salrashid123/cosign_id_token.md

## cosign_id_token.md

      
    Raw
  

              cosign_id_token.md
            
          
    Cosign SignBlob with GCP Identity Token from TPM

Snippet which uses a TPM based service account key to acquire an identity_token used to sign-blob using cosin
Normally, if you want to use cosign and a TPM, you would use the built in pkcs11 capability as described here:

Container Signing with Cosign and TPM PKCS-11

However, this snippet encodes the service account private key into a TPM and then making it issue an id_token directly using:

TPM Credential Source for Google Cloud SDK
TPM based Google Cloud Credential Access Token

Setup

As a demo, use a swtpm and encode the svc account private key into the TPM
 rm -rf /tmp/myvtpm && mkdir /tmp/myvtpm && swtpm_setup --tpmstate /tmp/myvtpm --tpm2 --create-ek-cert && swtpm socket --tpmstate dir=/tmp/myvtpm --tpm2 --server type=tcp,port=2321 --ctrl type=tcp,port=2322 --flags not-need-init,startup-clear --log level=2

cat /path/to/svc_account.json  | jq -r '.private_key' > /tmp/f.json

export SA_EMAIL=`cat /path/to/svc_account.json  | jq -r '.client_email'`
echo $SA_EMAIL

openssl rsa -in /tmp/f.json -out /tmp/key_rsa.pem 

export TPM2TOOLS_TCTI="swtpm:port=2321"
printf '\x00\x00' > unique.dat
tpm2_createprimary -C o -G ecc  -g sha256 \
    -c primary.ctx -a "fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda|restricted|decrypt" -u unique.dat

tpm2_import -C primary.ctx -G rsa2048:rsassa:null -g sha256 -i /tmp/key_rsa.pem -u key.pub -r key.prv
tpm2_flushcontext  -t
tpm2_load -C primary.ctx -u key.pub -r key.prv -c key.ctx 
tpm2_flushcontext  -t
tpm2_evictcontrol -C o -c key.ctx 0x81010002
tpm2_encodeobject -C primary.ctx -u key.pub -r key.prv -o private.pem 
Test IDTOKEN

using gcp-adc-tpm:
wget https://github.com/salrashid123/gcp-adc-tpm/releases/download/v0.8.5/gcp-adc-tpm_0.8.5_linux_amd64

### using persistentHandle
./gcp-adc-tpm --persistentHandle=0x81010002 --svcAccountEmail="$SA_EMAIL" --tpm-path="127.0.0.1:2321" -rawOutput -identityToken -audience=sigstore

### using service account key
./gcp-adc-tpm -keyfilepath=/tmp/private.pem --svcAccountEmail="$SA_EMAIL" --tpm-path="127.0.0.1:2321" -rawOutput -identityToken -audience=sigstore
Sign verify

echo -n "foo" > /tmp/message.text

### export as env var
export SIGSTORE_ID_TOKEN="..."

#### or inline as `--identity-token=`

cosign sign-blob --identity-token="...." --bundle /tmp/artifact.sigstore.json /tmp/message.txt
which gives
{
  "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json",
  "verificationMaterial": {
    "certificate": {
      "rawBytes": "MIIC5jCCAmygAwIBAgIUDq4FB6y3/NmLhdN5Xq5FHNZIj8UwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwMzAxMTU0OTA4WhcNMjYwMzAxMTU1OTA4WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfOmY53zwf6kqEDMv+MQL1Tr5lzlqgiYnnNWUdHbyhSkStY+SeCi20e4T772+uJzVjPHXcxPtMdHdEGHfgQno7qOCAYswggGHMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUml2CxzhVIyDpXitgQcAIXcN8l1YwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wOwYDVR0RAQH/BDEwL4EtY2ljZC10ZXN0LXNhQGNvcmUtZXNvLmlhbS5nc2VydmljZWFjY291bnQuY29tMCkGCisGAQQBg78wAQEEG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTArBgorBgEEAYO/MAEIBB0MG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABnKoW0XoAAAQDAEcwRQIhAP42wKtgswUN4V7/bieA4WJ0zd/B6QLSwkGaLU9t+iMHAiB02Rs0zra5iglH+cxJuuVUzM3dazGf3HjQSbLh0Ip+TzAKBggqhkjOPQQDAwNoADBlAjAhtSVUHAIeXjaArWaQh5fJH3oh+NdEBjaasfpRk5bEm1x4fYcAWOa6FMRa2eNbAgACMQCVV8gmx7QobBtHNDVctuGbZDDiDBi5xDtW4ozfOemzDw8VVuKWK75ClFJA1xu8mPE="
    },
    "tlogEntries": [
      {
        "logIndex": "1006574017",
        "logId": {
          "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
        },
        "kindVersion": {
          "kind": "hashedrekord",
          "version": "0.0.1"
        },
        "integratedTime": "1772380148",
        "inclusionPromise": {
          "signedEntryTimestamp": "MEUCICrmjpTQIDdUcopp7jSwOijjADOtO1Q3qWR4iumtH/IDAiEA8cVoFCm/MNlyc2ZVOx9SP4tq7miwiz7Aq2DNvUt5KlY="
        },
        "inclusionProof": {
          "logIndex": "884669755",
          "rootHash": "4fLEhvTz0QByIm1Ho7SlwcECTC15qWh3OdK4/5pwbJk=",
          "treeSize": "884669759",
          "hashes": [
            "5nxYUKsHPqcBvqrM1r78dYdTvsNBB58Zh4cgrkYCDbs=",
            "5dd2QauJxKuaa/TD1x2gGDOhg0asNVl7ChyBGRMz+qU=",
            "W4UlNo8GH/YUS3nI+sgi5gNgcEE/0MQBiNWN9YsL8WQ=",
            "5akSDb5G1w8HhbicVovjFHmgEE3gN6fhzaMN4wmy+D4=",
            "boz8bHcOyKz5w6ralhY8axvJbK6A1JZALIsP/bpD92s=",
            "dugKVpxSu8dfuxrzA/HfgCUwM/IvxdTm86189WLnEa0=",
            "scxuL9Xlkx4iHFacZg3+O1OMVrsssKxbd8wG5hzn0rI=",
            "PKwSqF71CUpo3fb/akSCPFcz8rRi7HcYoljXuf7efSY=",
            "Ve/RPfnrieaDg5q3GxUjWEo+NbB2DLZ3U49P+9P9nss=",
            "0fKZ7fg7dtKjg3ennf/fQpIfgjHvBQHskA6ErLVuc2E=",
            "udM4Iaa0MQeV5aAjA6OiaErtwN4bHyjekdZ7zASfqvo=",
            "KW6UeLjH2D5p4O+/lrcBZHN4MNYESq/zG/dtdGUwyEk=",
            "yvFQ2+3N36mUG6VtmOICP5n1CdupJdQYULSCNBfPXdY=",
            "qOKerUiBuxy8RKaCAyMN8Ltdchcr5+NhPZn+Id8lNZ0=",
            "f6d6XHkvBakAJj1i+jAchzhhVt8mLCsozwbXrdXa348=",
            "d7UsAtfobsuRNlP6UJLOk0MDd2vHFX3u7ORtpaQfDaA=",
            "2ifTIShLkLvxl0ELyqJ7qcRljsbpbh1yBXF/ffxvVqo=",
            "mjr+JtvJ1BwYlJvqagR3tMH25XuTBdYkgN1yMnmeCCs=",
            "ZleKYeRKwUF3HP3HO0kxHMVeJgY3N/euGinVhlVWaq0=",
            "fLAvE46NqCVV86EpB2pKkwJlFjjFk7ntX3lC+PiZuIo=",
            "T4DqWD42hAtN+vX8jKCWqoC4meE4JekI9LxYGCcPy1M="
          ],
          "checkpoint": {
            "envelope": "rekor.sigstore.dev - 1193050959916656506\n884669759\n4fLEhvTz0QByIm1Ho7SlwcECTC15qWh3OdK4/5pwbJk=\n\n— rekor.sigstore.dev wNI9ajBFAiATlv3pXcrySvjrP2oUv3bjdD1/BXJ9qhASeXhronyU3wIhAM0UQWSIvXf/e532HGYIDCM5SFH3iODB8+rGkn7SXfYe\n"
          }
        },
        "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJkOGQzMjEzYzcxOGE0YzBhZWNhMDI1YTNhOWMzZTA3Y2E3NjgwNmRmYmE4N2ZhNTZhMzhhN2U0YTljZjJjYzc3In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRmtJZjM5VWhIQ1haMkhHak1MVWwzeDgxYmtQU2VwN0hBUzRlTnpyQkNPcEFpQmV6ZHJtNkltblg2VDF6VmVnV3MxYTByRkN2ME5QRnlZclgwOC85aWFaR3c9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTTFha05EUVcxNVowRjNTVUpCWjBsVlJIRTBSa0kyZVRNdlRtMU1hR1JPTlZoeE5VWklUbHBKYWpoVmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDE2UVhoTlZGVXdUMVJCTkZkb1kwNU5hbGwzVFhwQmVFMVVWVEZQVkVFMFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZtVDIxWk5UTjZkMlkyYTNGRlJFMTJLMDFSVERGVWNqVnNlbXh4WjJsWmJtNU9WMVVLWkVoaWVXaFRhMU4wV1N0VFpVTnBNakJsTkZRM056SXJkVXA2Vm1wUVNGaGplRkIwVFdSSVpFVkhTR1puVVc1dk4zRlBRMEZaYzNkblowZElUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZ0YkRKRENuaDZhRlpKZVVSd1dHbDBaMUZqUVVsWVkwNDRiREZaZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDA5M1dVUldVakJTUVZGSUwwSkVSWGRNTkVWMFdUSnNhbHBETVRCYVdFNHdURmhPYUZGSFRuWmpiVlYwV2xoT2RreHRiR2hpVXpWdVl6SldlUXBrYld4cVdsZEdhbGt5T1RGaWJsRjFXVEk1ZEUxRGEwZERhWE5IUVZGUlFtYzNPSGRCVVVWRlJ6Sm9NR1JJUW5wUGFUaDJXVmRPYW1JelZuVmtTRTExQ2xveU9YWmFNbmhzVEcxT2RtSlVRWEpDWjI5eVFtZEZSVUZaVHk5TlFVVkpRa0l3VFVjeWFEQmtTRUo2VDJrNGRsbFhUbXBpTTFaMVpFaE5kVm95T1hZS1dqSjRiRXh0VG5aaVZFTkNhV2RaUzB0M1dVSkNRVWhYWlZGSlJVRm5VamhDU0c5QlpVRkNNa0ZPTURsTlIzSkhlSGhGZVZsNGEyVklTbXh1VG5kTGFRcFRiRFkwTTJwNWRDODBaVXRqYjBGMlMyVTJUMEZCUVVKdVMyOVhNRmh2UVVGQlVVUkJSV04zVWxGSmFFRlFOREozUzNSbmMzZFZUalJXTnk5aWFXVkJDalJYU2pCNlpDOUNObEZNVTNkclIyRk1WVGwwSzJsTlNFRnBRakF5VW5Nd2VuSmhOV2xuYkVnclkzaEtkWFZXVlhwTk0yUmhla2RtTTBocVVWTmlUR2dLTUVsd0sxUjZRVXRDWjJkeGFHdHFUMUJSVVVSQmQwNXZRVVJDYkVGcVFXaDBVMVpWU0VGSlpWaHFZVUZ5VjJGUmFEVm1Ta2d6YjJnclRtUkZRbXBoWVFwelpuQlNhelZpUlcweGVEUm1XV05CVjA5aE5rWk5VbUV5WlU1aVFXZEJRMDFSUTFaV09HZHRlRGRSYjJKQ2RFaE9SRlpqZEhWSFlscEVSR2xFUW1rMUNuaEVkRmMwYjNwbVQyVnRla1IzT0ZaV2RVdFhTemMxUTJ4R1NrRXhlSFU0YlZCRlBRb3RMUzB0TFVWT1JDQkRSVkpVU1VaSlEwRlVSUzB0TFMwdENnPT0ifX19fQ=="
      }
    ],
    "timestampVerificationData": {
      "rfc3161Timestamps": [
        {
          "signedTimestamp": "MIICyDADAgEAMIICvwYJKoZIhvcNAQcCoIICsDCCAqwCAQMxDTALBglghkgBZQMEAgEwgbcGCyqGSIb3DQEJEAEEoIGnBIGkMIGhAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgu0+YUYFRxhElk6W30XlVesf5eqH2B2bpQt9mkaBDP28CFHe31Ax92zG/sK8yi8NACr8PpPU5GA8yMDI2MDMwMTE1NDkwOFowAwIBAaAypDAwLjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MRUwEwYDVQQDEwxzaWdzdG9yZS10c2GgADGCAdowggHWAgEBMFEwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZAIUOhNULwyQYe68wUMvy4qOiyojiwwwCwYJYIZIAWUDBAIBoIH8MBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0BCQUxDxcNMjYwMzAxMTU0OTA4WjAvBgkqhkiG9w0BCQQxIgQgFbpZ388H7C3T9C0/BEMpAFTc6MAIKxMfQV8AW+wSYbYwgY4GCyqGSIb3DQEJEAIvMX8wfTB7MHkEIIX5J7wHq2LKw7RDVsEO/IGyxog/2nq55thw2dE6zQW3MFUwPaQ7MDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQCFDoTVC8MkGHuvMFDL8uKjosqI4sMMAoGCCqGSM49BAMCBGYwZAIwGLy3K91Aw3mQoToHush1rCsv+xNtHix/T+RP/h700rcb9ycmMArEanv2SfCMGxwSAjA2tmfMKWy7LAcEat0iqZyc6SI/P0bJ7oMzuykqj+0tcgzL8HfWkT1uAzr3dvVaNdY="
        }
      ]
    }
  },
  "messageSignature": {
    "messageDigest": {
      "algorithm": "SHA2_256",
      "digest": "2NMhPHGKTArsoCWjqcPgfKdoBt+6h/pWo4p+SpzyzHc="
    },
    "signature": "MEQCIFkIf39UhHCXZ2HGjMLUl3x81bkPSep7HAS4eNzrBCOpAiBezdrm6ImnX6T1zVegWs1a0rFCv0NPFyYrX08/9iaZGw=="
  }
}
now verify
$ cosign verify-blob   --certificate-identity $SA_EMAIL --certificate-oidc-issuer https://accounts.google.com  --bundle /tmp/artifact.sigstore.json /tmp/message.txt
Verified OK
No results found