refactor: use nitrite

cmd/main.go

@@ -12,8 +12,8 @@ import (
 	"os"
 	"strings"
 
+	"github.com/blocky/nitrite"
 	"github.com/tinfoilanalytics/verifier/pkg/models"
-	"github.com/tinfoilanalytics/verifier/pkg/nitro"
 	"github.com/tinfoilanalytics/verifier/pkg/sigstore"
 )
 
@@ -108,10 +108,11 @@ func main() {
 			}
 		}
 
-		nitroMeasurements, err = nitro.VerifyAttestation(attDocBytes)
+		att, err := nitrite.Verify(attDocBytes, nitrite.VerifyOptions{})
 		if err != nil {
 			panic(err)
 		}
+		nitroMeasurements = models.MeasurementFromDoc(att.Document)
 		log.Println("Nitro", nitroMeasurements)
 	}
 

go.mod

@@ -3,10 +3,9 @@ module github.com/tinfoilanalytics/verifier
 go 1.23.2
 
 require (
-	github.com/fxamacker/cbor/v2 v2.7.0
+	github.com/blocky/nitrite v0.0.1
 	github.com/sigstore/protobuf-specs v0.3.2
 	github.com/sigstore/sigstore-go v0.6.2
-	github.com/veraison/go-cose v1.2.1
 )
 
 require (
@@ -16,6 +15,7 @@ require (
 	github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
 	github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-chi/chi v4.1.2+incompatible // indirect
 	github.com/go-jose/go-jose/v4 v4.0.2 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect

go.sum

@@ -61,6 +61,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/blocky/nitrite v0.0.1 h1:pw3sZWFu5ADubW5JOUI5WM1JJSZZqyGTwn/nMR12DEM=
+github.com/blocky/nitrite v0.0.1/go.mod h1:Ava0jYckAHUqLIeROgFXzqlWJFdf/SdknIDrgmwOhB4=
 github.com/cenkalti/backoff/v3 v3.2.2 h1:cfUAAO3yvKMYKPrvhDuHSwQnhZNk/RMHKdZqKTxfm6M=
 github.com/cenkalti/backoff/v3 v3.2.2/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
@@ -308,8 +310,6 @@ github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
 github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4=
 github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A=
-github.com/veraison/go-cose v1.2.1 h1:Gj4x20D0YP79J2+cK3anjGEMwIkg2xX+TKVVGUXwNAc=
-github.com/veraison/go-cose v1.2.1/go.mod h1:t6V8WJzHm1PD5HNsuDjW3KLv577uWb6UTzbZGvdQHD8=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=

pkg/models/models.go

@@ -1,6 +1,11 @@
 package models
 
-import "fmt"
+import (
+	"encoding/hex"
+	"fmt"
+
+	"github.com/blocky/nitrite"
+)
 
 type Measurements struct {
 	PCR0 string
@@ -15,3 +20,11 @@ func (m *Measurements) Equals(other *Measurements) bool {
 func (m *Measurements) String() string {
 	return fmt.Sprintf(`{"PCR0":"%s", "PCR1":"%s", "PCR2":"%s"}`, m.PCR0, m.PCR1, m.PCR2)
 }
+
+func MeasurementFromDoc(doc *nitrite.Document) *Measurements {
+	return &Measurements{
+		PCR0: hex.EncodeToString(doc.PCRs[0]),
+		PCR1: hex.EncodeToString(doc.PCRs[1]),
+		PCR2: hex.EncodeToString(doc.PCRs[2]),
+	}
+}