Skip to content

Support dsse as hashedrekord#99

Merged
wolfv merged 3 commits into
sigstore:mainfrom
jku:support-dsse-as-hashedrekord
May 29, 2026
Merged

Support dsse as hashedrekord#99
wolfv merged 3 commits into
sigstore:mainfrom
jku:support-dsse-as-hashedrekord

Conversation

@jku

@jku jku commented May 26, 2026

Copy link
Copy Markdown
Member

Rekor2: Support DSSE via Hashedrekord entries

This is based on sigstore/architecture-docs#63

  • With Rekor v2 DSSE envelopes are supported via Hashedrekord entries instead of a dedicated dsse entry
  • digest is Hash(PAE(payloadType, payload))
  • Signature is the DSSE envelope signature

This removes all support for the "dsse 0.0.2" entry type: this seems ok as rekor v2 signing was never deployed in production (the log is there, it's just never been included in the SigningConfig).

  • When signing with rekor v2, build a "hashedrekord 0.0.2" entry with digest and signature as described above
  • When verifying hashedrekord, compute hash depending on bundle content
  • When matching hashedrekord signatures, use envelope signatures when appropriate
  • When verifying rekor entry consistency, accept a DSSE envelope with a "hashedrekord 0.0.2" entry

Testing:

  • Implement a few new verification tests
  • Use conformance main for now (tests for this are not released yet)

The test asset is from
cargo run -p sigstore-sign --example sign_attestation -- --staging crates/sigstore-verify/test_data/bundles/signed-package-2.1.0-hb0f4dca_0.conda -o crates/sigstore-verify/test_data/bundles/conda-attestation-rekor2.sigstore.json
and verifies with:
cargo run -p sigstore-verify --example verify_bundle -- --staging crates/sigstore-verify/test_data/bundles/signed-package-2.1.0-hb0f4dca_0.conda crates/sigstore-verify/test_data/bundles/conda-attestation-rekor2.sigstore.json

@jku jku force-pushed the support-dsse-as-hashedrekord branch 2 times, most recently from 6c0b83f to 145756e Compare May 26, 2026 07:59
@jku

jku commented May 27, 2026

Copy link
Copy Markdown
Member Author

I've opened #102, #103 as better defined, more focused PRs from this one: once those have been somehow handled I will update this branch so it only includes the dsse-as-hashedrekord change

@jku

jku commented May 28, 2026

Copy link
Copy Markdown
Member Author

Currently using a commit from conformance main to get the new tests for the dsse-as-hashedrekord: next conformance release will contain them

@jku jku force-pushed the support-dsse-as-hashedrekord branch from 3ad6452 to 502e00a Compare May 28, 2026 07:13
@jku

jku commented May 28, 2026

Copy link
Copy Markdown
Member Author

rebased on both #102 and #103.

@jku jku force-pushed the support-dsse-as-hashedrekord branch from 502e00a to fad59d7 Compare May 28, 2026 09:15
jku added 2 commits May 28, 2026 15:13
The new DSSE-as-hashedrekord tests have not yet been released

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
This is based on sigstore/architecture-docs#63
* With Rekor v2 DSSE envelopes are supported via Hashedrekord entries
  instead of a dedicated dsse entry
* digest is Hash(PAE(payloadType, payload))
* Signature is the DSSE envelope signature

This commit removes all support for the "dsse 0.0.2" entry type: this seems
ok as rekor v2 signing was never deployed in production.
* When signing with rekor v2, build a "hashedrekord 0.0.2" entry with digest
  and signature as described above
* When verifying hashedrekord, compute hash depending on bundle content
* When matching hashedrekord signatures, use envelope signatures when appropriate
* When verifying rekor entry consistency, accept a DSSE envelope with a
  "hashedrekord 0.0.2" entry

Testing:
* Implement a few new verification tests

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku jku force-pushed the support-dsse-as-hashedrekord branch from fad59d7 to 68ddc8f Compare May 28, 2026 12:34
@jku

jku commented May 28, 2026

Copy link
Copy Markdown
Member Author

I suppose this is ready for review

@jku jku marked this pull request as ready for review May 28, 2026 12:40

@loosebazooka loosebazooka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mostly questions about rust for me to understand.

let dsse_entry = DsseEntryV2::new(envelope, certificate);
let entry = rekor.create_dsse_entry_v2(dsse_entry).await.map_err(|e| {
Error::Signing(format!("Failed to create DSSE Rekor entry: {}", e))
let hash = sigstore_crypto::sha256(&envelope.pae());

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there no standard rust crypto that does sha256?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There indeed is no standard crypto in Rust.

We use aws-lc IIRC. I don't know why we use our own wrapper but my guess would be:

  • hide aws-lc so it can be swapped out if needed
  • get some nicer de/serialization (to base64 etc)

Comment thread crates/sigstore-sign/src/sign.rs Outdated
Comment thread crates/sigstore-sign/src/sign.rs

// Use V1 or V2 API based on configuration
let (log_entry, version) = match self.rekor_api_version {
let (log_entry, kind, version) = match self.rekor_api_version {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

how is log_entry typed here (just to the closest viable parent?)

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

log_entry is always a LogEntry (the rekor v2 code path has some "conversion code" that I'm not yet familiar with)

// Compute hash from artifact (bytes or pre-computed digest) or DSSE envelope
let hash = match &bundle.content {
SignatureContent::MessageSignature(_) => compute_artifact_digest(artifact),
SignatureContent::DsseEnvelope(envelope) => sigstore_crypto::sha256(&envelope.pae()),

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought you needed to use the algorithm_registry to get the signing algorithm to determine the hash algorithm. (maybe rust is just sha256 for now?)

@jku jku May 29, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I think you are correct: there is no dynamic hash selection for hashedrekord right now. Filed #104 for this

We should have a test for this in conformance -- cover the signing algorithms we actually care about -- otherwise this is not going to actually work in any client

Comment thread crates/sigstore-verify/src/verify_impl/hashedrekord.rs
As per specification

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@wolfv wolfv merged commit 0ef57c1 into sigstore:main May 29, 2026
16 checks passed
@wolfv wolfv mentioned this pull request May 28, 2026
@jku jku mentioned this pull request May 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants