| 372 | } |
| 373 | |
| 374 | func verifyEnvelope(ctx context.Context, e *dsse.Envelope, opts *WorkflowRunDescribeOpts) error { |
| 375 | if opts.PublicKeyRef == "" && opts.CertPath == "" { |
| 376 | return fmt.Errorf("no public key or cert path specified") |
| 377 | } |
| 378 | |
| 379 | var verifier signature.Verifier |
| 380 | var err error |
| 381 | if opts.PublicKeyRef != "" { |
| 382 | verifier, err = sigs.PublicKeyFromKeyRef(ctx, opts.PublicKeyRef) |
| 383 | if err != nil { |
| 384 | return fmt.Errorf("invalid public key: %w", err) |
| 385 | } |
| 386 | } |
| 387 | |
| 388 | if opts.CertPath != "" { |
| 389 | // Load cert from PEM |
| 390 | certs, err := loadCertificates(opts.CertPath) |
| 391 | if err != nil { |
| 392 | return fmt.Errorf("loading certificate: %w", err) |
| 393 | } |
| 394 | |
| 395 | var chain []*x509.Certificate |
| 396 | if opts.CertChainPath != "" { |
| 397 | chain, err = loadCertificates(opts.CertChainPath) |
| 398 | if err != nil { |
| 399 | return fmt.Errorf("loading certificate chain: %w", err) |
| 400 | } |
| 401 | } |
| 402 | |
| 403 | verifier, err = cosign.ValidateAndUnpackCertWithChain(certs[0], chain, &cosign.CheckOpts{IgnoreSCT: true}) |
| 404 | if err != nil { |
| 405 | return fmt.Errorf("validating the certificate: %w", err) |
| 406 | } |
| 407 | } |
| 408 | |
| 409 | dsseVerifier, err := dsse.NewEnvelopeVerifier(&sigdsee.VerifierAdapter{SignatureVerifier: verifier}) |
| 410 | if err != nil { |
| 411 | return fmt.Errorf("creating DSSE verifier: %w", err) |
| 412 | } |
| 413 | |
| 414 | _, err = dsseVerifier.Verify(ctx, e) |
| 415 | return err |
| 416 | } |
| 417 | |
| 418 | func loadCertificates(certPath string) ([]*x509.Certificate, error) { |
| 419 | cert, err := blob.LoadFileOrURL(certPath) |