Merge pull request #1166 from sigstore/dsse-conformance

Support DSSE signing conformance test

Author: aaronlew02

.github/workflows/conformance.yml

@@ -14,14 +14,13 @@ jobs:
     strategy:
       matrix:
         java-version: [11, 17, 21]
-        sigstore-env: [production, staging]
       fail-fast: false
 
     concurrency:
       # On main/release, we don't want any jobs cancelled
       # On PR branches, we cancel the job if new commits are pushed
       # More info: https://stackoverflow.com/a/70972844/1261287
-      group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}-${{ matrix.java-version }}-${{ matrix.sigstore-env }}
+      group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}-${{ matrix.java-version }}
       cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
     runs-on: ubuntu-latest
@@ -54,9 +53,25 @@ jobs:
           java-version: ${{ matrix.java-version }}
           distribution: 'temurin'
 
-      - uses: sigstore/sigstore-conformance@eae6eb1f59e25c6d3d602c5dad3dc55767c2f1cb # v0.0.25
+      - name: Run Conformance Tests (production)
+        uses: sigstore/sigstore-conformance@9611941d54398f2e3f6383b6f744442a56d2fb2a # v0.0.26
         with:
           entrypoint: ${{ github.workspace }}/sigstore-cli/sigstore-cli-server
-          environment: ${{ matrix.sigstore-env }}
+          environment: production
           skip-result-upload: ${{ matrix.java-version != 17 }}
-          xfail: "test_verify*-intoto-with-custom-trust-root] test_verify*managed-key-happy-path] test_verify*managed-key-and-trusted-root]"
+          xfail: >-
+            test_verify*-intoto-with-custom-trust-root]
+            test_verify*managed-key-happy-path]
+            test_verify*managed-key-and-trusted-root]
+            test_sign_verify_dsse
+
+      - name: Run Conformance Tests (staging)
+        uses: sigstore/sigstore-conformance@9611941d54398f2e3f6383b6f744442a56d2fb2a # v0.0.26
+        with:
+          entrypoint: ${{ github.workspace }}/sigstore-cli/sigstore-cli-server
+          environment: staging
+          skip-result-upload: ${{ matrix.java-version != 17 }}
+          xfail: >-
+            test_verify*-intoto-with-custom-trust-root]
+            test_verify*managed-key-happy-path]
+            test_verify*managed-key-and-trusted-root]

sigstore-cli/src/main/java/dev/sigstore/cli/Sign.java

@@ -18,6 +18,7 @@
 import dev.sigstore.KeylessSigner;
 import dev.sigstore.SigningConfigProvider;
 import dev.sigstore.TrustedRootProvider;
+import dev.sigstore.bundle.Bundle;
 import dev.sigstore.oidc.client.OidcClients;
 import dev.sigstore.oidc.client.TokenStringOidcClient;
 import dev.sigstore.tuf.RootProvider;
@@ -89,6 +90,12 @@ static class Target {
       required = false)
   Path workingDirectory;
 
+  @Option(
+      names = {"--in-toto"},
+      description = "treat the artifact as an in-toto statement payload",
+      required = false)
+  boolean inToto;
+
   @Override
   public Integer call() throws Exception {
     if (workingDirectory != null) {
@@ -151,7 +158,12 @@ public Integer call() throws Exception {
           OidcClients.of(TokenStringOidcClient.from(identityToken)));
     }
     var signer = signerBuilder.build();
-    var bundle = signer.signFile(artifact);
+    Bundle bundle;
+    if (inToto) {
+      bundle = signer.attest(Files.readString(artifact, StandardCharsets.UTF_8));
+    } else {
+      bundle = signer.signFile(artifact);
+    }
     Files.write(bundleFile, bundle.toJson().getBytes(StandardCharsets.UTF_8));
     return 0;
   }