Fix scaffolding trust root (#1486)

* workflows: Add a test that uses trusted_root.json

Scaffolding TUF setup includes a generated trusted_root.json
but it is never tested: Add a cosign invocation that does so.

Signed-off-by: Jussi Kukkonen <[email protected]>

* repo: Use correct-er LogID calculation

logid used in trusted_root.json (which is an artifact in the TUF repository
that scaffolding generates) is a hash of **DER** key.

Signed-off-by: Jussi Kukkonen <[email protected]>

---------

Signed-off-by: Jussi Kukkonen <[email protected]>

Author: jku

.github/workflows/fulcio-rekor-kind.yaml

@@ -176,6 +176,22 @@ jobs:
         --certificate-identity "https://kubernetes.io/namespaces/default/serviceaccounts/default" \
         --certificate-oidc-issuer "https://kubernetes.default.svc.cluster.local"
 
+    - name: Sign a blob with signature bundle format
+      run: |
+        cosign sign-blob --yes --new-bundle-format=true --bundle=bundle.json --rekor-url $REKOR_URL --fulcio-url $FULCIO_URL --identity-token $OIDC_TOKEN README.md
+
+    - name: Verify blob with signature bundle format using trusted_root.json
+      run: |
+        # the trusted_root.json is in the TUF target cache: Use --trusted-root while cosign does not
+        # use it by default
+        cosign verify-blob \
+            --certificate-identity-regexp="https://kubernetes.io/namespaces/default/serviceaccounts/default" \
+            --certificate-oidc-issuer-regexp="https://kubernetes.default.svc.cluster.local" \
+            --bundle=bundle.json  --new-bundle-format \
+            --rekor-url $REKOR_URL \
+            --trusted-root=$HOME/.sigstore/root/targets/trusted_root.json \
+            README.md
+
     # Test with cosign in 'airgapped mode'
     # Uncomment these once modified cosign goes in.
     #- name: Checkout modified cosign for testing.

pkg/repo/repo.go

@@ -287,8 +287,8 @@ func constructTrustedRoot(targets []TargetWithMetadata) (*TargetWithMetadata, er
 }
 
 func pubkeyToTransparencyLogInstance(keyBytes []byte, tm time.Time) (*root.TransparencyLog, string, error) {
-	logID := sha256.Sum256(keyBytes)
 	der, _ := pem.Decode(keyBytes)
+	logID := sha256.Sum256(der.Bytes)
 	key, keyDetails, err := getKeyWithDetails(der.Bytes)
 	if err != nil {
 		return nil, "", err