Skip to content

Commit 751b19d

Browse files
bobcallawaybobcallaway
authored
Optimize lookup of attestation from storage layer (#909)
Currently only two Rekor pluggable types support the storage of attestations (intoto, cose); the previous code to fetch attestations was type-agnostic, but due to the fix #878 the server was doing unnecessary lookups for all types, regardless of whether they store attestation content or not. This makes the attestation storage an explict interface, which we can test casting for and avoid a roundtrip to the storage layer for types that don't support storing attestations. Signed-off-by: Bob Callaway <bcallaway@google.com>
1 parent 3184a52 commit 751b19d

File tree

10 files changed

+45
-101
lines changed

10 files changed

+45
-101
lines changed

‎pkg/api/entries.go‎

Lines changed: 38 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -106,31 +106,33 @@ func logEntryFromLeaf(ctx context.Context, signer signature.Signer, tc TrillianC
106106
return nil, err
107107
}
108108

109-
var att []byte
110-
var fetchErr error
111-
attKey := eimpl.AttestationKey()
112-
// if we're given a key by the type logic, let's try that first
113-
if attKey != "" {
114-
att, fetchErr = storageClient.FetchAttestation(ctx, attKey)
115-
if fetchErr != nil {
116-
log.ContextLogger(ctx).Errorf("error fetching attestation by key, trying by UUID: %s %w", attKey, fetchErr)
117-
}
118-
}
119-
// if looking up by key failed or we weren't able to generate a key, try looking up by uuid
120-
if attKey == "" || fetchErr != nil {
121-
activeTree := fmt.Sprintf("%x", tc.logID)
122-
entryIDstruct, err := sharding.CreateEntryIDFromParts(activeTree, uuid)
123-
if err != nil {
124-
return nil, fmt.Errorf("error creating EntryID from active treeID %v and uuid %v: %w", activeTree, uuid, err)
109+
if entryWithAtt, ok := eimpl.(types.EntryWithAttestationImpl); ok {
110+
var att []byte
111+
var fetchErr error
112+
attKey := entryWithAtt.AttestationKey()
113+
// if we're given a key by the type logic, let's try that first
114+
if attKey != "" {
115+
att, fetchErr = storageClient.FetchAttestation(ctx, attKey)
116+
if fetchErr != nil {
117+
log.ContextLogger(ctx).Errorf("error fetching attestation by key, trying by UUID: %s %w", attKey, fetchErr)
118+
}
125119
}
126-
att, fetchErr = storageClient.FetchAttestation(ctx, entryIDstruct.UUID)
127-
if fetchErr != nil {
128-
log.ContextLogger(ctx).Errorf("error fetching attestation by uuid: %s %v", entryIDstruct.UUID, fetchErr)
120+
// if looking up by key failed or we weren't able to generate a key, try looking up by uuid
121+
if attKey == "" || fetchErr != nil {
122+
activeTree := fmt.Sprintf("%x", tc.logID)
123+
entryIDstruct, err := sharding.CreateEntryIDFromParts(activeTree, uuid)
124+
if err != nil {
125+
return nil, fmt.Errorf("error creating EntryID from active treeID %v and uuid %v: %w", activeTree, uuid, err)
126+
}
127+
att, fetchErr = storageClient.FetchAttestation(ctx, entryIDstruct.UUID)
128+
if fetchErr != nil {
129+
log.ContextLogger(ctx).Errorf("error fetching attestation by uuid: %s %v", entryIDstruct.UUID, fetchErr)
130+
}
129131
}
130-
}
131-
if fetchErr == nil {
132-
logEntryAnon.Attestation = &models.LogEntryAnonAttestation{
133-
Data: att,
132+
if fetchErr == nil {
133+
logEntryAnon.Attestation = &models.LogEntryAnonAttestation{
134+
Data: att,
135+
}
134136
}
135137
}
136138
}
@@ -250,20 +252,21 @@ func createLogEntry(params entries.CreateLogEntryParams) (models.LogEntry, middl
250252
}
251253

252254
if viper.GetBool("enable_attestation_storage") {
253-
254-
go func() {
255-
attKey, attVal := entry.AttestationKeyValue()
256-
if attVal == nil {
257-
log.ContextLogger(ctx).Infof("no attestation for %s", uuid)
258-
return
259-
}
260-
if err := storeAttestation(context.Background(), attKey, attVal); err != nil {
261-
// entryIDstruct.UUID
262-
log.ContextLogger(ctx).Errorf("error storing attestation: %s", err)
255+
if entryWithAtt, ok := entry.(types.EntryWithAttestationImpl); ok {
256+
attKey, attVal := entryWithAtt.AttestationKeyValue()
257+
if attVal != nil {
258+
go func() {
259+
if err := storeAttestation(context.Background(), attKey, attVal); err != nil {
260+
// entryIDstruct.UUID
261+
log.ContextLogger(ctx).Errorf("error storing attestation: %s", err)
262+
} else {
263+
log.ContextLogger(ctx).Infof("stored attestation for uuid %s with filename %s", entryIDstruct.UUID, attKey)
264+
}
265+
}()
263266
} else {
264-
log.ContextLogger(ctx).Infof("stored attestation for uuid %s with filename %s", entryIDstruct.UUID, attKey)
267+
log.ContextLogger(ctx).Infof("no attestation returned for %s", uuid)
265268
}
266-
}()
269+
}
267270
}
268271

269272
signature, err := signEntry(ctx, api.signer, logEntryAnon)

‎pkg/types/alpine/v0.0.1/entry.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -287,14 +287,6 @@ func (v V001Entry) validate() error {
287287
return nil
288288
}
289289

290-
func (v V001Entry) AttestationKey() string {
291-
return ""
292-
}
293-
294-
func (v V001Entry) AttestationKeyValue() (string, []byte) {
295-
return "", nil
296-
}
297-
298290
func (v V001Entry) CreateFromArtifactProperties(ctx context.Context, props types.ArtifactProperties) (models.ProposedEntry, error) {
299291
returnVal := models.Alpine{}
300292
re := V001Entry{}

‎pkg/types/entries.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,16 @@ type EntryImpl interface {
3535
IndexKeys() ([]string, error) // the keys that should be added to the external index for this entry
3636
Canonicalize(ctx context.Context) ([]byte, error) // marshal the canonical entry to be put into the tlog
3737
Unmarshal(e models.ProposedEntry) error // unmarshal the abstract entry into the specific struct for this versioned type
38-
AttestationKey() string // returns the key used to look up the attestation from storage (should be sha256:digest)
39-
AttestationKeyValue() (string, []byte) // returns the key to be used when storing the attestation as well as the attestation itself
4038
CreateFromArtifactProperties(context.Context, ArtifactProperties) (models.ProposedEntry, error)
4139
}
4240

41+
// EntryWithAttestationImpl specifies the behavior of a versioned type that also stores attestations
42+
type EntryWithAttestationImpl interface {
43+
EntryImpl
44+
AttestationKey() string // returns the key used to look up the attestation from storage (should be sha256:digest)
45+
AttestationKeyValue() (string, []byte) // returns the key to be used when storing the attestation as well as the attestation itself
46+
}
47+
4348
// EntryFactory describes a factory function that can generate structs for a specific versioned type
4449
type EntryFactory func() EntryImpl
4550

‎pkg/types/hashedrekord/v0.0.1/entry.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -189,14 +189,6 @@ func (v *V001Entry) validate() (pki.Signature, pki.PublicKey, error) {
189189
return sigObj, keyObj, nil
190190
}
191191

192-
func (v V001Entry) AttestationKey() string {
193-
return ""
194-
}
195-
196-
func (v V001Entry) AttestationKeyValue() (string, []byte) {
197-
return "", nil
198-
}
199-
200192
func (v V001Entry) CreateFromArtifactProperties(ctx context.Context, props types.ArtifactProperties) (models.ProposedEntry, error) {
201193
returnVal := models.Hashedrekord{}
202194
re := V001Entry{}

‎pkg/types/helm/v0.0.1/entry.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -280,14 +280,6 @@ func (v V001Entry) validate() error {
280280
return nil
281281
}
282282

283-
func (v V001Entry) AttestationKey() string {
284-
return ""
285-
}
286-
287-
func (v V001Entry) AttestationKeyValue() (string, []byte) {
288-
return "", nil
289-
}
290-
291283
func (v V001Entry) CreateFromArtifactProperties(ctx context.Context, props types.ArtifactProperties) (models.ProposedEntry, error) {
292284
//TODO: how to select version of item to create
293285
returnVal := models.Helm{}

‎pkg/types/jar/v0.0.1/entry.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -271,14 +271,6 @@ func extractPKCS7SignatureFromJAR(inz *zip.Reader) ([]byte, error) {
271271
return nil, errors.New("unable to locate signature in JAR file")
272272
}
273273

274-
func (v V001Entry) AttestationKey() string {
275-
return ""
276-
}
277-
278-
func (v V001Entry) AttestationKeyValue() (string, []byte) {
279-
return "", nil
280-
}
281-
282274
func (v *V001Entry) CreateFromArtifactProperties(ctx context.Context, props types.ArtifactProperties) (models.ProposedEntry, error) {
283275
returnVal := models.Jar{}
284276
re := V001Entry{}

‎pkg/types/rekord/v0.0.1/entry.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -332,14 +332,6 @@ func (v V001Entry) validate() error {
332332
return nil
333333
}
334334

335-
func (v V001Entry) AttestationKey() string {
336-
return ""
337-
}
338-
339-
func (v V001Entry) AttestationKeyValue() (string, []byte) {
340-
return "", nil
341-
}
342-
343335
func (v V001Entry) CreateFromArtifactProperties(ctx context.Context, props types.ArtifactProperties) (models.ProposedEntry, error) {
344336
returnVal := models.Rekord{}
345337
re := V001Entry{}

‎pkg/types/rfc3161/v0.0.1/entry.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -173,14 +173,6 @@ func (v V001Entry) validate() error {
173173
return nil
174174
}
175175

176-
func (v V001Entry) AttestationKey() string {
177-
return ""
178-
}
179-
180-
func (v V001Entry) AttestationKeyValue() (string, []byte) {
181-
return "", nil
182-
}
183-
184176
func (v V001Entry) CreateFromArtifactProperties(_ context.Context, props types.ArtifactProperties) (models.ProposedEntry, error) {
185177
returnVal := models.Rfc3161{}
186178

‎pkg/types/rpm/v0.0.1/entry.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -307,14 +307,6 @@ func (v V001Entry) validate() error {
307307
return nil
308308
}
309309

310-
func (v V001Entry) AttestationKey() string {
311-
return ""
312-
}
313-
314-
func (v V001Entry) AttestationKeyValue() (string, []byte) {
315-
return "", nil
316-
}
317-
318310
func (v V001Entry) CreateFromArtifactProperties(ctx context.Context, props types.ArtifactProperties) (models.ProposedEntry, error) {
319311
returnVal := models.Rpm{}
320312
re := V001Entry{}

‎pkg/types/tuf/v0.0.1/entry.go‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -294,14 +294,6 @@ func (v V001Entry) Validate() error {
294294
return nil
295295
}
296296

297-
func (v V001Entry) AttestationKey() string {
298-
return ""
299-
}
300-
301-
func (v V001Entry) AttestationKeyValue() (string, []byte) {
302-
return "", nil
303-
}
304-
305297
func (v V001Entry) CreateFromArtifactProperties(ctx context.Context, props types.ArtifactProperties) (models.ProposedEntry, error) {
306298
// This will do only syntactic checks of the metablock, not signature verification.
307299
// Signature verification occurs in FetchExternalEntries()

0 commit comments

Comments
 (0)