e923880694
Some checks failed
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
Export Center CI / export-ci (push) Has been cancelled
Mirror Thin Bundle Sign & Verify / mirror-sign (push) Has been cancelled
- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil. - Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt. feat: Implement ILockRepository interface and LockRepository class - Defined ILockRepository interface with methods for acquiring and releasing locks. - Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations. feat: Add SurfaceManifestPointer record for manifest pointers - Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest. feat: Create PolicySimulationInputLock and related validation logic - Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests. - Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements. test: Add unit tests for ReplayVerificationService and ReplayVerifier - Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios. - Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic. test: Implement PolicySimulationInputLockValidatorTests - Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions. chore: Add cosign key example and signing scripts - Included a placeholder cosign key example for development purposes. - Added a script for signing Signals artifacts using cosign with support for both v2 and v3. chore: Create script for uploading evidence to the evidence locker - Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.
95 lines
2.9 KiB
Bash
95 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Deterministic DSSE signing helper for Signals artifacts.
|
|
# Prefers system cosign v3 (bundle) and falls back to repo-pinned v2.6.0.
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
COSIGN_BIN="${COSIGN_BIN:-}"
|
|
|
|
# Detect cosign binary (v3 preferred).
|
|
if [[ -z "$COSIGN_BIN" ]]; then
|
|
if command -v /usr/local/bin/cosign >/dev/null 2>&1; then
|
|
COSIGN_BIN="/usr/local/bin/cosign"
|
|
elif command -v cosign >/dev/null 2>&1; then
|
|
COSIGN_BIN="$(command -v cosign)"
|
|
elif [[ -x "$ROOT/tools/cosign/cosign" ]]; then
|
|
COSIGN_BIN="$ROOT/tools/cosign/cosign"
|
|
else
|
|
echo "cosign not found; install or set COSIGN_BIN" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# Resolve key
|
|
TMP_KEY=""
|
|
if [[ -n "${COSIGN_KEY_FILE:-}" ]]; then
|
|
KEY_FILE="$COSIGN_KEY_FILE"
|
|
elif [[ -n "${COSIGN_PRIVATE_KEY_B64:-}" ]]; then
|
|
TMP_KEY="$(mktemp)"
|
|
echo "$COSIGN_PRIVATE_KEY_B64" | base64 -d > "$TMP_KEY"
|
|
chmod 600 "$TMP_KEY"
|
|
KEY_FILE="$TMP_KEY"
|
|
elif [[ -f "$ROOT/tools/cosign/cosign.key" ]]; then
|
|
KEY_FILE="$ROOT/tools/cosign/cosign.key"
|
|
else
|
|
echo "No signing key: set COSIGN_PRIVATE_KEY_B64 or COSIGN_KEY_FILE, or place key at tools/cosign/cosign.key" >&2
|
|
exit 2
|
|
fi
|
|
|
|
OUT_BASE="${OUT_DIR:-$ROOT/evidence-locker/signals/2025-12-01}"
|
|
mkdir -p "$OUT_BASE"
|
|
|
|
ARTIFACTS=(
|
|
"decay/confidence_decay_config.yaml|stella.ops/confidenceDecayConfig@v1|confidence_decay_config"
|
|
"unknowns/unknowns_scoring_manifest.json|stella.ops/unknownsScoringManifest@v1|unknowns_scoring_manifest"
|
|
"heuristics/heuristics.catalog.json|stella.ops/heuristicCatalog@v1|heuristics_catalog"
|
|
)
|
|
|
|
COSIGN_VERSION="$($COSIGN_BIN version | head -n1)"
|
|
USE_BUNDLE=0
|
|
[[ "$COSIGN_VERSION" == *"v3."* ]] && USE_BUNDLE=1
|
|
|
|
pushd "$ROOT/docs/modules/signals" >/dev/null
|
|
|
|
SHA_FILE="$OUT_BASE/SHA256SUMS"
|
|
: > "$SHA_FILE"
|
|
|
|
for entry in "${ARTIFACTS[@]}"; do
|
|
IFS="|" read -r path predicate stem <<<"$entry"
|
|
if [[ ! -f "$path" ]]; then
|
|
echo "Missing artifact: $path" >&2
|
|
exit 3
|
|
fi
|
|
|
|
if (( USE_BUNDLE )); then
|
|
bundle="$OUT_BASE/${stem}.sigstore.json"
|
|
COSIGN_PASSWORD="${COSIGN_PASSWORD:-}" \
|
|
"$COSIGN_BIN" sign-blob \
|
|
--key "$KEY_FILE" \
|
|
--predicate-type "$predicate" \
|
|
--bundle "$bundle" \
|
|
"$path"
|
|
printf "%s %s\n" "$(sha256sum "$bundle" | cut -d' ' -f1)" "$(realpath --relative-to="$OUT_BASE" "$bundle")" >> "$SHA_FILE"
|
|
else
|
|
sig="$OUT_BASE/${stem}.dsse"
|
|
COSIGN_PASSWORD="${COSIGN_PASSWORD:-}" \
|
|
"$COSIGN_BIN" sign-blob \
|
|
--key "$KEY_FILE" \
|
|
--predicate-type "$predicate" \
|
|
--output-signature "$sig" \
|
|
"$path"
|
|
printf "%s %s\n" "$(sha256sum "$sig" | cut -d' ' -f1)" "$(realpath --relative-to="$OUT_BASE" "$sig")" >> "$SHA_FILE"
|
|
fi
|
|
|
|
printf "%s %s\n" "$(sha256sum "$path" | cut -d' ' -f1)" "$(realpath --relative-to="$OUT_BASE" "$path")" >> "$SHA_FILE"
|
|
done
|
|
|
|
popd >/dev/null
|
|
|
|
echo "Signed artifacts written to $OUT_BASE"
|
|
|
|
if [[ -n "$TMP_KEY" ]]; then
|
|
rm -f "$TMP_KEY"
|
|
fi
|