From 03ce6e0b06a12762a7f9605881f168576923baa2 Mon Sep 17 00:00:00 2001 From: Alexis Date: Wed, 13 Nov 2024 11:09:23 +0100 Subject: [PATCH 1/3] Add `signature` on `Envelope` Signed-off-by: Alexis --- sigstore/dsse/__init__.py | 24 ++++++++++++++++++++ test/unit/test_dsse.py | 47 +++++++++++++++++++++++++++++++++++++-- 2 files changed, 69 insertions(+), 2 deletions(-) diff --git a/sigstore/dsse/__init__.py b/sigstore/dsse/__init__.py index d1a0b949..0cc1136e 100644 --- a/sigstore/dsse/__init__.py +++ b/sigstore/dsse/__init__.py @@ -190,6 +190,12 @@ def build(self) -> Statement: return Statement(stmt) +class InvalidEnvelope(Error): + """ + Raised when the associated `Envelope` is invalid in some way. + """ + + class Envelope: """ Represents a DSSE envelope. @@ -207,6 +213,19 @@ def __init__(self, inner: _Envelope) -> None: """ self._inner = inner + self._verify() + + def _verify(self) -> None: + """ + Verify and load the Envelope. + """ + if len(self._inner.signatures) != 1: + raise InvalidEnvelope("envelope must contain exactly one signature") + + if not self._inner.signatures[0].sig: + raise InvalidEnvelope("envelope signature must be non-empty") + + self._signature_bytes = self._inner.signatures[0].sig @classmethod def _from_json(cls, contents: bytes | str) -> Envelope: @@ -228,6 +247,11 @@ def __eq__(self, other: object) -> bool: return self._inner == other._inner + @property + def signature(self) -> bytes: + """Return the decoded bytes of the Envelope signature.""" + return self._signature_bytes + def _pae(type_: str, body: bytes) -> bytes: """ diff --git a/test/unit/test_dsse.py b/test/unit/test_dsse.py index c41fa2c8..ebb77b16 100644 --- a/test/unit/test_dsse.py +++ b/test/unit/test_dsse.py @@ -15,7 +15,10 @@ import base64 import json +import pytest + from sigstore import dsse +from sigstore.dsse import InvalidEnvelope class TestEnvelope: @@ -26,7 +29,6 @@ def test_roundtrip(self): "payloadType": dsse.Envelope._TYPE, "signatures": [ {"sig": base64.b64encode(b"lol").decode()}, - {"sig": base64.b64encode(b"lmao").decode()}, ], } ) @@ -34,8 +36,49 @@ def test_roundtrip(self): assert evp._inner.payload == b"foo" assert evp._inner.payload_type == dsse.Envelope._TYPE - assert [b"lol", b"lmao"] == [s.sig for s in evp._inner.signatures] + assert evp.signature == b"lol" serialized = evp.to_json() assert serialized == raw assert dsse.Envelope._from_json(serialized) == evp + + def test_missing_signature(self): + raw = json.dumps( + { + "payload": base64.b64encode(b"foo").decode(), + "payloadType": dsse.Envelope._TYPE, + "signatures": [], + } + ) + + with pytest.raises(InvalidEnvelope, match="one signature"): + dsse.Envelope._from_json(raw) + + def test_empty_signature(self): + raw = json.dumps( + { + "payload": base64.b64encode(b"foo").decode(), + "payloadType": dsse.Envelope._TYPE, + "signatures": [ + {"sig": ""}, + ], + } + ) + + with pytest.raises(InvalidEnvelope, match="non-empty"): + dsse.Envelope._from_json(raw) + + def test_multiple_signatures(self): + raw = json.dumps( + { + "payload": base64.b64encode(b"foo").decode(), + "payloadType": dsse.Envelope._TYPE, + "signatures": [ + {"sig": base64.b64encode(b"lol").decode()}, + {"sig": base64.b64encode(b"lmao").decode()}, + ], + } + ) + + with pytest.raises(InvalidEnvelope, match="one signature"): + dsse.Envelope._from_json(raw) \ No newline at end of file From a090bc749c35935b2b6a56c67d8141c147d9653c Mon Sep 17 00:00:00 2001 From: Alexis Date: Wed, 13 Nov 2024 11:14:29 +0100 Subject: [PATCH 2/3] Fix linter. Signed-off-by: Alexis --- test/unit/test_dsse.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/unit/test_dsse.py b/test/unit/test_dsse.py index ebb77b16..0a2ee879 100644 --- a/test/unit/test_dsse.py +++ b/test/unit/test_dsse.py @@ -81,4 +81,4 @@ def test_multiple_signatures(self): ) with pytest.raises(InvalidEnvelope, match="one signature"): - dsse.Envelope._from_json(raw) \ No newline at end of file + dsse.Envelope._from_json(raw) From a6b3e6db9e6bcf073b79056c7841f7ac50a38f17 Mon Sep 17 00:00:00 2001 From: Alexis Date: Wed, 13 Nov 2024 17:55:25 +0100 Subject: [PATCH 3/3] Add CHANGELOG entries Signed-off-by: Alexis --- CHANGELOG.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index bfd8058c..b417d6b9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,14 @@ All versions prior to 0.9.0 are untracked. ## [Unreleased] +### Added + +* API: The DSSE `Envelope` class now performs automatic validation + ([#1211](https://github.com/sigstore/sigstore-python/pull/1211)) + +* API: Added `signature` property to `Envelope` class for accessing raw + signature bytes ([#1211](https://github.com/sigstore/sigstore-python/pull/1211)) + ### Fixed * Fixed a CLI parsing bug introduced in 3.5.1 where a warning about