107 lines
3.8 KiB
Bash
107 lines
3.8 KiB
Bash
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
|
||
# Deterministic DSSE signing helper for Authority gap artefacts (AU1–AU10, RR1–RR10).
|
||
# Prefers system cosign v3 (bundle) and falls back to repo-pinned v2.6.0.
|
||
|
||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||
COSIGN_BIN="${COSIGN_BIN:-}"
|
||
|
||
# Detect cosign binary
|
||
if [[ -z "$COSIGN_BIN" ]]; then
|
||
if command -v /usr/local/bin/cosign >/dev/null 2>&1; then
|
||
COSIGN_BIN="/usr/local/bin/cosign"
|
||
elif command -v cosign >/dev/null 2>&1; then
|
||
COSIGN_BIN="$(command -v cosign)"
|
||
elif [[ -x "$ROOT/tools/cosign/cosign" ]]; then
|
||
COSIGN_BIN="$ROOT/tools/cosign/cosign"
|
||
else
|
||
echo "cosign not found; install or set COSIGN_BIN" >&2
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
# Resolve key
|
||
TMP_KEY=""
|
||
if [[ -n "${COSIGN_KEY_FILE:-}" ]]; then
|
||
KEY_FILE="$COSIGN_KEY_FILE"
|
||
elif [[ -n "${COSIGN_PRIVATE_KEY_B64:-}" ]]; then
|
||
TMP_KEY="$(mktemp)"
|
||
echo "$COSIGN_PRIVATE_KEY_B64" | base64 -d > "$TMP_KEY"
|
||
chmod 600 "$TMP_KEY"
|
||
KEY_FILE="$TMP_KEY"
|
||
elif [[ -f "$ROOT/tools/cosign/cosign.key" ]]; then
|
||
KEY_FILE="$ROOT/tools/cosign/cosign.key"
|
||
elif [[ "${COSIGN_ALLOW_DEV_KEY:-0}" == "1" && -f "$ROOT/tools/cosign/cosign.dev.key" ]]; then
|
||
echo "[warn] Using development key (tools/cosign/cosign.dev.key); NOT for production/Evidence Locker" >&2
|
||
KEY_FILE="$ROOT/tools/cosign/cosign.dev.key"
|
||
else
|
||
echo "No signing key: set COSIGN_PRIVATE_KEY_B64 or COSIGN_KEY_FILE, or place key at tools/cosign/cosign.key" >&2
|
||
exit 2
|
||
fi
|
||
|
||
OUT_BASE="${OUT_DIR:-$ROOT/docs/modules/authority/gaps/dsse/2025-12-04}"
|
||
if [[ "$OUT_BASE" != /* ]]; then
|
||
OUT_BASE="$ROOT/$OUT_BASE"
|
||
fi
|
||
mkdir -p "$OUT_BASE"
|
||
|
||
ARTEFACTS=(
|
||
"docs/modules/authority/gaps/artifacts/authority-scope-role-catalog.v1.json|authority-scope-role-catalog"
|
||
"docs/modules/authority/gaps/artifacts/authority-jwks-metadata.schema.json|authority-jwks-metadata.schema"
|
||
"docs/modules/authority/gaps/artifacts/crypto-profile-registry.v1.json|crypto-profile-registry"
|
||
"docs/modules/authority/gaps/artifacts/authority-offline-verifier-bundle.v1.json|authority-offline-verifier-bundle"
|
||
"docs/modules/authority/gaps/artifacts/authority-abac.schema.json|authority-abac.schema"
|
||
"docs/modules/authority/gaps/artifacts/rekor-receipt-policy.v1.json|rekor-receipt-policy"
|
||
"docs/modules/authority/gaps/artifacts/rekor-receipt.schema.json|rekor-receipt.schema"
|
||
"docs/modules/authority/gaps/artifacts/rekor-receipt-bundle.v1.json|rekor-receipt-bundle"
|
||
)
|
||
|
||
USE_BUNDLE=0
|
||
if $COSIGN_BIN version --json 2>/dev/null | grep -q '"GitVersion":"v3'; then
|
||
USE_BUNDLE=1
|
||
elif $COSIGN_BIN version 2>/dev/null | grep -q 'GitVersion:.*v3\.'; then
|
||
USE_BUNDLE=1
|
||
fi
|
||
|
||
SHA_FILE="$OUT_BASE/SHA256SUMS"
|
||
: > "$SHA_FILE"
|
||
|
||
for entry in "${ARTEFACTS[@]}"; do
|
||
IFS="|" read -r path stem <<<"$entry"
|
||
if [[ ! -f "$ROOT/$path" ]]; then
|
||
echo "Missing artefact: $path" >&2
|
||
exit 3
|
||
fi
|
||
if (( USE_BUNDLE )); then
|
||
bundle="$OUT_BASE/${stem}.sigstore.json"
|
||
COSIGN_PASSWORD="${COSIGN_PASSWORD:-}" \
|
||
"$COSIGN_BIN" sign-blob \
|
||
--key "$KEY_FILE" \
|
||
--yes \
|
||
--tlog-upload=false \
|
||
--bundle "$bundle" \
|
||
"$ROOT/$path"
|
||
printf "%s %s\n" "$(sha256sum "$bundle" | cut -d' ' -f1)" "$(realpath --relative-to="$OUT_BASE" "$bundle")" >> "$SHA_FILE"
|
||
else
|
||
sig="$OUT_BASE/${stem}.dsse"
|
||
COSIGN_PASSWORD="${COSIGN_PASSWORD:-}" \
|
||
"$COSIGN_BIN" sign-blob \
|
||
--key "$KEY_FILE" \
|
||
--yes \
|
||
--tlog-upload=false \
|
||
--output-signature "$sig" \
|
||
"$ROOT/$path"
|
||
printf "%s %s\n" "$(sha256sum "$sig" | cut -d' ' -f1)" "$(realpath --relative-to="$OUT_BASE" "$sig")" >> "$SHA_FILE"
|
||
fi
|
||
|
||
printf "%s %s\n" "$(sha256sum "$ROOT/$path" | cut -d' ' -f1)" "$(realpath --relative-to="$OUT_BASE" "$ROOT/$path")" >> "$SHA_FILE"
|
||
echo "Signed $path"
|
||
done
|
||
|
||
echo "Signed artefacts written to $OUT_BASE"
|
||
|
||
if [[ -n "$TMP_KEY" ]]; then
|
||
rm -f "$TMP_KEY"
|
||
fi
|