Add sha256 prefix to index keys for artifact hashes (sigstore#290)

* Add sha256 prefix to index keys for artifact hashes

This change adds the `sha256:` prefix to index values that are created to simplify searching the transparency log for artifacts. In case we shift to using a different hashing algorithm in the future, this will provide a way to specify it.

Fixes sigstore#289

Signed-off-by: Bob Callaway <bob.callaway@gmail.com>

Author: bobcallaway

cmd/rekor-cli/app/pflags.go

@@ -27,6 +27,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
@@ -47,7 +48,7 @@ func addSearchPFlags(cmd *cobra.Command) error {
 
 	cmd.Flags().Var(&fileOrURLFlag{}, "artifact", "path or URL to artifact file")
 
-	cmd.Flags().Var(&uuidFlag{}, "sha", "the SHA256 sum of the artifact")
+	cmd.Flags().Var(&shaFlag{}, "sha", "the SHA256 sum of the artifact")
 
 	cmd.Flags().Var(&emailFlag{}, "email", "email associated with the public key's subject")
 	return nil
@@ -468,6 +469,36 @@ func (f *pkiFormatFlag) Set(s string) error {
 	return fmt.Errorf("value specified is invalid: [%s] supported values are: [pgp, minisign, x509, ssh]", s)
 }
 
+type shaFlag struct {
+	hash string
+}
+
+func (s *shaFlag) String() string {
+	return s.hash
+}
+
+func (s *shaFlag) Set(v string) error {
+	if v == "" {
+		return errors.New("flag must be specified")
+	}
+	strToCheck := v
+	if strings.HasPrefix(v, "sha256:") {
+		strToCheck = strings.Replace(v, "sha256:", "", 1)
+	}
+	if _, err := hex.DecodeString(strToCheck); (err != nil) || (len(strToCheck) != 64) {
+		if err == nil {
+			err = errors.New("invalid length for value")
+		}
+		return fmt.Errorf("value specified is invalid: %w", err)
+	}
+	s.hash = v
+	return nil
+}
+
+func (s *shaFlag) Type() string {
+	return "sha"
+}
+
 type uuidFlag struct {
 	hash string
 }

cmd/rekor-cli/app/search.go

@@ -116,7 +116,7 @@ var searchCmd = &cobra.Command{
 			}
 
 			hashVal := strings.ToLower(hex.EncodeToString(hasher.Sum(nil)))
-			params.Query.Hash = hashVal
+			params.Query.Hash = "sha256:" + hashVal
 		}
 
 		publicKeyStr := viper.GetString("public-key")

openapi.yaml

@@ -338,7 +338,7 @@ definitions:
           - "format"
       hash:
         type: string
-        pattern: '^[0-9a-fA-F]{64}$'
+        pattern: '^(sha256:)?[0-9a-fA-F]{64}$'
 
   SearchLogQuery:
     type: object

pkg/api/entries.go

@@ -296,12 +296,14 @@ func SearchLogQueryHandler(params entries.SearchLogQueryParams) middleware.Respo
 		}
 
 		for _, leafResp := range searchByHashResults {
-			logEntry, err := logEntryFromLeaf(tc, leafResp.Leaf, leafResp.SignedLogRoot, leafResp.Proof)
-			if err != nil {
-				return handleRekorAPIError(params, code, err, err.Error())
-			}
+			if leafResp != nil {
+				logEntry, err := logEntryFromLeaf(tc, leafResp.Leaf, leafResp.SignedLogRoot, leafResp.Proof)
+				if err != nil {
+					return handleRekorAPIError(params, code, err, err.Error())
+				}
 
-			resultPayload = append(resultPayload, logEntry)
+				resultPayload = append(resultPayload, logEntry)
+			}
 		}
 	}
 

pkg/generated/models/search_index.go

@@ -93,7 +93,8 @@ func (v V001Entry) IndexKeys() []string {
 	}
 
 	if v.JARModel.Archive.Hash != nil {
-		result = append(result, strings.ToLower(swag.StringValue(v.JARModel.Archive.Hash.Value)))
+		hashKey := strings.ToLower(fmt.Sprintf("%s:%s", *v.JARModel.Archive.Hash.Algorithm, *v.JARModel.Archive.Hash.Value))
+		result = append(result, hashKey)
 	}
 
 	return result

pkg/generated/restapi/embedded_spec.go

@@ -88,7 +88,8 @@ func (v V001Entry) IndexKeys() []string {
 	result = append(result, v.keyObj.EmailAddresses()...)
 
 	if v.RekordObj.Data.Hash != nil {
-		result = append(result, strings.ToLower(swag.StringValue(v.RekordObj.Data.Hash.Value)))
+		hashKey := strings.ToLower(fmt.Sprintf("%s:%s", *v.RekordObj.Data.Hash.Algorithm, *v.RekordObj.Data.Hash.Value))
+		result = append(result, hashKey)
 	}
 
 	return result

pkg/types/jar/v0.0.1/entry.go

@@ -92,7 +92,8 @@ func (v V001Entry) IndexKeys() []string {
 	result = append(result, v.keyObj.EmailAddresses()...)
 
 	if v.RPMModel.Package.Hash != nil {
-		result = append(result, strings.ToLower(swag.StringValue(v.RPMModel.Package.Hash.Value)))
+		hashKey := strings.ToLower(fmt.Sprintf("%s:%s", *v.RPMModel.Package.Hash.Algorithm, *v.RPMModel.Package.Hash.Value))
+		result = append(result, hashKey)
 	}
 
 	return result

pkg/types/rekord/v0.0.1/entry.go

@@ -45,3 +45,9 @@ TMPDIR="$(mktemp -d -t rekor_test.XXXXXX)"
 touch $TMPDIR.rekor.yaml
 trap "rm -rf $TMPDIR" EXIT
 TMPDIR=$TMPDIR go test -tags=e2e ./tests/
+if docker-compose logs --no-color | grep -q "panic: runtime error:" ; then
+   # if we're here, we found a panic
+   echo "Failing due to panics detected in logs"
+   docker-compose logs --no-color
+   exit 1
+fi