Close #1251: Allow no transparency-log entries

* Add support for verifying bundles without transparency-log entries, relying on signed RFC 3161 timestamps.

Author: anthonydahanne

sigstore-cli/src/main/java/dev/sigstore/cli/Verify.java

@@ -113,6 +113,16 @@ static class Policy {
       required = false)
   Path workingDirectory;
 
+  @Option(
+      names = {"--allow-non-transparency-log"},
+      description =
+          "verify a bundle that has no transparency-log entry, relying on a signed RFC 3161 "
+              + "timestamp instead (reduced assurance; for instances that do not publish to a "
+              + "transparency log, e.g. GitHub's Sigstore instance for private repositories)",
+      required = false,
+      defaultValue = "false")
+  Boolean allowNonTransparencyLog;
+
   @Override
   public Integer call() throws Exception {
     byte[] digest;
@@ -142,6 +152,9 @@ public Integer call() throws Exception {
               .subjectAlternativeName(StringMatcher.string(policy.certificateSan))
               .build());
     }
+    if (allowNonTransparencyLog) {
+      verificationOptionsBuilder.allowNonTransparencyLogVerification(true);
+    }
     var verificationOptions = verificationOptionsBuilder.build();
 
     KeylessVerifier verifier;

sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java

@@ -132,6 +132,18 @@ public Builder trustedRootProvider(TrustedRootProvider trustedRootProvider) {
   private AlgorithmRegistry.HashAlgorithm findHashAlgorithm(Bundle bundle)
       throws KeylessVerificationException {
     try {
+      // When the bundle has no transparency-log entry (e.g. a signed-timestamp-only bundle),
+      // derive the hash algorithm without one: DSSE bundles use SHA-256 (as in the dsse:0.0.1
+      // case below), otherwise fall back to the signing certificate's algorithm. Whether such a
+      // bundle is permitted at all is enforced in verify(...) via
+      // VerificationOptions#allowNonTransparencyLogVerification.
+      if (bundle.getEntries().isEmpty()) {
+        if (bundle.getDsseEnvelope().isPresent()) {
+          return AlgorithmRegistry.HashAlgorithm.SHA2_256;
+        }
+        var publicKey = Certificates.getLeaf(bundle.getCertPath()).getPublicKey();
+        return AlgorithmRegistry.getSigningAlgorithm(publicKey).getHashAlgorithm();
+      }
       var rekorEntry = bundle.getEntries().get(0);
       var body = rekorEntry.getBodyDecoded();
       if ("0.0.1".equals(body.getApiVersion())) {
@@ -209,7 +221,20 @@ public void verify(byte[] artifactDigest, Bundle bundle, VerificationOptions opt
     checkCertificateMatchers(leafCert, options.getCertificateMatchers());
 
     var hashAlgorithm = findHashAlgorithm(bundle);
-    var rekorEntry = bundle.getEntries().get(0);
+
+    // A transparency-log entry is required by default. Bundles from instances that do not publish
+    // to a log (e.g. GitHub's Sigstore instance for private repositories) carry only a signed
+    // timestamp; verifying those requires opting in and relies on the RFC 3161 timestamp (verified
+    // below) for trusted time.
+    var entries = bundle.getEntries();
+    if (entries.isEmpty() && !options.allowNonTransparencyLogVerification()) {
+      throw new KeylessVerificationException(
+          "Bundle does not contain a transparency log entry. If it is from an instance that does "
+              + "not publish to a transparency log, set "
+              + "VerificationOptions.allowNonTransparencyLogVerification(true) to verify using its "
+              + "signed timestamp instead.");
+    }
+    var rekorEntry = entries.isEmpty() ? null : entries.get(0);
 
     byte[] signature;
     if (bundle.getMessageSignature().isPresent()) { // hashedrekord
@@ -222,16 +247,20 @@ public void verify(byte[] artifactDigest, Bundle bundle, VerificationOptions opt
       signature = dsseEnvelope.getSignature();
     }
 
-    try {
-      rekorVerifier.verifyEntry(rekorEntry);
-    } catch (RekorVerificationException ex) {
-      throw new KeylessVerificationException("Transparency log entry could not be verified", ex);
+    // A transparency-log entry that is present is always verified; opting in only relaxes the
+    // requirement that one exists, never the verification of one that is provided.
+    Instant entryTime = null;
+    if (rekorEntry != null) {
+      try {
+        rekorVerifier.verifyEntry(rekorEntry);
+      } catch (RekorVerificationException ex) {
+        throw new KeylessVerificationException("Transparency log entry could not be verified", ex);
+      }
+      // if entry was verified and has a SET, get time from it
+      var set = rekorEntry.getVerification().getSignedEntryTimestamp();
+      entryTime = set != null ? rekorEntry.getIntegratedTimeInstant() : null;
     }
 
-    // if entry was verified and has a SET, get time from it
-    var set = rekorEntry.getVerification().getSignedEntryTimestamp();
-    var entryTime = set != null ? rekorEntry.getIntegratedTimeInstant() : null;
-
     verifyTimestamps(leafCert, bundle.getTimestamps(), entryTime, signature);
   }
 
@@ -325,6 +354,12 @@ private void checkMessageSignature(
           "Signature could not be processed: " + ex.getMessage(), ex);
     }
 
+    // No transparency-log entry (allowed via VerificationOptions): the artifact digest and
+    // signature have been verified above, and there is nothing to cross-check against.
+    if (rekorEntry == null) {
+      return;
+    }
+
     // recreate the log entry and check if it matches what was provided in the entry
     String version;
     try {
@@ -469,6 +504,12 @@ private void checkDsseEnvelope(
       throw new KeylessVerificationException("Signature could not be processed", se);
     }
 
+    // No transparency-log entry (allowed via VerificationOptions): the payload subject digest and
+    // DSSE signature have been verified above, and there is nothing to cross-check against.
+    if (rekorEntry == null) {
+      return;
+    }
+
     RekorEntryBody entryBody;
     try {
       entryBody = rekorEntry.getBodyDecoded();

sigstore-java/src/main/java/dev/sigstore/VerificationOptions.java

@@ -20,6 +20,7 @@
 import java.security.cert.X509Certificate;
 import java.util.List;
 import java.util.function.Predicate;
+import org.immutables.value.Value.Default;
 import org.immutables.value.Value.Immutable;
 
 @Immutable(singleton = true)
@@ -28,6 +29,24 @@ public interface VerificationOptions {
   /** An allow list of certificate identities to match with. */
   List<CertificateMatcher> getCertificateMatchers();
 
+  /**
+   * Whether to allow verifying a bundle that contains no transparency-log entry, relying solely on
+   * a signed RFC 3161 timestamp for trusted time. Defaults to {@code false}, matching the Sigstore
+   * public-good instance where a transparency-log entry is always present and required.
+   *
+   * <p>Enabling this weakens the guarantees: without a transparency-log entry the signature is not
+   * publicly monitorable/auditable. Only enable it for bundles from instances that intentionally do
+   * not publish to a transparency log (for example, GitHub's Sigstore instance for private
+   * repositories), and pair it with a pinned trusted root. A signed timestamp is still required.
+   *
+   * <p>This only relaxes the <em>requirement</em> that a transparency-log entry exists; a
+   * transparency-log entry that <em>is</em> present in the bundle is still fully verified.
+   */
+  @Default
+  default boolean allowNonTransparencyLogVerification() {
+    return false;
+  }
+
   /**
    * An interface for allowing matching of certificates. Use {@link #fulcio()} to instantiate the
    * default {@link FulcioCertificateMatcher} implementation. Custom implementations may throw