Sign and verify with rekorv2 by jku · Pull Request #1432 · sigstore/sigstore-python

jku · 2025-06-09T12:49:39Z

Start signing and verifying with rekor v2 (when signingconfig / trustedroot instruct to do so).

This is a continuation of #1414 (although does not use any direct commits from there). The verifier.py changes are mostly from @ramonpetgrave64

Contents:

SigningConfig now returns RekorV2Clients when appropriate
Verifier: verify_dsse() and verify_artifact() now handle v002 entry types
- _validate_*_v001_entry_body() methods are just the existing code path refactored to separate methods
- _validate_*_v002_entry_body() methods are the new validation code
tests:
- SigningConfig test are amended to test for different rekor clients
- A simple rekorv2 signing test is added
- a test asset is added for verifying rekorv2 signatures, this is used in an existing test
- A trustconfig for signing with staging rekor v2 is added to assets: It's not used in tests but is handy for manually signing with --trust-config staging-but-sign-with-rekor-v2.json

Notes:

verification code needs a careful review: it mostly only changes validation of entries getting verified but still
Decision on feature flag: Currently it's all enabled as soon as trustedroot / signingconfig contains rekor v2 instance. We could put the signing part behind a --experimental flag for a release if this seems useful -- but I think I would prefer no new flags
I originally I thought CLI changes are not needed but maybe we should add an extra line of output about rekor v2 signing being potentially slow before we make a request to rekorv2 (since we now wait until inclusion proof). Especially for operations where multiple artifacts are signed this could be a problem. The fix can be done in a followup issue but the slowness could affect the decision to gate this feature behind a CLI flag
Good ideas for better testing are welcome (I'm currently working on conformance tests, see Add verification tests / assets for staging rekor v2 sigstore-conformance#212: planning to mostly add the verification tests there if possible and not just here)

jku · 2025-06-10T14:14:46Z

rebased on the rekor v2 client branch
refactored verifier a bit more
Added a better failure for unknown entry types/versions: I think this is safe to do with regards to old bundles (the kind_version gets backfilled from the entry content itself during deserialization in those cases)

jku · 2025-06-11T09:02:25Z

last commit: Made sure we support the same signature algorithms in verification that we support with rekor v1 entries (we should support a bit more but that's another PR)

If signingconfig contains rekor v2, let's start preferring it Make sure we test the status quo (no rekor v2 in signing config) and the case where there is a rekor v2 in signing config. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

This is current staging trust root and signing config, with just the rekor v2 instance added to signing config $ TRUSTCONFIG=test/assets/trust_config/staging-but-sign-with-rekor-v2.json $ sigstore --trust-config $TRUSTCONFIG sign README.md Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

This code is originally from Ramon, updated by Jussi $ TRUSTCONFIG=test/assets/trust_config/staging-but-sign-with-rekor-v2.json $ sigstore --trust-config $TRUSTCONFIG sign README.md $ sigstore --staging verify identity \ --cert-identity jku@goto.fi \ --cert-oidc-issuer https://github.com/login/oauth README.md OK: README.md Co-authored-by: Ramon Petgrave <ramon.petgrave64@gmail.com> Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

This makes the code quite a bit uglier: we will likely want to refactor... Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

These are fairly basic for now. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

This reverts commit d7ddd50. Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

We can handle not just the key extraction but getting the whole v2.Verifier for the certificate: both v002 types need it. Also make private methods private and improve docstrings Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

This change affects the signing certificate verification in rekor v2 entries: * Support all ECDSA keys listed in https://github.com/sigstore/architecture-docs/blob/main/algorithm-registry.md * Don't support other algorithms yet since the actual signature verification does not support them currently Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku · 2025-06-13T11:14:17Z

Rebased on main after #1422 was merged: I will do a final self-review and mark this ready for review

EDIT looks fine to me. The beginnings of conformance tests are in sigstore/sigstore-conformance#216 -- that PR is pending a sigstore-python release (or at least merging of this PR)

jku · 2025-06-13T16:07:54Z

Also, a future work item is concurrent rekor requests:

Since rekor now responds to the request only after the inclusion proof is available, signing multiple artifacts is slow as currently implemented (each entry ends up integrated into the log in separate batches that only happen every few seconds)
if we sent the rekor requests in parallel, all of them could be integrated in one go so signing should no longer be very slow
this might be harder than expected -- the architecture is not designed for this and e.g. requests Session is not thread safe

(alternative to parallelizing is to talk rekor-tiles project into providing api for creating multiple entries... But that'll still require client changes)

ramonpetgrave64 · 2025-06-13T21:30:07Z

Good ideas for better testing are welcome

I think we can get a lot more coverage without writing new tests in #1441

ramonpetgrave64 · 2025-06-13T21:44:13Z

+@pytest.fixture
+def staging_with_rekorv2() -> tuple[
+    type[SigningContext], type[Verifier], IdentityToken
+]:


In #1441, we could add another param specific for this "alpha" instance.

Hayden-IO · 2025-07-01T14:36:50Z

@di @woodruffw can you take a pass over this? I’ve reviewed it, it looks functionally good, though I can’t speak to how pythonic it is.

woodruffw · 2025-07-01T15:35:29Z

LGTM -- I did a pass over the verifier bits and nothing stood out to me 🙂

jku · 2025-07-08T08:34:17Z

Thanks all: I think I will merge this today.

Possibly we want to remedy rekorv2: parallelize entry requests #1446 before a release: will look at Ramons work on that next
We can still add a feature flag to keep signing with rekor2 disabled by default

I'll file a tracking issue for next release so we don't drop the ball on those

jku mentioned this pull request Jun 9, 2025

sign and verify with Rekorv2 #1414

Closed

4 tasks

jku changed the title ~~Sign with rekorv2~~ Sign and verify with rekorv2 Jun 9, 2025

jku commented Jun 9, 2025

View reviewed changes

Comment thread sigstore/verify/verifier.py Outdated

ramonpetgrave64 mentioned this pull request Jun 9, 2025

Additons to Sign with rekorv2 #1437

Merged

jku force-pushed the rekov2-client branch 2 times, most recently from 334e1b2 to 983bfa6 Compare June 10, 2025 08:16

jku commented Jun 10, 2025

View reviewed changes

Comment thread sigstore/verify/verifier.py Outdated

jku commented Jun 10, 2025

View reviewed changes

Comment thread sigstore/verify/verifier.py Outdated

jku force-pushed the sign-with-rekorv2 branch from 9b0a970 to e47e555 Compare June 10, 2025 14:11

jku commented Jun 10, 2025

View reviewed changes

Comment thread sigstore/verify/verifier.py Outdated

ramonpetgrave64 mentioned this pull request Jun 10, 2025

Client support for Rekor V2: sigstore-python sigstore/rekor-tiles#289

Closed

35 tasks

jku mentioned this pull request Jun 11, 2025

Support more signing cert signing algorithms in verification #1439

Open

Base automatically changed from rekov2-client to main June 12, 2025 18:27

jku and others added 14 commits June 13, 2025 14:11

verifier: Fix lint issues

57ea545

This makes the code quite a bit uglier: we will likely want to refactor... Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

tests: Add tests for signing and verifying rekorv2 bundles

9eec8b7

These are fairly basic for now. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

refactor entry validation

b04e3c0

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

use staging_with_rekorv2 fixture

e173a3b

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

staging_with_rekorv2 uses embedded trust config

c868f55

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

verify rekorv2 dssse bundle

732cdbf

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

Revert "staging_with_rekorv2 uses embedded trust config"

46d9873

This reverts commit d7ddd50. Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

use ambient oidc

5261d23

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

verifier: One more refactor

c0733ac

We can handle not just the key extraction but getting the whole v2.Verifier for the certificate: both v002 types need it. Also make private methods private and improve docstrings Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

verifier: Improve error messages with unknown types

600eb7e

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

jku force-pushed the sign-with-rekorv2 branch from 441c416 to 47b7664 Compare June 13, 2025 11:13

jku marked this pull request as ready for review June 13, 2025 13:15

jku requested review from di and woodruffw June 13, 2025 13:19

woodruffw added component:signing Core signing functionality component:verification Core verification functionality labels Jun 13, 2025

Merge branch 'main' into sign-with-rekorv2

7d898c5

jku mentioned this pull request Jun 13, 2025

rekorv2: parallelize entry requests #1446

Closed

ramonpetgrave64 approved these changes Jun 13, 2025

View reviewed changes

Hayden-IO reviewed Jun 17, 2025

View reviewed changes

Comment thread sigstore/verify/verifier.py

Comment thread sigstore/verify/verifier.py

jku mentioned this pull request Jun 23, 2025

Add function for determining key_details #1456

Merged

Merge branch 'main' into sign-with-rekorv2

00fae2a

woodruffw approved these changes Jul 1, 2025

View reviewed changes

jku added 2 commits July 8, 2025 11:34

Merge branch 'main' into sign-with-rekorv2

498cffd

Merge branch 'main' into sign-with-rekorv2

9ae51b3

jku merged commit b7d2138 into main Jul 8, 2025
26 checks passed

jku deleted the sign-with-rekorv2 branch July 8, 2025 13:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sign and verify with rekorv2#1432

Sign and verify with rekorv2#1432
jku merged 18 commits into
mainfrom
sign-with-rekorv2

jku commented Jun 9, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jku commented Jun 10, 2025

Uh oh!

Uh oh!

jku commented Jun 11, 2025

Uh oh!

jku commented Jun 13, 2025 •

edited

Loading

Uh oh!

jku commented Jun 13, 2025 •

edited

Loading

Uh oh!

ramonpetgrave64 commented Jun 13, 2025

Uh oh!

ramonpetgrave64 Jun 13, 2025

Uh oh!

Uh oh!

Uh oh!

Hayden-IO commented Jul 1, 2025

Uh oh!

woodruffw commented Jul 1, 2025

Uh oh!

jku commented Jul 8, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

jku commented Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jku commented Jun 10, 2025

Uh oh!

Uh oh!

jku commented Jun 11, 2025

Uh oh!

jku commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jku commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ramonpetgrave64 commented Jun 13, 2025

Uh oh!

ramonpetgrave64 Jun 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Hayden-IO commented Jul 1, 2025

Uh oh!

woodruffw commented Jul 1, 2025

Uh oh!

jku commented Jul 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jku commented Jun 9, 2025 •

edited

Loading

jku commented Jun 13, 2025 •

edited

Loading

jku commented Jun 13, 2025 •

edited

Loading

jku commented Jul 8, 2025 •

edited

Loading