Verify blob attestations exclusively via sigstore-go

Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>

Author: aaronlew02

cmd/cosign/cli/options/verify.go

@@ -242,59 +242,41 @@ func (o *VerifyDockerfileOptions) AddFlags(cmd *cobra.Command) {
 
 // VerifyBlobAttestationOptions is the top level wrapper for the `verify-blob-attestation` command.
 type VerifyBlobAttestationOptions struct {
-	Key           string
-	SignaturePath string
-	BundlePath    string
+	Key        string
+	BundlePath string
 
 	PredicateOptions
 	CheckClaims bool
 
 	SecurityKey         SecurityKeyOptions
 	CertVerify          CertVerifyOptions
-	Rekor               RekorOptions
 	CommonVerifyOptions CommonVerifyOptions
-	SignatureDigest     SignatureDigestOptions
-
-	RFC3161TimestampPath string
 
 	Digest    string
 	DigestAlg string
 }
 
-var _ Interface = (*VerifyBlobOptions)(nil)
+var _ Interface = (*VerifyBlobAttestationOptions)(nil)
 
 // AddFlags implements Interface
 func (o *VerifyBlobAttestationOptions) AddFlags(cmd *cobra.Command) {
 	o.PredicateOptions.AddFlags(cmd)
 	o.SecurityKey.AddFlags(cmd)
-	o.Rekor.AddFlags(cmd)
 	o.CertVerify.AddFlags(cmd)
 	o.CommonVerifyOptions.AddFlags(cmd)
-	o.SignatureDigest.AddFlags(cmd)
-
-	_ = cmd.Flags().MarkDeprecated("rekor-url", "please use --bundle, which includes the Rekor inclusion proof")
 
 	cmd.Flags().StringVar(&o.Key, "key", "",
 		"path to the public key file, KMS URI or Kubernetes Secret")
 	_ = cmd.MarkFlagFilename("key", publicKeyExts...)
 
-	cmd.Flags().StringVar(&o.SignaturePath, "signature", "",
-		"path to base64-encoded signature over attestation in DSSE format")
-	_ = cmd.MarkFlagFilename("signature", signatureExts...)
-	_ = cmd.Flags().MarkDeprecated("signature", "please use --bundle to provide a signature")
-
 	cmd.Flags().StringVar(&o.BundlePath, "bundle", "",
 		"path to bundle FILE")
 	_ = cmd.MarkFlagFilename("bundle", bundleExts...)
+	_ = cmd.MarkFlagRequired("bundle")
 
 	cmd.Flags().BoolVar(&o.CheckClaims, "check-claims", true,
 		"if true, verifies the digest exists in the in-toto subject (using either the provided digest and digest algorithm or the provided blob's sha256 digest). If false, only the DSSE envelope is verified.")
 
-	cmd.Flags().StringVar(&o.RFC3161TimestampPath, "rfc3161-timestamp", "",
-		"path to RFC3161 timestamp FILE")
-	// _ = cmd.MarkFlagFilename("rfc3161-timestamp") // no typical extensions
-	_ = cmd.Flags().MarkDeprecated("rfc3161-timestamp", "please use --bundle to provide the output bundle location, which will include the signed timestamp")
-
 	cmd.Flags().StringVar(&o.Digest, "digest", "",
 		"Digest to use for verifying in-toto subject (instead of providing a blob)")
 	_ = cmd.RegisterFlagCompletionFunc("digest", cobra.NoFileCompletions)

cmd/cosign/cli/verify.go

@@ -356,10 +356,12 @@ func VerifyBlobAttestation() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "verify-blob-attestation",
 		Short: "Verify an attestation on the supplied blob",
-		Long: `Verify an attestation on the supplied blob input using the specified key reference.
-You may specify either a key or a kms reference to verify against.
+		Long: `Verify an attestation on the supplied blob input using a Sigstore bundle, provided via --bundle (required).
+Verify against a public key or KMS reference (--key), a security key (--sk), or, for keyless
+signatures, a certificate identity and OIDC issuer (--certificate-identity and --certificate-oidc-issuer).
 
-Signed material is provided with the --bundle flag.
+A trusted root verifies service-provided material in the bundle (certificates, transparency log
+entries, and RFC 3161 timestamps). Cosign fetches it from TUF, unless you provide one via --trusted-root.
 The blob may be specified as a path to a file.`,
 		Example: ` cosign verify-blob-attestation --bundle <path> --certificate-identity <identity> --certificate-oidc-issuer <issuer> <blob>
 
@@ -390,45 +392,29 @@ The blob may be specified as a path to a file.`,
 				o.CommonVerifyOptions.IgnoreTlog = true
 			}
 
-			hashAlgorithm, err := o.SignatureDigest.HashAlgorithm()
-			if err != nil {
-				return err
-			}
-
 			ko := options.KeyOpts{
-				KeyRef:               o.Key,
-				Sk:                   o.SecurityKey.Use,
-				Slot:                 o.SecurityKey.Slot,
-				RekorURL:             o.Rekor.URL,
-				BundlePath:           o.BundlePath,
-				RFC3161TimestampPath: o.RFC3161TimestampPath,
-				TSACertChainPath:     o.CommonVerifyOptions.TSACertChainPath,
-				NewBundleFormat:      o.CommonVerifyOptions.NewBundleFormat,
+				KeyRef:     o.Key,
+				Sk:         o.SecurityKey.Use,
+				Slot:       o.SecurityKey.Slot,
+				BundlePath: o.BundlePath,
 			}
 			v := verify.VerifyBlobAttestationCommand{
 				KeyOpts:                      ko,
 				PredicateType:                o.Type,
 				CheckClaims:                  o.CheckClaims,
-				SignaturePath:                o.SignaturePath,
 				CertVerifyOptions:            o.CertVerify,
-				CertRef:                      o.CertVerify.Cert,
-				CertChain:                    o.CertVerify.CertChain,
-				CARoots:                      o.CertVerify.CARoots,
-				CAIntermediates:              o.CertVerify.CAIntermediates,
 				CertGithubWorkflowTrigger:    o.CertVerify.CertGithubWorkflowTrigger,
 				CertGithubWorkflowSHA:        o.CertVerify.CertGithubWorkflowSha,
 				CertGithubWorkflowName:       o.CertVerify.CertGithubWorkflowName,
 				CertGithubWorkflowRepository: o.CertVerify.CertGithubWorkflowRepository,
 				CertGithubWorkflowRef:        o.CertVerify.CertGithubWorkflowRef,
 				IgnoreSCT:                    o.CertVerify.IgnoreSCT,
-				SCTRef:                       o.CertVerify.SCT,
 				Offline:                      o.CommonVerifyOptions.Offline,
 				IgnoreTlog:                   o.CommonVerifyOptions.IgnoreTlog,
 				UseSignedTimestamps:          o.CommonVerifyOptions.UseSignedTimestamps,
 				TrustedRootPath:              o.CommonVerifyOptions.TrustedRootPath,
 				Digest:                       o.Digest,
 				DigestAlg:                    o.DigestAlg,
-				HashAlgorithm:                hashAlgorithm,
 				AllowCertificateChain:        o.CommonVerifyOptions.AllowCertificateChain,
 			}
 			// We only use the blob if we are checking claims.

cmd/cosign/cli/verify/common.go

@@ -69,11 +69,6 @@ func CheckSigstoreBundleUnsupportedOptions(cmd any, verifyOfflineWithKey bool, c
 	return nil
 }
 
-func isb64(data []byte) bool {
-	_, err := base64.StdEncoding.DecodeString(string(data))
-	return err == nil
-}
-
 // LoadVerifierFromKey returns a signature.Verifier from the provided key flags to use for verifying an artifact.
 // In the case of certain types of keys, it returns a close function that must be called by the calling method.
 func LoadVerifierFromKey(ctx context.Context, keyRef, slot string, sk bool) (signature.Verifier, func(), error) {