Class: Sigstore::TrustedRoot

Inherits:
Sigstore::TrustRoot::V1::TrustedRoot
  • Object
show all
Defined in:
lib/sigstore/trusted_root.rb

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.from_file(path) ⇒ Object 



43
44
45
46
 
# File 'lib/sigstore/trusted_root.rb', line 43

def self.from_file(path)
  contents = Gem.read_binary(path)
  new Sigstore::TrustRoot::V1::TrustedRoot.decode_json(contents, registry: REGISTRY)
end

.from_tuf(url, offline) ⇒ Object 



38
39
40
41
 
# File 'lib/sigstore/trusted_root.rb', line 38

def self.from_tuf(url, offline)
  path = TUF::TrustUpdater.new(url, offline).tap { _1.refresh unless offline }.trusted_root_path
  from_file(path)
end

.production(offline: false) ⇒ Object 



30
31
32
 
# File 'lib/sigstore/trusted_root.rb', line 30

def self.production(offline: false)
  from_tuf(TUF::DEFAULT_TUF_URL, offline)
end

.staging(offline: false) ⇒ Object 



34
35
36
 
# File 'lib/sigstore/trusted_root.rb', line 34

def self.staging(offline: false)
  from_tuf(TUF::STAGING_TUF_URL, offline)
end

Instance Method Details

#certificate_authority_for_signing ⇒ Object 



77
78
79
80
81
 
# File 'lib/sigstore/trusted_root.rb', line 77

def certificate_authority_for_signing
  certificate_authorities.find do |ca|
    timerange_valid?(ca.valid_for, allow_expired: false)
  end
end

#ctfe_keys ⇒ Object

Raises:



55
56
57
58
59
60
 
# File 'lib/sigstore/trusted_root.rb', line 55

def ctfe_keys
  keys = tlog_keys(ctlogs).to_a
  raise Error::InvalidBundle, "Did not find any CTFE keys" if keys.empty?

  keys
end

#fulcio_cert_chain ⇒ Object

Raises:



62
63
64
65
66
67
68
69
 
# File 'lib/sigstore/trusted_root.rb', line 62

def fulcio_cert_chain
  certs = ca_keys(certificate_authorities, allow_expired: true).flat_map do |raw_bytes|
    Internal::X509::Certificate.read(raw_bytes)
  end
  raise Error::InvalidBundle, "Fulcio certificates not found in trusted root" if certs.empty?

  certs
end

#rekor_keys ⇒ Object

Raises:



48
49
50
51
52
53
 
# File 'lib/sigstore/trusted_root.rb', line 48

def rekor_keys
  keys = tlog_keys(tlogs).to_a
  raise Error::InvalidBundle, "Did not find one Rekor key" if keys.size != 1

  keys
end

#tlog_for_signing ⇒ Object 



71
72
73
74
75
 
# File 'lib/sigstore/trusted_root.rb', line 71

def tlog_for_signing
  tlogs.find do |ctlog|
    timerange_valid?(ctlog.public_key.valid_for, allow_expired: false)
  end
end