-
Notifications
You must be signed in to change notification settings - Fork 259
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fragment COSE Sign1 support. Allows for a fragment presented by the h…
…ost (#1575) to be checked for a good cert chain and a valid issuer DID that matches the certs and so the signature. Includes DID and COSE Sign1 packages and tooling. Support extracting a DID directly from a COSE Sign1 document and also support single cert COSE Sign document checking, but not DID generation. `signutil` is a debug tool that allows generating valid DID given a COSE Sign1 document and provides other utility functions like printing cert chain, leaf certs, displaying COSE Sign1 document content etc. Signed-off-by: Ken Gordon <ken.gordon@microsoft.com>
- Loading branch information
Showing
244 changed files
with
64,187 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,3 +43,7 @@ test/results | |
| # go workspace files | ||
| go.work | ||
| go.work.sum | ||
|
|
||
| # keys and related artifacts | ||
| *.pem | ||
| *.cose | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| *.pem | ||
| *.srl | ||
| sign1util | ||
| *.cose | ||
| *.base64 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| # | ||
| # This makefile lets us exercise the library via the sign1util tool and shows various examples of | ||
| # creating and checking COSE Sign1 documents as well as getting DID:x509 documents out of them | ||
| # Note that today the PEM files that match are not checked in as the github/ADO credential checker will trigger. | ||
| # I may fix that with some head/tail magic. Meanwhile, you need to build fresh certs with make -f Makefile.certs | ||
| # and these checks below (for infra.rego.cose, not the EPRS one) will fail. You will need to update the certificate | ||
| # fingerprints to match the fresh ones. | ||
| # | ||
| # eg change the following | ||
| # | ||
| #did-check: chain.pem infra.rego.cose sign1util | ||
| # ./sign1util check -in infra.rego.cose -did did:x509:0:sha256:RgpNsHOK5hPlCAfTtiGY_BcDhFRxQbJnhlxNDhxps6U::subject:CN:Test%20Leaf%20%28DO%20NOT%20TRUST%29 | ||
| # | ||
| # to | ||
| # | ||
| #did-check: chain.pem infra.rego.cose sign1util | ||
| # ./sign1util check -in infra.rego.cose -did did:x509:0:sha256:my-new-cert-fingerprint::subject:CN:Test%20Leaf%20%28DO%20NOT%20TRUST%29 | ||
| # | ||
| # where | ||
| # | ||
| # ./sign1util did:x509 -chain chain.pem -i 1 -policy "subject:CN:Test Leaf (DO NOT TRUST)" | ||
| # | ||
| # will print the new fingerprint of the intermediate cert as part of the did:x509 generated | ||
| # | ||
|
|
||
| cose: infra.rego.cose | ||
|
|
||
| # from these media types have to match containerd. The also need to change and the security policy one ought to be x-ms-ccepolicy-frag | ||
| # fragment atrifact type = application/x-ms-ccepolicy-frag | ||
| # fragment media type = application/cose_x509+rego | ||
|
|
||
| # Use a local linux build of the tool for the purposes of this Makefile - ie assume using in wsl. | ||
| # Usually sign1util.exe is a windows exe in /mnt/c/ContainerPlat aka c:\ContainerPlat but that is not certain. | ||
|
|
||
| sign1util: ../../internal/tools/sign1util/main.go *.go | ||
| go build ../../internal/tools/sign1util | ||
|
|
||
| infra.rego.cose: infra.rego.base64 chain.pem leaf.private.pem sign1util | ||
| ./sign1util create -algo ES384 -chain chain.pem -claims infra.rego.base64 -key leaf.private.pem -out $@ -issuer TestIssuer -feed TestFeed -salt zero | ||
| ./sign1util check -in $@ | ||
|
|
||
| print: infra.rego.cose sign1util | ||
| ./sign1util chain -in $< > tmp.chain.pem | ||
| ./sign1util did:x509 -chain tmp.chain.pem --policy cn | ||
|
|
||
| show: sign1util | ||
| ./sign1util chain -in esrp.test.cose > tmp.chain.pem | ||
| ./sign1util did:x509 -chain tmp.chain.pem -policy cn | ||
|
|
||
|
|
||
| didx509: chain.pem sign1util | ||
| ./sign1util did:x509 -chain chain.pem -i 1 -policy "subject:CN:Test Leaf (DO NOT TRUST)" -verbose | ||
|
|
||
| # for this to pass the did:x509 fingerprint (RgpNsHOK5hPlCAfTtiGY_BcDhFRxQbJnhlxNDhxps6U here) needs to be the one output from make print | ||
| did-check: chain.pem infra.rego.cose sign1util | ||
| ./sign1util check -in infra.rego.cose -did did:x509:0:sha256:RgpNsHOK5hPlCAfTtiGY_BcDhFRxQbJnhlxNDhxps6U::subject:CN:Test%20Leaf%20%28DO%20NOT%20TRUST%29 | ||
|
|
||
| # For normal workflow start from the chain.pem, here we'd take the chain from inside the cose sign1 doc, eg to manually confirm it is | ||
| # as otherwise expected (ie that the issuer DID matches the chain) or to shortcut getting a DID from a cose document. | ||
|
|
||
| did-from-cose: sign1util infra.rego.cose | ||
| ./sign1util did:x509 -in infra.rego.cose -policy cn | ||
|
|
||
| did-fail-fingerprint: chain.pem sign1util | ||
| ./sign1util check -chain chain.pem -in infra.rego.cose -did did:x509:0:sha256:XXXi_nuWegx4NiLaeGabiz36bDUhDDiHEFl8HXMA_4o::subject:CN:Test+Leaf+%28DO+NOT+TRUST%29 | ||
|
|
||
| did-fail-subject: chain.pem sign1util | ||
| ./sign1util check -chain chain.pem -in infra.rego.cose -did did:x509:0:sha256:RgpNsHOK5hPlCAfTtiGY_BcDhFRxQbJnhlxNDhxps6U::subject:CN:Test+XXXX+%28DO+NOT+TRUST%29 | ||
|
|
||
| did-fail: did-fail-subject did-fail-fingerprint | ||
|
|
||
|
|
||
| # beyond the scope of this repo | ||
| #infra.rego.base64: infra-fragment.toml | ||
| # /mnt/c/ContainerPlat/securitypolicy.exe -c infra-fragment.toml -n infra -v 1.0.0 -t fragment > infra.rego.base64 | ||
|
|
||
| # this would push the COSE Sign1 fragment given the appropriate env variables | ||
| #oras: infra.rego.cose | ||
| # oras push ${REGISTRY}/${INFRA_REPO}:latest \ | ||
| # --artifact-type application/x-ms-ccepolicy-frag \ | ||
| # --manifest-config /dev/null:application/vnd.unknown.config.v1+json \ | ||
| # --subject ${INFRA_IMAGE} \ | ||
| # ./infra.rego.cose:application/cose_x509+rego | ||
|
|
||
| %.pem: | ||
| $(MAKE) -f Makefile.certs chain.pem | ||
|
|
||
|
|
||
| infra.rego.base64: infra.rego | ||
| base64 infra.rego > infra.rego.base64 | ||
|
|
||
| clean: | ||
| $(MAKE) -f Makefile.certs $@ | ||
| rm -f infra.rego.base64 infra.rego.cose sign1util |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| all: chain.pem | ||
|
|
||
| %.private.pem: | ||
| openssl ecparam -name secp384r1 -genkey -noout -out $@ | ||
|
|
||
| %.public.pem: %.private.pem | ||
| openssl ec -in $< -pubout -out $@ | ||
|
|
||
| root.cert.pem: root.private.pem | ||
| openssl req -new -key $< -out $@.tmp.csr -subj "/CN=Test Root CA (DO NOT TRUST)" -addext 'basicConstraints=critical,CA:TRUE' -addext 'keyUsage=digitalSignature,keyCertSign' | ||
| openssl x509 -req -days 365 -in $@.tmp.csr -signkey $< -out $@ -CAcreateserial -extfile cert.extensions.cfg | ||
| rm -rf $@.tmp.csr | ||
|
|
||
| intermediate.cert.pem: intermediate.private.pem | root.private.pem | ||
| openssl req -new -key $< -out $@.tmp.csr -subj "/CN=Test Intermediate CA (DO NOT TRUST)" -addext 'basicConstraints=critical,CA:TRUE' -addext 'keyUsage=digitalSignature,keyCertSign' | ||
| openssl x509 -req -days 365 -in $@.tmp.csr -CA ${subst private,cert,$|} -CAkey $| -out $@ -CAcreateserial -extfile cert.extensions.cfg | ||
| rm $@.tmp.csr | ||
|
|
||
| leaf.cert.pem: leaf.private.pem | intermediate.private.pem | ||
| openssl req -new -key $< -out $@.tmp.csr -subj "/CN=Test Leaf (DO NOT TRUST)" | ||
| openssl x509 -req -days 365 -in $@.tmp.csr -CA ${subst private,cert,$|} -CAkey $| -out $@ -CAcreateserial | ||
| rm -rf $@.tmp.csr | ||
|
|
||
| chain.pem: root.cert.pem intermediate.cert.pem leaf.cert.pem | root.public.pem intermediate.public.pem leaf.public.pem | ||
| rm -rf $@ | ||
| cat `(for d in $^; do echo $$d; done) | tac` >> $@ | ||
|
|
||
| clean: | ||
| rm -f chain.pem root.*.pem intermediate.*.pem leaf.*.pem *.tmp.csr *.cert.srl |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| basicConstraints=critical,CA:TRUE | ||
| keyUsage=digitalSignature,keyCertSign |
Oops, something went wrong.