Skip to content

Commit 3c2835d

Browse files
bobcallawaybobcallaway
committed
process type contents serially
Signed-off-by: Bob Callaway <[email protected]>
1 parent fe7e8e6 commit 3c2835d

File tree

5 files changed

+104
-370
lines changed

5 files changed

+104
-370
lines changed

‎pkg/types/alpine/v0.0.1/entry.go‎

Lines changed: 27 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ import (
3232

3333
"github.com/go-openapi/strfmt"
3434
"github.com/go-openapi/swag/conv"
35-
"golang.org/x/sync/errgroup"
3635

3736
"github.com/sigstore/rekor/pkg/generated/models"
3837
"github.com/sigstore/rekor/pkg/log"
@@ -179,122 +178,55 @@ func (v *V001Entry) Unmarshal(pe models.ProposedEntry) error {
179178
return v.validate()
180179
}
181180

182-
func (v *V001Entry) fetchExternalEntities(ctx context.Context) (*x509.PublicKey, *alpine.Package, error) {
181+
func (v *V001Entry) fetchExternalEntities(_ context.Context) (*x509.PublicKey, *alpine.Package, error) {
183182
if err := v.validate(); err != nil {
184183
return nil, nil, &types.InputValidationError{Err: err}
185184
}
186185

187-
g, ctx := errgroup.WithContext(ctx)
188-
189-
hashR, hashW := io.Pipe()
190-
apkR, apkW := io.Pipe()
191-
defer hashR.Close()
192-
defer apkR.Close()
193-
194-
closePipesOnError := types.PipeCloser(hashR, hashW, apkR, apkW)
195-
196186
oldSHA := ""
197187
if v.AlpineModel.Package.Hash != nil && v.AlpineModel.Package.Hash.Value != nil {
198188
oldSHA = conv.Value(v.AlpineModel.Package.Hash.Value)
199189
}
200190

201-
g.Go(func() error {
202-
defer hashW.Close()
203-
defer apkW.Close()
204-
205-
dataReadCloser := bytes.NewReader(v.AlpineModel.Package.Content)
206-
207-
/* #nosec G110 */
208-
if _, err := io.Copy(io.MultiWriter(hashW, apkW), dataReadCloser); err != nil {
209-
return closePipesOnError(err)
210-
}
211-
return nil
212-
})
213-
214-
hashResult := make(chan string)
215-
216-
g.Go(func() error {
217-
defer close(hashResult)
218-
hasher := sha256.New()
219-
220-
if _, err := io.Copy(hasher, hashR); err != nil {
221-
return closePipesOnError(err)
222-
}
223-
224-
computedSHA := hex.EncodeToString(hasher.Sum(nil))
225-
if oldSHA != "" && computedSHA != oldSHA {
226-
return closePipesOnError(&types.InputValidationError{Err: fmt.Errorf("SHA mismatch: %s != %s", computedSHA, oldSHA)})
227-
}
228-
229-
select {
230-
case <-ctx.Done():
231-
return ctx.Err()
232-
case hashResult <- computedSHA:
233-
return nil
234-
}
235-
})
236-
237-
keyResult := make(chan *x509.PublicKey)
238-
239-
g.Go(func() error {
240-
defer close(keyResult)
241-
keyReadCloser := bytes.NewReader(*v.AlpineModel.PublicKey.Content)
242-
243-
keyObj, err := x509.NewPublicKey(keyReadCloser)
244-
if err != nil {
245-
return closePipesOnError(&types.InputValidationError{Err: err})
246-
}
247-
248-
select {
249-
case <-ctx.Done():
250-
return ctx.Err()
251-
case keyResult <- keyObj:
252-
return nil
253-
}
254-
})
255-
256-
var apkObj *alpine.Package
257-
var key *x509.PublicKey
258-
259-
g.Go(func() error {
260-
apk := alpine.Package{}
261-
if err := apk.Unmarshal(apkR); err != nil {
262-
return closePipesOnError(&types.InputValidationError{Err: err})
263-
}
264-
265-
key = <-keyResult
266-
if key == nil {
267-
return closePipesOnError(errors.New("error processing public key"))
268-
}
191+
// Parse public key
192+
keyObj, err := x509.NewPublicKey(bytes.NewReader(*v.AlpineModel.PublicKey.Content))
193+
if err != nil {
194+
return nil, nil, &types.InputValidationError{Err: err}
195+
}
269196

270-
if err := apk.VerifySignature(key.CryptoPubKey()); err != nil {
271-
return closePipesOnError(&types.InputValidationError{Err: err})
272-
}
197+
// Parse package and verify hash
198+
dataReadCloser := bytes.NewReader(v.AlpineModel.Package.Content)
199+
hasher := sha256.New()
273200

274-
apkObj = &apk
201+
/* #nosec G110 */
202+
packageData := bytes.NewBuffer(nil)
203+
if _, err := io.Copy(io.MultiWriter(hasher, packageData), dataReadCloser); err != nil {
204+
return nil, nil, err
205+
}
275206

276-
select {
277-
case <-ctx.Done():
278-
return ctx.Err()
279-
default:
280-
return nil
281-
}
282-
})
207+
computedSHA := hex.EncodeToString(hasher.Sum(nil))
208+
if oldSHA != "" && computedSHA != oldSHA {
209+
return nil, nil, &types.InputValidationError{Err: fmt.Errorf("SHA mismatch: %s != %s", computedSHA, oldSHA)}
210+
}
283211

284-
computedSHA := <-hashResult
212+
// Parse and verify package
213+
apk := alpine.Package{}
214+
if err := apk.Unmarshal(packageData); err != nil {
215+
return nil, nil, &types.InputValidationError{Err: err}
216+
}
285217

286-
if err := g.Wait(); err != nil {
287-
return nil, nil, err
218+
if err := apk.VerifySignature(keyObj.CryptoPubKey()); err != nil {
219+
return nil, nil, &types.InputValidationError{Err: err}
288220
}
289221

290-
// if we get here, all goroutines succeeded without error
222+
// Set hash if not provided
291223
if oldSHA == "" {
292224
v.AlpineModel.Package.Hash = &models.AlpineV001SchemaPackageHash{}
293225
v.AlpineModel.Package.Hash.Algorithm = conv.Pointer(models.AlpineV001SchemaPackageHashAlgorithmSha256)
294226
v.AlpineModel.Package.Hash.Value = conv.Pointer(computedSHA)
295227
}
296228

297-
return key, apkObj, nil
229+
return keyObj, &apk, nil
298230
}
299231

300232
func (v *V001Entry) Canonicalize(ctx context.Context) ([]byte, error) {

‎pkg/types/helm/v0.0.1/entry.go‎

Lines changed: 19 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ import (
3838
"github.com/sigstore/rekor/pkg/types"
3939
"github.com/sigstore/rekor/pkg/types/helm"
4040
"github.com/sigstore/rekor/pkg/util"
41-
"golang.org/x/sync/errgroup"
4241
)
4342

4443
const (
@@ -190,88 +189,35 @@ func DecodeEntry(input any, output *models.HelmV001Schema) error {
190189
}
191190
}
192191

193-
func (v *V001Entry) fetchExternalEntities(ctx context.Context) (*helm.Provenance, *pgp.PublicKey, *pgp.Signature, error) {
192+
func (v *V001Entry) fetchExternalEntities(_ context.Context) (*helm.Provenance, *pgp.PublicKey, *pgp.Signature, error) {
194193
if err := v.validate(); err != nil {
195194
return nil, nil, nil, &types.InputValidationError{Err: err}
196195
}
197196

198-
g, ctx := errgroup.WithContext(ctx)
199-
200-
provenanceR, provenanceW := io.Pipe()
201-
defer provenanceR.Close()
202-
203-
closePipesOnError := types.PipeCloser(provenanceR, provenanceW)
204-
205-
g.Go(func() error {
206-
defer provenanceW.Close()
207-
208-
dataReadCloser := bytes.NewReader(v.HelmObj.Chart.Provenance.Content)
209-
210-
/* #nosec G110 */
211-
if _, err := io.Copy(provenanceW, dataReadCloser); err != nil {
212-
return closePipesOnError(err)
213-
}
214-
return nil
215-
})
216-
217-
keyResult := make(chan *pgp.PublicKey)
218-
219-
g.Go(func() error {
220-
defer close(keyResult)
221-
keyReadCloser := bytes.NewReader(*v.HelmObj.PublicKey.Content)
222-
223-
keyObj, err := pgp.NewPublicKey(keyReadCloser)
224-
if err != nil {
225-
return closePipesOnError(&types.InputValidationError{Err: err})
226-
}
227-
228-
select {
229-
case <-ctx.Done():
230-
return ctx.Err()
231-
case keyResult <- keyObj:
232-
return nil
233-
}
234-
})
197+
// Parse public key
198+
keyObj, err := pgp.NewPublicKey(bytes.NewReader(*v.HelmObj.PublicKey.Content))
199+
if err != nil {
200+
return nil, nil, nil, &types.InputValidationError{Err: err}
201+
}
235202

236-
var key *pgp.PublicKey
203+
// Parse provenance
237204
provenance := &helm.Provenance{}
238-
var sig *pgp.Signature
239-
g.Go(func() error {
240-
241-
if err := provenance.Unmarshal(provenanceR); err != nil {
242-
return closePipesOnError(&types.InputValidationError{Err: err})
243-
}
244-
245-
key = <-keyResult
246-
if key == nil {
247-
return closePipesOnError(errors.New("error processing public key"))
248-
}
249-
250-
// Set signature
251-
var err error
252-
sig, err = pgp.NewSignature(provenance.Block.ArmoredSignature.Body)
253-
if err != nil {
254-
return closePipesOnError(&types.InputValidationError{Err: err})
255-
}
256-
257-
// Verify signature
258-
if err := sig.Verify(bytes.NewReader(provenance.Block.Bytes), key); err != nil {
259-
return closePipesOnError(&types.InputValidationError{Err: err})
260-
}
205+
if err := provenance.Unmarshal(bytes.NewReader(v.HelmObj.Chart.Provenance.Content)); err != nil {
206+
return nil, nil, nil, &types.InputValidationError{Err: err}
207+
}
261208

262-
select {
263-
case <-ctx.Done():
264-
return ctx.Err()
265-
default:
266-
return nil
267-
}
268-
})
209+
// Create signature
210+
sig, err := pgp.NewSignature(provenance.Block.ArmoredSignature.Body)
211+
if err != nil {
212+
return nil, nil, nil, &types.InputValidationError{Err: err}
213+
}
269214

270-
if err := g.Wait(); err != nil {
271-
return nil, nil, nil, err
215+
// Verify signature
216+
if err := sig.Verify(bytes.NewReader(provenance.Block.Bytes), keyObj); err != nil {
217+
return nil, nil, nil, &types.InputValidationError{Err: err}
272218
}
273219

274-
return provenance, key, sig, nil
220+
return provenance, keyObj, sig, nil
275221
}
276222

277223
func (v *V001Entry) Canonicalize(ctx context.Context) ([]byte, error) {

0 commit comments

Comments
 (0)