Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: make rekor verify work with sharded uuids #970

Merged
merged 1 commit into from
Aug 17, 2022
Merged

fix: make rekor verify work with sharded uuids #970

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
12 changes: 10 additions & 2 deletions cmd/rekor-cli/app/verify.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ import (
"github.com/sigstore/rekor/pkg/generated/client/entries"
"github.com/sigstore/rekor/pkg/generated/models"
"github.com/sigstore/rekor/pkg/log"
"github.com/sigstore/rekor/pkg/sharding"
"github.com/sigstore/rekor/pkg/types"
)

Expand Down Expand Up @@ -153,10 +154,17 @@ var verifyCmd = &cobra.Command{
}
}

if viper.IsSet("uuid") && (viper.GetString("uuid") != o.EntryUUID) {
return nil, fmt.Errorf("unexpected entry returned from rekor server")
if viper.IsSet("uuid") {
uuid, err := sharding.GetUUIDFromIDString(viper.GetString("uuid"))
if err != nil {
return nil, err
}
if uuid != o.EntryUUID {
return nil, fmt.Errorf("unexpected entry returned from rekor server")
}
}

// Note: the returned entry UUID is the UUID (not include the Tree ID)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't the API return the full entryUUID (including the treeID)?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's my main question in the PR description. However, the behavior is mixed... e.g. rekor-cli get returns just the raw UUID as well, and the request API here also may take the raw UUID.

Originally I had changed the response payload to fix this. Should I go back to that?

leafHash, _ := hex.DecodeString(o.EntryUUID)
if !bytes.Equal(rfc6962.DefaultHasher.HashLeaf(entryBytes), leafHash) {
return nil, fmt.Errorf("computed leaf hash did not match entry UUID")
Expand Down
10 changes: 10 additions & 0 deletions tests/sharding-e2e-test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,4 +269,14 @@ stringsMatch $NUM_ELEMENTS "2"
RETRIEVE_LOGINDEX1=$(curl -f http://localhost:3000/api/v1/log/entries/retrieve -H "Content-Type: application/json" -H "Accept: application/json" -d "{ \"logIndexes\": [1]}" | jq '.[0]' | jq -r .$UUID1.logIndex)
stringsMatch $RETRIEVE_LOGINDEX1 "1"

# Make sure that verification succeeds via UUID
echo
echo "Testing rekor-cli verification via UUID..."
$REKOR_CLI verify --uuid $UUID1 --rekor_server http://localhost:3000

# Make sure that verification succeeds via Entry ID (Tree ID in hex + UUID)
echo
echo "Testing rekor-cli verification via Entry ID..."
DEBUG=1 $REKOR_CLI verify --uuid $ENTRY_ID_1 --rekor_server http://localhost:3000

echo "Test passed successfully :)"