[no ci] wip

edgelesssys · Sep 20, 2023 · 9e56163 · 9e56163
1 parent 548bb2d
commit 9e56163
Showing 1 changed file with 74 additions and 0 deletions.
diff --git a/internal/versions/hash-generator/generate.go b/internal/versions/hash-generator/generate.go
@@ -19,10 +19,15 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"regexp"
+	"strconv"
 
+	"github.com/edgelesssys/constellation/v2/internal/sigstore"
 	"golang.org/x/tools/go/ast/astutil"
 )
 
+var kuberntesMinorRegex = regexp.MustCompile(`^.*\.(?P<Minor>\d+)\..*(kubelet|kubeadm|kubectl)+$`)
+
 func mustGetHash(url string) string {
 	// remove quotes around url
 	url = url[1 : len(url)-1]
@@ -78,9 +83,78 @@ func mustGetHash(url string) string {
 		panic("hash mismatch")
 	}
 
+	// Verify cosign signature if available
+	// Currently, we verify the signature of kubeadm, kubelet and kubectl with minor version >=1.26.
+	minorVersion := kuberntesMinorRegex.FindStringSubmatch(url)
+	if minorVersion == nil {
+		return fmt.Sprintf("\"sha256:%x\"", fileHash)
+	}
+	minorVersionIndex := kuberntesMinorRegex.SubexpIndex("Minor")
+	if minorVersionIndex != -1 {
+		minorVersionNumber, err := strconv.Atoi(minorVersion[minorVersionIndex])
+		if err != nil {
+			panic(err)
+		}
+		if minorVersionNumber >= 26 {
+			content, err := io.ReadAll(resp.Body)
+			if err != nil {
+				panic(err)
+			}
+			if err := verifyCosignSignature(content, url); err != nil {
+				panic(err)
+			}
+		}
+	}
+
 	return fmt.Sprintf("\"sha256:%x\"", fileHash)
 }
 
+func verifyCosignSignature(content []byte, url string) error {
+	// Get the signature
+	req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, url+".sig", nil)
+	if err != nil {
+		panic(err)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		panic(err)
+	}
+	defer resp.Body.Close()
+
+	// Check server response
+	if resp.StatusCode != http.StatusOK {
+		panic("bad status: " + resp.Status)
+	}
+
+	sig, err := io.ReadAll(resp.Body)
+	if err != nil {
+		panic(err)
+	}
+
+	// Get the certificate
+	req, err = http.NewRequestWithContext(context.Background(), http.MethodGet, url+".cert", nil)
+	if err != nil {
+		panic(err)
+	}
+	resp, err = http.DefaultClient.Do(req)
+	if err != nil {
+		panic(err)
+	}
+	defer resp.Body.Close()
+
+	// Check server response
+	if resp.StatusCode != http.StatusOK {
+		panic("bad status: " + resp.Status)
+	}
+
+	cert, err := io.ReadAll(resp.Body)
+	if err != nil {
+		panic(err)
+	}
+
+	return sigstore.VerifySignature(content, sig, cert)
+}
+
 func main() {
 	fmt.Println("Generating hashes...")