Close #1251: Allow no transparency-log entries

* Add support for verifying bundles without transparency-log entries, relying on signed RFC 3161 timestamps.

Author: anthonydahanne

sigstore-cli/src/main/java/dev/sigstore/cli/Verify.java

@@ -113,6 +113,16 @@ static class Policy {
       required = false)
   Path workingDirectory;
 
+  @Option(
+      names = {"--allow-non-transparency-log"},
+      description =
+          "verify a bundle that has no transparency-log entry, relying on a signed RFC 3161 "
+              + "timestamp instead (reduced assurance; for instances that do not publish to a "
+              + "transparency log, e.g. GitHub's Sigstore instance for private repositories)",
+      required = false,
+      defaultValue = "false")
+  Boolean allowNonTransparencyLog;
+
   @Override
   public Integer call() throws Exception {
     byte[] digest;
@@ -142,6 +152,9 @@ public Integer call() throws Exception {
               .subjectAlternativeName(StringMatcher.string(policy.certificateSan))
               .build());
     }
+    if (allowNonTransparencyLog) {
+      verificationOptionsBuilder.allowNonTransparencyLogVerification(true);
+    }
     var verificationOptions = verificationOptionsBuilder.build();
 
     KeylessVerifier verifier;

sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java

@@ -132,6 +132,18 @@ public Builder trustedRootProvider(TrustedRootProvider trustedRootProvider) {
   private AlgorithmRegistry.HashAlgorithm findHashAlgorithm(Bundle bundle)
       throws KeylessVerificationException {
     try {
+      // When the bundle has no transparency-log entry (e.g. a signed-timestamp-only bundle),
+      // derive the hash algorithm without one: DSSE bundles use SHA-256 (as in the dsse:0.0.1
+      // case below), otherwise fall back to the signing certificate's algorithm. Whether such a
+      // bundle is permitted at all is enforced in verify(...) via
+      // VerificationOptions#allowNonTransparencyLogVerification.
+      if (bundle.getEntries().isEmpty()) {
+        if (bundle.getDsseEnvelope().isPresent()) {
+          return AlgorithmRegistry.HashAlgorithm.SHA2_256;
+        }
+        var publicKey = Certificates.getLeaf(bundle.getCertPath()).getPublicKey();
+        return AlgorithmRegistry.getSigningAlgorithm(publicKey).getHashAlgorithm();
+      }
       var rekorEntry = bundle.getEntries().get(0);
       var body = rekorEntry.getBodyDecoded();
       if ("0.0.1".equals(body.getApiVersion())) {
@@ -199,7 +211,8 @@ public void verify(byte[] artifactDigest, Bundle bundle, VerificationOptions opt
 
     // a trusted CT log
     try {
-      fulcioVerifier.verifySigningCertificate(signingCert);
+      fulcioVerifier.verifySigningCertificate(
+          signingCert, options.allowNonTransparencyLogVerification());
     } catch (FulcioVerificationException | IOException ex) {
       throw new KeylessVerificationException(
           "Fulcio certificate was not valid: " + ex.getMessage(), ex);
@@ -209,7 +222,20 @@ public void verify(byte[] artifactDigest, Bundle bundle, VerificationOptions opt
     checkCertificateMatchers(leafCert, options.getCertificateMatchers());
 
     var hashAlgorithm = findHashAlgorithm(bundle);
-    var rekorEntry = bundle.getEntries().get(0);
+
+    // A transparency-log entry is required by default. Bundles from instances that do not publish
+    // to a log (e.g. GitHub's Sigstore instance for private repositories) carry only a signed
+    // timestamp; verifying those requires opting in and relies on the RFC 3161 timestamp (verified
+    // below) for trusted time.
+    var entries = bundle.getEntries();
+    if (entries.isEmpty() && !options.allowNonTransparencyLogVerification()) {
+      throw new KeylessVerificationException(
+          "Bundle does not contain a transparency log entry. If it is from an instance that does "
+              + "not publish to a transparency log, set "
+              + "VerificationOptions.allowNonTransparencyLogVerification(true) to verify using its "
+              + "signed timestamp instead.");
+    }
+    var rekorEntry = entries.isEmpty() ? null : entries.get(0);
 
     byte[] signature;
     if (bundle.getMessageSignature().isPresent()) { // hashedrekord
@@ -222,16 +248,20 @@ public void verify(byte[] artifactDigest, Bundle bundle, VerificationOptions opt
       signature = dsseEnvelope.getSignature();
     }
 
-    try {
-      rekorVerifier.verifyEntry(rekorEntry);
-    } catch (RekorVerificationException ex) {
-      throw new KeylessVerificationException("Transparency log entry could not be verified", ex);
+    // A transparency-log entry that is present is always verified; opting in only relaxes the
+    // requirement that one exists, never the verification of one that is provided.
+    Instant entryTime = null;
+    if (rekorEntry != null) {
+      try {
+        rekorVerifier.verifyEntry(rekorEntry);
+      } catch (RekorVerificationException ex) {
+        throw new KeylessVerificationException("Transparency log entry could not be verified", ex);
+      }
+      // if entry was verified and has a SET, get time from it
+      var set = rekorEntry.getVerification().getSignedEntryTimestamp();
+      entryTime = set != null ? rekorEntry.getIntegratedTimeInstant() : null;
     }
 
-    // if entry was verified and has a SET, get time from it
-    var set = rekorEntry.getVerification().getSignedEntryTimestamp();
-    var entryTime = set != null ? rekorEntry.getIntegratedTimeInstant() : null;
-
     verifyTimestamps(leafCert, bundle.getTimestamps(), entryTime, signature);
   }
 
@@ -325,6 +355,12 @@ private void checkMessageSignature(
           "Signature could not be processed: " + ex.getMessage(), ex);
     }
 
+    // No transparency-log entry (allowed via VerificationOptions): the artifact digest and
+    // signature have been verified above, and there is nothing to cross-check against.
+    if (rekorEntry == null) {
+      return;
+    }
+
     // recreate the log entry and check if it matches what was provided in the entry
     String version;
     try {
@@ -469,6 +505,12 @@ private void checkDsseEnvelope(
       throw new KeylessVerificationException("Signature could not be processed", se);
     }
 
+    // No transparency-log entry (allowed via VerificationOptions): the payload subject digest and
+    // DSSE signature have been verified above, and there is nothing to cross-check against.
+    if (rekorEntry == null) {
+      return;
+    }
+
     RekorEntryBody entryBody;
     try {
       entryBody = rekorEntry.getBodyDecoded();

sigstore-java/src/main/java/dev/sigstore/VerificationOptions.java

@@ -20,6 +20,7 @@
 import java.security.cert.X509Certificate;
 import java.util.List;
 import java.util.function.Predicate;
+import org.immutables.value.Value.Default;
 import org.immutables.value.Value.Immutable;
 
 @Immutable(singleton = true)
@@ -28,6 +29,24 @@ public interface VerificationOptions {
   /** An allow list of certificate identities to match with. */
   List<CertificateMatcher> getCertificateMatchers();
 
+  /**
+   * Whether to allow verifying a bundle that contains no transparency-log entry, relying solely on
+   * a signed RFC 3161 timestamp for trusted time. Defaults to {@code false}, matching the Sigstore
+   * public-good instance where a transparency-log entry is always present and required.
+   *
+   * <p>Enabling this weakens the guarantees: without a transparency-log entry the signature is not
+   * publicly monitorable/auditable. Only enable it for bundles from instances that intentionally do
+   * not publish to a transparency log (for example, GitHub's Sigstore instance for private
+   * repositories), and pair it with a pinned trusted root. A signed timestamp is still required.
+   *
+   * <p>This only relaxes the <em>requirement</em> that a transparency-log entry exists; a
+   * transparency-log entry that <em>is</em> present in the bundle is still fully verified.
+   */
+  @Default
+  default boolean allowNonTransparencyLogVerification() {
+    return false;
+  }
+
   /**
    * An interface for allowing matching of certificates. Use {@link #fulcio()} to instantiate the
    * default {@link FulcioCertificateMatcher} implementation. Custom implementations may throw

sigstore-java/src/main/java/dev/sigstore/bundle/BundleReader.java

@@ -50,9 +50,11 @@ static Bundle readBundle(Reader jsonReader) throws BundleParseException {
 
     bundleBuilder.mediaType(protoBundle.getMediaType());
 
-    if (protoBundle.getVerificationMaterial().getTlogEntriesCount() == 0) {
-      throw new BundleParseException("Could not find any tlog entries in bundle json");
-    }
+    // A bundle may legitimately carry no transparency-log entry (for example, GitHub's Sigstore
+    // instance for private repositories, which relies on a signed RFC 3161 timestamp instead).
+    // Such bundles are parsed here; whether their absence is acceptable is a verification-time
+    // policy decision (see VerificationOptions#allowNonTransparencyLogVerification), not a parse
+    // error. Any tlog entries that ARE present must still be well-formed (inclusion proof required).
     for (var bundleEntry : protoBundle.getVerificationMaterial().getTlogEntriesList()) {
       if (!bundleEntry.hasInclusionProof()) {
         // all consumed bundles must have an inclusion proof

sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioVerifier.java

@@ -150,7 +150,30 @@ private void verifyEmbeddedScts(CertPath certPath) throws FulcioVerificationExce
    */
   public void verifySigningCertificate(CertPath signingCertificate)
       throws FulcioVerificationException, IOException {
+    verifySigningCertificate(signingCertificate, false);
+  }
+
+  /**
+   * Verify a signing certificate, optionally tolerating a trust root that provides no certificate
+   * transparency logs.
+   *
+   * @param signingCertificate the chain to verify
+   * @param allowEmptyCtLogs when {@code true} and the configured trust root declares <em>no</em> CT
+   *     logs, SCT verification is skipped. This is required for Sigstore instances that do not use
+   *     certificate transparency (for example, GitHub's Sigstore instance for private repositories,
+   *     whose trust root carries zero CT logs and whose certificates embed no SCT). When {@code
+   *     false} (the default) a missing CT log is an error, preserving the strict behavior for the
+   *     public-good instance. If the trust root <em>does</em> provide CT logs, SCTs are always
+   *     verified regardless of this flag.
+   */
+  public void verifySigningCertificate(CertPath signingCertificate, boolean allowEmptyCtLogs)
+      throws FulcioVerificationException, IOException {
     CertPath fullCertPath = validateCertPath(signingCertificate);
+    if (ctLogs.isEmpty() && allowEmptyCtLogs) {
+      // The trust root declares no certificate-transparency logs, so there is nothing to verify an
+      // SCT against. Trusted time is established elsewhere (a signed RFC 3161 timestamp).
+      return;
+    }
     verifySct(fullCertPath);
   }