Skip to content

Commit a1e7b71

Browse files
aaronlew02aaronlew02
committed
Replace --use-signing-config with --no-signing-config
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
1 parent 11392f7 commit a1e7b71

15 files changed

Lines changed: 52 additions & 38 deletions

‎cmd/cosign/cli/attest.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ func Attest() *cobra.Command {
100100
IssueCertificateForExistingKey: o.IssueCertificate,
101101
BundlePath: o.BundlePath,
102102
}
103-
if err := signcommon.LoadSigningConfigAndTrustedMaterial(cmd.Context(), &ko, o.UseSigningConfig, o.SigningConfigPath, o.TrustedRootPath); err != nil {
103+
if err := signcommon.LoadSigningConfigAndTrustedMaterial(cmd.Context(), &ko, o.NoSigningConfig, o.SigningConfigPath, o.TrustedRootPath); err != nil {
104104
return err
105105
}
106106

‎cmd/cosign/cli/attest_blob.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ func AttestBlob() *cobra.Command {
8181
IssueCertificateForExistingKey: o.IssueCertificate,
8282
BundlePath: o.BundlePath,
8383
}
84-
if err := signcommon.LoadSigningConfigAndTrustedMaterial(cmd.Context(), &ko, o.UseSigningConfig, o.SigningConfigPath, o.TrustedRootPath); err != nil {
84+
if err := signcommon.LoadSigningConfigAndTrustedMaterial(cmd.Context(), &ko, o.NoSigningConfig, o.SigningConfigPath, o.TrustedRootPath); err != nil {
8585
return err
8686
}
8787

‎cmd/cosign/cli/options/attest.go‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ type AttestOptions struct {
3232
TSAClientKey string
3333
TSAServerName string
3434
BundlePath string
35-
UseSigningConfig bool
35+
NoSigningConfig bool
3636
SigningConfigPath string
3737
TrustedRootPath string
3838

@@ -95,14 +95,13 @@ func (o *AttestOptions) AddFlags(cmd *cobra.Command) {
9595
"write everything required to verify the blob to a FILE")
9696
_ = cmd.MarkFlagFilename("bundle", bundleExts...)
9797

98-
cmd.Flags().BoolVar(&o.UseSigningConfig, "use-signing-config", true,
99-
"whether to use a TUF-provided signing config for the service URLs")
100-
_ = cmd.Flags().MarkDeprecated("use-signing-config", "an offline signing flag will be added in the future; TUF will continue to provide a signing config by default if one is not provided manually")
98+
cmd.Flags().BoolVar(&o.NoSigningConfig, "no-signing-config", false,
99+
"do not use a signing config or connect to any Sigstore services")
101100

102101
cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
103102
"path to a signing config file")
104103

105-
cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
104+
cmd.MarkFlagsMutuallyExclusive("no-signing-config", "signing-config")
106105

107106
cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
108107
"optional path to a TrustedRoot JSON file to verify a signature after signing")

‎cmd/cosign/cli/options/attest_blob.go‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ type AttestBlobOptions struct {
4040
OIDC OIDCOptions
4141
SecurityKey SecurityKeyOptions
4242

43-
UseSigningConfig bool
43+
NoSigningConfig bool
4444
SigningConfigPath string
4545
TrustedRootPath string
4646
}
@@ -74,14 +74,13 @@ func (o *AttestBlobOptions) AddFlags(cmd *cobra.Command) {
7474
_ = cmd.MarkFlagFilename("bundle", bundleExts...)
7575
_ = cmd.MarkFlagRequired("bundle")
7676

77-
cmd.Flags().BoolVar(&o.UseSigningConfig, "use-signing-config", true,
78-
"whether to use a TUF-provided signing config for the service URLs")
79-
_ = cmd.Flags().MarkDeprecated("use-signing-config", "an offline signing flag will be added in the future; TUF will continue to provide a signing config by default if one is not provided manually")
77+
cmd.Flags().BoolVar(&o.NoSigningConfig, "no-signing-config", false,
78+
"do not use a signing config or connect to any Sigstore services")
8079

8180
cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
8281
"path to a signing config file")
8382

84-
cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
83+
cmd.MarkFlagsMutuallyExclusive("no-signing-config", "signing-config")
8584

8685
cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
8786
"optional path to a TrustedRoot JSON file to verify a signature after signing")

‎cmd/cosign/cli/options/sign.go‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ type SignOptions struct {
3333
TSAClientKey string
3434
TSAServerName string
3535
IssueCertificate bool
36-
UseSigningConfig bool
36+
NoSigningConfig bool
3737
SigningConfigPath string
3838
TrustedRootPath string
3939

@@ -105,14 +105,13 @@ func (o *SignOptions) AddFlags(cmd *cobra.Command) {
105105
"issue a code signing certificate from Fulcio, even if a key is provided")
106106
_ = cmd.Flags().MarkDeprecated("issue-certificate", "support for this flag will be removed in the future")
107107

108-
cmd.Flags().BoolVar(&o.UseSigningConfig, "use-signing-config", true,
109-
"whether to use a TUF-provided signing config for the service URLs")
110-
_ = cmd.Flags().MarkDeprecated("use-signing-config", "an offline signing flag will be added in the future; TUF will continue to provide a signing config by default if one is not provided manually")
108+
cmd.Flags().BoolVar(&o.NoSigningConfig, "no-signing-config", false,
109+
"do not use a signing config or connect to any Sigstore services")
111110

112111
cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
113112
"path to a signing config file")
114113

115-
cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
114+
cmd.MarkFlagsMutuallyExclusive("no-signing-config", "signing-config")
116115

117116
cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
118117
"optional path to a TrustedRoot JSON file to verify a signature after signing")

‎cmd/cosign/cli/options/signblob.go‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ type SignBlobOptions struct {
4242
IssueCertificate bool
4343
SigningAlgorithm string
4444

45-
UseSigningConfig bool
45+
NoSigningConfig bool
4646
SigningConfigPath string
4747
TrustedRootPath string
4848
}
@@ -75,14 +75,13 @@ func (o *SignBlobOptions) AddFlags(cmd *cobra.Command) {
7575
_ = cmd.MarkFlagFilename("bundle", bundleExts...)
7676
_ = cmd.MarkFlagRequired("bundle")
7777

78-
cmd.Flags().BoolVar(&o.UseSigningConfig, "use-signing-config", true,
79-
"whether to use a TUF-provided signing config for the service URLs")
80-
_ = cmd.Flags().MarkDeprecated("use-signing-config", "an offline signing flag will be added in the future; TUF will continue to provide a signing config by default if one is not provided manually")
78+
cmd.Flags().BoolVar(&o.NoSigningConfig, "no-signing-config", false,
79+
"do not use a signing config or connect to any Sigstore services")
8180

8281
cmd.Flags().StringVar(&o.SigningConfigPath, "signing-config", "",
8382
"path to a signing config file")
8483

85-
cmd.MarkFlagsMutuallyExclusive("use-signing-config", "signing-config")
84+
cmd.MarkFlagsMutuallyExclusive("no-signing-config", "signing-config")
8685

8786
cmd.Flags().StringVar(&o.TrustedRootPath, "trusted-root", "",
8887
"optional path to a TrustedRoot JSON file to verify a signature after signing")

‎cmd/cosign/cli/sign.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ race conditions or (worse) malicious tampering.
115115
TSAServerName: o.TSAServerName,
116116
IssueCertificateForExistingKey: o.IssueCertificate,
117117
}
118-
if err := signcommon.LoadSigningConfigAndTrustedMaterial(cmd.Context(), &ko, o.UseSigningConfig, o.SigningConfigPath, o.TrustedRootPath); err != nil {
118+
if err := signcommon.LoadSigningConfigAndTrustedMaterial(cmd.Context(), &ko, o.NoSigningConfig, o.SigningConfigPath, o.TrustedRootPath); err != nil {
119119
return err
120120
}
121121

‎cmd/cosign/cli/signblob.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ func SignBlob() *cobra.Command {
105105
IssueCertificateForExistingKey: o.IssueCertificate,
106106
SigningAlgorithm: o.SigningAlgorithm,
107107
}
108-
if err := signcommon.LoadSigningConfigAndTrustedMaterial(cmd.Context(), &ko, o.UseSigningConfig, o.SigningConfigPath, o.TrustedRootPath); err != nil {
108+
if err := signcommon.LoadSigningConfigAndTrustedMaterial(cmd.Context(), &ko, o.NoSigningConfig, o.SigningConfigPath, o.TrustedRootPath); err != nil {
109109
return err
110110
}
111111

‎cmd/cosign/cli/signcommon/common.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -477,14 +477,17 @@ func ParseSignatureAlgorithmFlag(signingAlgorithm string) (pb_go_v1.PublicKeyDet
477477
}
478478

479479
// LoadSigningConfigAndTrustedMaterial loads the signing config and trusted material from the given options.
480-
func LoadSigningConfigAndTrustedMaterial(ctx context.Context, ko *options.KeyOpts, useSigningConfig bool, signingConfigPath, trustedRootPath string) error {
480+
func LoadSigningConfigAndTrustedMaterial(ctx context.Context, ko *options.KeyOpts, noSigningConfig bool, signingConfigPath, trustedRootPath string) error {
481481
var err error
482-
if signingConfigPath != "" {
482+
switch {
483+
case signingConfigPath != "":
483484
ko.SigningConfig, err = root.NewSigningConfigFromPath(signingConfigPath)
484485
if err != nil {
485486
return fmt.Errorf("error reading signing config from file: %w", err)
486487
}
487-
} else if useSigningConfig {
488+
case noSigningConfig:
489+
ko.SigningConfig = NewEmptySigningConfig()
490+
default:
488491
ko.SigningConfig, err = cosign.SigningConfig()
489492
if err != nil {
490493
return fmt.Errorf("error getting signing config from TUF: %w", err)

‎cmd/cosign/cli/signcommon/common_test.go‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,17 @@ func mustSigningConfigWithFulcio(t *testing.T, fulcioURL string) *root.SigningCo
237237
return sc
238238
}
239239

240+
func assertEmptySigningConfig(t *testing.T, sc *root.SigningConfig) {
241+
t.Helper()
242+
if !assert.NotNil(t, sc) {
243+
return
244+
}
245+
assert.Empty(t, sc.FulcioCertificateAuthorityURLs())
246+
assert.Empty(t, sc.OIDCProviderURLs())
247+
assert.Empty(t, sc.RekorLogURLs())
248+
assert.Empty(t, sc.TimestampAuthorityURLs())
249+
}
250+
240251
func TestConfirmPrivacyStatement(t *testing.T) {
241252
tests := []struct {
242253
name string
@@ -454,7 +465,7 @@ func TestLoadSigningConfigAndTrustedMaterial(t *testing.T) {
454465
assert.Empty(t, entries, "expected TUF directory to remain empty when signing config has no services")
455466
})
456467

457-
t.Run("useSigningConfig false with explicit trusted root loads TrustedMaterial without contacting TUF", func(t *testing.T) {
468+
t.Run("noSigningConfig true with explicit trusted root loads TrustedMaterial without contacting TUF", func(t *testing.T) {
458469
tufDir := t.TempDir()
459470
t.Setenv("TUF_ROOT", tufDir)
460471
t.Setenv("TUF_MIRROR", tufDir)
@@ -464,9 +475,9 @@ func TestLoadSigningConfigAndTrustedMaterial(t *testing.T) {
464475
assert.NoError(t, os.WriteFile(trPath, []byte(trJSON), 0600))
465476

466477
ko := options.KeyOpts{KeyRef: "cosign.key"}
467-
err := LoadSigningConfigAndTrustedMaterial(ctx, &ko, false, "", trPath)
478+
err := LoadSigningConfigAndTrustedMaterial(ctx, &ko, true, "", trPath)
468479
assert.NoError(t, err)
469-
assert.Nil(t, ko.SigningConfig)
480+
assertEmptySigningConfig(t, ko.SigningConfig)
470481
assert.NotNil(t, ko.TrustedMaterial)
471482

472483
entries, err := os.ReadDir(tufDir)
@@ -497,22 +508,22 @@ func TestLoadSigningConfigAndTrustedMaterial(t *testing.T) {
497508
ko := options.KeyOpts{KeyRef: ""}
498509
var err error
499510
stderr := ui.RunWithTestCtx(func(c context.Context, _ ui.WriteFunc) {
500-
err = LoadSigningConfigAndTrustedMaterial(c, &ko, false, "", "")
511+
err = LoadSigningConfigAndTrustedMaterial(c, &ko, true, "", "")
501512
})
502513
assert.NoError(t, err)
503514
assert.Nil(t, ko.TrustedMaterial)
504515
assert.Contains(t, stderr, "Could not fetch trusted_root.json from the TUF repository. Continuing without trusted root.")
505516
})
506517

507-
t.Run("useSigningConfig false with no signing config and key ref leaves both nil and bypasses TUF", func(t *testing.T) {
518+
t.Run("noSigningConfig true with no signing config and key ref sets empty signing config and bypasses TUF", func(t *testing.T) {
508519
tufDir := t.TempDir()
509520
t.Setenv("TUF_ROOT", tufDir)
510521
t.Setenv("TUF_MIRROR", tufDir)
511522

512523
ko := options.KeyOpts{KeyRef: "cosign.key"}
513-
err := LoadSigningConfigAndTrustedMaterial(ctx, &ko, false, "", "")
524+
err := LoadSigningConfigAndTrustedMaterial(ctx, &ko, true, "", "")
514525
assert.NoError(t, err)
515-
assert.Nil(t, ko.SigningConfig)
526+
assertEmptySigningConfig(t, ko.SigningConfig)
516527
assert.Nil(t, ko.TrustedMaterial)
517528

518529
entries, err := os.ReadDir(tufDir)
@@ -544,18 +555,18 @@ func TestLoadSigningConfigAndTrustedMaterial(t *testing.T) {
544555

545556
t.Run("invalid trusted root path returns error", func(t *testing.T) {
546557
ko := options.KeyOpts{KeyRef: "cosign.key"}
547-
err := LoadSigningConfigAndTrustedMaterial(ctx, &ko, false, "", "/nonexistent/trusted_root.json")
558+
err := LoadSigningConfigAndTrustedMaterial(ctx, &ko, true, "", "/nonexistent/trusted_root.json")
548559
assert.Error(t, err)
549560
assert.Contains(t, err.Error(), "loading trusted root")
550561
})
551562

552-
t.Run("useSigningConfig true fails when TUF signing config cannot be retrieved", func(t *testing.T) {
563+
t.Run("noSigningConfig false fails when TUF signing config cannot be retrieved", func(t *testing.T) {
553564
tufDir := t.TempDir()
554565
t.Setenv("TUF_ROOT", tufDir)
555566
t.Setenv("TUF_MIRROR", tufDir)
556567

557568
ko := options.KeyOpts{KeyRef: "cosign.key"}
558-
err := LoadSigningConfigAndTrustedMaterial(ctx, &ko, true, "", "")
569+
err := LoadSigningConfigAndTrustedMaterial(ctx, &ko, false, "", "")
559570
assert.Error(t, err)
560571
assert.Contains(t, err.Error(), "getting signing config from TUF")
561572
})

0 commit comments

Comments
 (0)