBase64Signature string, - untrustedPayloadBytes []byte) (crypto.PublicKey, error) { - return nil, errors.New("fulcio disabled at compile-time") - -} diff --git a/signature/fulcio_cert_test.go b/signature/fulcio_cert_test.go index 554edfa887..4ea45fba16 100644 --- a/signature/fulcio_cert_test.go +++ b/signature/fulcio_cert_test.go @@ -1,5 +1,3 @@ -//go:build !containers_image_fulcio_stub - package signature import ( diff --git a/signature/internal/rekor_set.go b/signature/internal/rekor_set.go index f26a978701..cf09cfde59 100644 --- a/signature/internal/rekor_set.go +++ b/signature/internal/rekor_set.go @@ -1,5 +1,3 @@ -//go:build !containers_image_rekor_stub - package internal import ( diff --git a/signature/internal/rekor_set_stub.go b/signature/internal/rekor_set_stub.go deleted file mode 100644 index 4ff3da7edb..0000000000 --- a/signature/internal/rekor_set_stub.go +++ /dev/null @@ -1,14 +0,0 @@ -//go:build containers_image_rekor_stub - -package internal - -import ( - "crypto/ecdsa" - "time" -) - -// VerifyRekorSET verifies that unverifiedRekorSET is correctly signed by publicKey and matches the rest of the data. -// Returns bundle upload time on success. -func VerifyRekorSET(publicKeys []*ecdsa.PublicKey, unverifiedRekorSET []byte, unverifiedKeyOrCertBytes []byte, unverifiedBase64Signature string, unverifiedPayloadBytes []byte) (time.Time, error) { - return time.Time{}, NewInvalidSignatureError("rekor disabled at compile-time") -} diff --git a/signature/internal/rekor_set_test.go b/signature/internal/rekor_set_test.go index 7772180af8..61fef497c1 100644 --- a/signature/internal/rekor_set_test.go +++ b/signature/internal/rekor_set_test.go @@ -1,5 +1,3 @@ -//go:build !containers_image_rekor_stub - package internal import ( diff --git a/signature/policy_eval_sigstore_test.go b/signature/policy_eval_sigstore_test.go index 6cc93793b8..f9b4f8a45c 100644 --- a/signature/policy_eval_sigstore_test.go +++ b/signature/policy_eval_sigstore_test.go @@ -1,5 +1,3 @@ -//go:build !containers_image_fulcio_stub - // Policy evaluation for prCosignSigned. package signature diff --git a/signature/sigstore/fulcio/fulcio.go b/signature/sigstore/fulcio/fulcio.go index 1e55b6ba08..8d1620371b 100644 --- a/signature/sigstore/fulcio/fulcio.go +++ b/signature/sigstore/fulcio/fulcio.go @@ -1,5 +1,3 @@ -//go:build !containers_image_fulcio_stub - package fulcio import ( diff --git a/signature/sigstore/fulcio/fulcio_stub.go b/signature/sigstore/fulcio/fulcio_stub.go deleted file mode 100644 index 1fd22c8fc9..0000000000 --- a/signature/sigstore/fulcio/fulcio_stub.go +++ /dev/null @@ -1,44 +0,0 @@ -//go:build containers_image_fulcio_stub - -package fulcio - -import ( - "fmt" - "io" - "net/url" - - "github.com/containers/image/v5/signature/sigstore/internal" -) - -func WithFulcioAndPreexistingOIDCIDToken(fulcioURL *url.URL, oidcIDToken string) internal.Option { - return func(s *internal.SigstoreSigner) error { - return fmt.Errorf("fulcio disabled at compile time") - } -} - -// WithFulcioAndDeviceAuthorizationGrantOIDC sets up signing to use a short-lived key and a Fulcio-issued certificate -// based on an OIDC ID token obtained using a device authorization grant (RFC 8628). -// -// interactiveOutput must be directly accessible to a human user in real time (i.e. not be just a log file). -func WithFulcioAndDeviceAuthorizationGrantOIDC(fulcioURL *url.URL, oidcIssuerURL *url.URL, oidcClientID, oidcClientSecret string, - interactiveOutput io.Writer) internal.Option { - return func(s *internal.SigstoreSigner) error { - return fmt.Errorf("fulcio disabled at compile time") - } -} - -// WithFulcioAndInterativeOIDC sets up signing to use a short-lived key and a Fulcio-issued certificate -// based on an interactively-obtained OIDC ID token. -// The token is obtained -// - directly using a browser, listening on localhost, automatically opening a browser to the OIDC issuer, -// to be redirected on localhost. (I.e. the current environment must allow launching a browser that connect back to the current process; -// either or both may be impossible in a container or a remote VM). -// - or by instructing the user to manually open a browser, obtain the OIDC code, and interactively input it as text. -// -// interactiveInput and interactiveOutput must both be directly operable by a human user in real time (i.e. not be just a log file). -func WithFulcioAndInteractiveOIDC(fulcioURL *url.URL, oidcIssuerURL *url.URL, oidcClientID, oidcClientSecret string, - interactiveInput io.Reader, interactiveOutput io.Writer) internal.Option { - return func(s *internal.SigstoreSigner) error { - return fmt.Errorf("fulcio disabled at compile time") - } -} diff --git a/signature/sigstore/rekor/rekor.go b/signature/sigstore/rekor/rekor.go index 9f745a2b99..4314b95072 100644 --- a/signature/sigstore/rekor/rekor.go +++ b/signature/sigstore/rekor/rekor.go @@ -1,5 +1,3 @@ -//go:build !containers_image_rekor_stub - package rekor import ( diff --git a/signature/sigstore/rekor/rekor_stub.go b/signature/sigstore/rekor/rekor_stub.go deleted file mode 100644 index 4dc0b88da9..0000000000 --- a/signature/sigstore/rekor/rekor_stub.go +++ /dev/null @@ -1,16 +0,0 @@ -//go:build containers_image_rekor_stub - -package rekor - -import ( - "fmt" - "net/url" - - signerInternal "github.com/containers/image/v5/signature/sigstore/internal" -) - -func WithRekor(rekorURL *url.URL) signerInternal.Option { - return func(s *signerInternal.SigstoreSigner) error { - return fmt.Errorf("rekor disabled at build time") - } -}