If an intermediate tree already exists and we know this ahead of time,
we should use it without recreating it with all of its contents resolved
and written recursively. This commit adds support for such cases and
renames TreeBuilder's APIs to generalize away from accepting blob IDs
only.
Signed-off-by: Aditya Sirish <aditya@saky.in>
gittuf has a companion app for GitHub that can record attestations for
pull request reviews. Previously, the app was identified by its signing
key. This commit adds initial support for naming the app, with an eye
towards eventually supporting attestations from multiple apps.
Signed-off-by: Aditya Sirish <aditya@saky.in>
This commit adds support for different types of global rules (i.e., non
threshold constraints). This commit also adds a global rule to block
force pushes to one or more specified refs.
Signed-off-by: Aditya Sirish <aditya@saky.in>
This commit adds initial support for "global rules" that set baselines
that must be met during verification. Currently, the global rule only
enforces threshold rules. Each rule is enforced by inspecting the set of
principals successfully verified for a change. If a change is not
protected explicitly, then it's verified using all principals in the
policy.
Signed-off-by: Aditya Sirish <aditya@saky.in>
The before condition check was incorrect when handling repositories that
were not numbered from the start. This commit updates the before entry
number condition to only apply if the entry being examined is in fact
numbered.
This commit also adds some debug statements.
Signed-off-by: Aditya Sirish <aditya@saky.in>
We have two very similar helpers: verifyGitObjectAndAttestations and
verifyGitObjectAndAttestationsUsingVerifiers. The first one calls the
second one. However, there were numerous cases of direct invocation of
the second one. This commit makes the first helper the one that's used
consistently. This ensures that finding which verifiers to use and so on
are consistent everywhere.
Signed-off-by: Aditya Sirish <aditya@saky.in>
This commit corrals all policy.Verify APIs as methods on a
PolicyVerifier type. This has benefits such as how they share the
underlying repository handler as well as searchers, cache populating,
etc.
Signed-off-by: Aditya Sirish <aditya@saky.in>
1. VerifyMergeable was incorrectly returning an error when no verifiers were
found (for an unprotected base branch).
2. Policy's searcher interface was also returning the wrong error when the
latest policy or attestation entry was not found.
3. A verify-mergeable command has been added to simplify debugging.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
We have some policy state specific tasks that need to happen only once and can
be consolidated as part of a generic preprocessing flow.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
This commit enables checking if a change in a feature ref can be merged into
the target ref. Significantly, this API returns true if the policy can be met
when the merge is performed by an authorized person.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
This commit allows for using persons in the CLI. In doing so, it updates the
expected flow where add-rule no longer also adds the principals passed in.
Instead, keys / persons must be added explicitly first, and add-rule will fail
if the principal is not found.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
This commit introduces v02 of policy metadata schemas for root and targets
files. The biggest change is the introduction of the Person principal type.
This commit also adds a migration function from v01 to v02, though it's
selectively invoked.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
v0.1 assumes the target is a tree, meaning it's not possible to approve tags.
v0.2 fixes this assumption.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
This commit moves existing implementations of attestation predicates into
subpackages to start supporting multiple versions in parallel.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
We took out support for legacy key types a few commits ago, but this would mean
we will have to reset gittuf metadata for gittuf's own repository. This commit
adds support for verifying signatures using those legacy key types but does not
support them for signing new metadata.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
This is a massive commit that isn't easy to split up, my apologies to
reviewers. Here's everything that's happening.
First, the base tuf package now includes interfaces for RootMetadata,
TargetsMetadata, Rule, and Principal. The first two are self-explanatory. Rule
represents some protection rule, currently matched by the Delegation schema,
while Principal defines a new take on who a trusted party is. Existing schemas
have been moved into a v01 subpackage. v01 also includes a Key type based on
signerverifier.SSLibKey which implements the Principal interface. This means
that expectations elsewhere (such as in repository and policy) re a principal
can be met by existing policy metadata.
Second, with most of the policy metadata manipulations having moved to the tuf
package, this commit drops them from the policy package as they were thin
wrappers. While we originally kept them around for the purposes of migrating
versions when a repository must move from the old metadata schema to a newer
one, it doesn't make sense to implement this in every individual manipulation
function.
Finally, the rest of the packages that handle keys (for adding to metadata or
for signing / verifying) have been updated to use either
signerverifier.SSLibKey directly or the new Principal interface, depending on
what the purpose is. For now, the idea is to continue using the
signerverifier.SSLibKey representation of a key itself for the signature
verification flows, though we may eventually move that into gittuf rather than
rely on go-securesystemslib. Note that some of the transitions have been
included in this commit for compatibility reasons, and subsequent PRs will
update that. For example, the GitHub app pull request approval attestation must
be updated to not use tufv01.Key objects to represent approvers.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
This commit drops support for the legacy / custom securesystemslib key format.
This format was used in two forms:
a) In tests
b) On disk in the policy state for the root keys
To address the removal, tests have been updated to use SSH keys (via the
ssh-keygen signer). This makes up the majority of the diff for this commit, and
includes some additions to the ssh package to more easily load test artifacts.
Additionally, we don't need to store a policy state's root keys on disk for
that ref. This was an error in our initial design, and it actually leads to
complications in ensuring that the policy state's on disk keys match the keys
listed in the state's root metadata. This commit updates it so only the root
metadata's record of the root keys are used, with the keys directory omitted
for future policy states. However, we maintain backwards compatibility for
policy states that include the keys on disk, we just ignore them.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
Currently, attestations are loaded assuming the approval target is a Git tree.
Entries for tags don't have trees. Separately, we can add support for approval
attestations for tags that know not to compute merge trees when approving a
tag, instead using the commit ID the tag is expected to point to.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
