[aaronlew02]

Depends on #5088

Summary

This change mandates the new bundle format for verify-blob-attestation.

This enables the exclusive use of sigstore-go and requires a trusted root.

Release Note

• Verifiers validating service-provided verification material MUST use a trusted root (either fetched from TUF automatically or explicitly provided via --trusted-root).

  • This applies to ALL keyless verifiers.
  • This applies to key-based verifiers with a certificate, RFC 3161 timestamp, and/or transparency log entry.

• Several flags have been rendered obsolete:

  • Service configuration flags obsoleted by the trusted root:
    • --rekor-url, --timestamp-certificate-chain, --ca-roots, --ca-intermediates, --certificate-chain, --certificate, --offline
  • Flags obsoleted by the new bundle format:
    • --new-bundle-format
    • Input overrides: --signature, --signature-digest-algorithm
    • Detached inputs: --sct, --rfc3161-timestamp

• Service configuration environment variables are no longer used in production (but remain used in testing):

  • SIGSTORE_ROOT_FILE, SIGSTORE_REKOR_PUBLIC_KEY, SIGSTORE_CT_LOG_PUBLIC_KEY_FILE, SIGSTORE_TSA_CERTIFICATE_FILE

[codecov]

Codecov Report

❌ Patch coverage is 63.88889% with 26 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.08%. Comparing base (2ef6022) to head (a2c5a73).
⚠️ Report is 907 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/cosign/cli/attest_blob.go	45.00%	11 Missing ⚠️
cmd/cosign/cli/verify/verify_blob_attestation.go	84.84%	5 Missing ⚠️
cmd/cosign/cli/verify.go	55.55%	4 Missing ⚠️
cmd/cosign/cli/options/attest_blob.go	0.00%	3 Missing ⚠️
cmd/cosign/cli/attest/attest_blob.go	66.66%	2 Missing ⚠️
cmd/cosign/cli/options/verify.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5089      +/-   ##
==========================================
+ Coverage   40.10%   47.08%   +6.98%     
==========================================
  Files         155      209      +54     
  Lines       10044    11498    +1454     
==========================================
+ Hits         4028     5414    +1386     
- Misses       5530     6084     +554     
+ Partials      486        0     -486     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[aaronlew02]

Testing

The following commands can be used to test the changes in this PR.

Setup

Before running the tests, ensure that you have generated a local test keypair (which is used for key-based tests):

# Generate a keypair (writes to cosign.key and cosign.pub)
cosign generate-key-pair

1. TUF-provided Trusted Root

Verify that the TUF-provided trusted root is resolved correctly for keyless verification and for key-based verification of bundles with a log entry and timestamp:

Keyless Operations

Blob attestation & verification

# Attest a blob to generate a bundle
cosign attest-blob --predicate [PREDICATE_FILE] --bundle attest.bundle [BLOB_FILE]

# Verify the blob attestation using the bundle and TUF trusted root
cosign verify-blob-attestation --bundle attest.bundle --certificate-identity [IDENTITY] --certificate-oidc-issuer [ISSUER] [BLOB_FILE]

Key-based / Certificate-backed Operations

Key-based, certificate-backed attestation & verification

# Attest a blob using local key and request Fulcio certificate using TUF signing config
cosign attest-blob --key cosign.key --issue-certificate --predicate [PREDICATE_FILE] --bundle attest.bundle [BLOB_FILE]

# Verify using TUF trusted root and identity checks
cosign verify-blob-attestation --bundle attest.bundle --certificate-identity [IDENTITY] --certificate-oidc-issuer [ISSUER] [BLOB_FILE]

Key-based attestation with transparency log and RFC 3161 timestamp

# Attest a blob using key and request log entry/timestamp
cosign attest-blob --key cosign.key --predicate [PREDICATE_FILE] --bundle attest.bundle [BLOB_FILE]

# Verify the attestation bundle (verifying the signature and log proof against TUF trusted root)
cosign verify-blob-attestation --key cosign.pub --bundle attest.bundle [BLOB_FILE]

# Verify the attestation bundle, additionally verifying the RFC 3161 timestamp
cosign verify-blob-attestation --key cosign.pub --use-signed-timestamps --bundle attest.bundle [BLOB_FILE]

---

2. Explicit Local Trusted Root

Verify that an explicitly provided local trusted root file is loaded and utilized correctly:

Keyless Operations

Blob attestation & verification

# Attest a blob using local signing config and trusted root files
cosign attest-blob --signing-config [PATH_TO_SIGNING_CONFIG] --trusted-root [PATH_TO_TRUSTED_ROOT] --predicate [PREDICATE_FILE] --bundle attest.bundle [BLOB_FILE]

# Verify the blob attestation using an explicit trusted root file
cosign verify-blob-attestation --trusted-root [PATH_TO_TRUSTED_ROOT] --bundle attest.bundle --certificate-identity [IDENTITY] --certificate-oidc-issuer [ISSUER] [BLOB_FILE]

Key-based Operations

Key-based, certificate-backed attestation & verification

# Attest a blob using local key and request Fulcio certificate using local signing config
cosign attest-blob --key cosign.key --issue-certificate --signing-config [PATH_TO_SIGNING_CONFIG] --trusted-root [PATH_TO_TRUSTED_ROOT] --predicate [PREDICATE_FILE] --bundle attest.bundle [BLOB_FILE]

# Verify using local trusted root file and identity checks
cosign verify-blob-attestation --trusted-root [PATH_TO_TRUSTED_ROOT] --bundle attest.bundle --certificate-identity [IDENTITY] --certificate-oidc-issuer [ISSUER] [BLOB_FILE]

Key-based attestation with transparency log and RFC 3161 timestamp

# Attest a blob using key and request log entry/timestamp via local signing config
cosign attest-blob --key cosign.key --signing-config [PATH_TO_SIGNING_CONFIG] --trusted-root [PATH_TO_TRUSTED_ROOT] --predicate [PREDICATE_FILE] --bundle attest.bundle [BLOB_FILE]

# Verify the attestation bundle against local trusted root file
cosign verify-blob-attestation --key cosign.pub --trusted-root [PATH_TO_TRUSTED_ROOT] --bundle attest.bundle [BLOB_FILE]

# Verify the attestation bundle against local trusted root file, additionally verifying the RFC 3161 timestamp
cosign verify-blob-attestation --key cosign.pub --trusted-root [PATH_TO_TRUSTED_ROOT] --use-signed-timestamps --bundle attest.bundle [BLOB_FILE]

Service Omission Tests (Config-driven behavior)

Verify that bundles produced without specific services are handled correctly during verification:

Omitting Rekor (No log entry in the bundle)

# 1. Generate a signing config file without Rekor configured
cosign signing-config create --with-default-services --no-default-rekor --out signing-config-no-rekor.json

# 2. Attest a blob (generated bundle will not contain a log entry)
cosign attest-blob --signing-config signing-config-no-rekor.json --predicate [PREDICATE_FILE] --bundle attest-no-rekor.bundle [BLOB_FILE]

# 3. Verify the bundle (should FAIL by default due to missing log entry/SET proof)
cosign verify-blob-attestation --trusted-root [PATH_TO_TRUSTED_ROOT] --bundle attest-no-rekor.bundle --certificate-identity [IDENTITY] --certificate-oidc-issuer [ISSUER] [BLOB_FILE]

# 4. Verify the bundle with tlog bypassed (should SUCCEED; the certificate is checked against the current time, so run this within its validity window or add --use-signed-timestamps)
cosign verify-blob-attestation --trusted-root [PATH_TO_TRUSTED_ROOT] --bundle attest-no-rekor.bundle --insecure-ignore-tlog --certificate-identity [IDENTITY] --certificate-oidc-issuer [ISSUER] [BLOB_FILE]

Omitting TSA (No RFC 3161 timestamp in the bundle)

# 1. Generate a signing config file without TSA configured
cosign signing-config create --with-default-services --no-default-tsa --out signing-config-no-tsa.json

# 2. Attest a blob (generated bundle will not contain a timestamp)
cosign attest-blob --signing-config signing-config-no-tsa.json --predicate [PREDICATE_FILE] --bundle attest-no-tsa.bundle [BLOB_FILE]

# 3. Verify the bundle (should SUCCEED; falls back to using the tlog integrated time to verify certificate expiry)
cosign verify-blob-attestation --trusted-root [PATH_TO_TRUSTED_ROOT] --bundle attest-no-tsa.bundle --certificate-identity [IDENTITY] --certificate-oidc-issuer [ISSUER] [BLOB_FILE]

# 4. Verify the bundle requiring a signed timestamp (should FAIL due to missing timestamp)
cosign verify-blob-attestation --trusted-root [PATH_TO_TRUSTED_ROOT] --bundle attest-no-tsa.bundle --use-signed-timestamps --certificate-identity [IDENTITY] --certificate-oidc-issuer [ISSUER] [BLOB_FILE]

---

3. Simple Key-based Attestation & Verification (No services)

Verify that simple key-based operations (which do not interact with Fulcio, Rekor, or a timestamp authority) work cleanly:

# Attest a blob using a private key and no signing config (generates a simple bundle without log/timestamp verification material)
cosign attest-blob --key cosign.key --use-signing-config=false --predicate [PREDICATE_FILE] --bundle attest.bundle [BLOB_FILE]

# Verify the blob attestation using the public key and bundle (should SUCCEED; no trusted root is needed)
cosign verify-blob-attestation --key cosign.pub --insecure-ignore-tlog --bundle attest.bundle [BLOB_FILE]

# Verify without bypassing the tlog (should FAIL because the bundle contains no log entry)
cosign verify-blob-attestation --key cosign.pub --bundle attest.bundle [BLOB_FILE]

---

4. CLI Flag Validations (Negative Testing)

Verify that the CLI rejects removed flags and enforces mandatory new arguments:

# 1. Rejects removed flags (should fail with unknown flag errors)
cosign verify-blob-attestation --signature [SIG_PATH] [BLOB_FILE]
cosign verify-blob-attestation --rekor-url [URL] --bundle attest.bundle [BLOB_FILE]
cosign verify-blob-attestation --rfc3161-timestamp [TS_PATH] --bundle attest.bundle [BLOB_FILE]
cosign verify-blob-attestation --signature-digest-algorithm sha512 --bundle attest.bundle [BLOB_FILE]

# 2. Enforces bundle for blob attestation verification (should fail with "please specify --bundle")
cosign verify-blob-attestation --key cosign.pub [BLOB_FILE]
cosign verify-blob-attestation --certificate-identity [IDENTITY] --certificate-oidc-issuer [ISSUER] [BLOB_FILE]