✨ Accept tlog index for POST endpoint.

app/server/internal/hashedrekord/hashedrekord.go

@@ -0,0 +1,88 @@
+// Copyright 2023 OpenSSF Scorecard Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package hashedrekord
+
+import (
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/pem"
+	"fmt"
+	"log"
+)
+
+const Kind = "hashedrekord"
+
+// https://github.com/sigstore/rekor/blob/f01f9cd2c55eaddba9be28624fea793a26ad28c4/pkg/types/hashedrekord/v0.0.1/hashedrekord_v0_0_1_schema.json
+//
+//nolint:lll
+type Body struct {
+	APIVersion string `json:"apiVersion"`
+	Kind       string `json:"kind"`
+	Spec       Spec   `json:"spec"`
+}
+type Spec struct {
+	Data      Data      `json:"data"`
+	Signature Signature `json:"signature"`
+}
+type Data struct {
+	Hash map[string]string
+}
+type Signature struct {
+	Content   string    `json:"content"`
+	PublicKey PublicKey `json:"publicKey"`
+}
+type PublicKey struct {
+	Content string `json:"content"`
+}
+
+// check if the rekord object matches a given blob (currently compares sha256 hash).
+func (b Body) Matches(blob []byte) bool {
+	if b.Spec.Data.Hash["algorithm"] != "sha256" {
+		log.Println("hashed rekord entry has no sha256")
+		return false
+	}
+	sha := sha256.Sum256(blob)
+	have := hex.EncodeToString(sha[:])
+	want := b.Spec.Data.Hash["value"]
+	return have == want
+}
+
+// extracts x509 certs from the hashedrekord tlog entry.
+// It uses the public key to pem decode the certificates.
+func (b Body) Certs() ([]*x509.Certificate, error) {
+	publicKey, err := base64.StdEncoding.DecodeString(b.Spec.Signature.PublicKey.Content)
+	if err != nil {
+		return nil, fmt.Errorf("decode rekord public key: %w", err)
+	}
+
+	remaining := publicKey
+	var result []*x509.Certificate
+	for len(remaining) > 0 {
+		var certDer *pem.Block
+		certDer, remaining = pem.Decode(remaining)
+		if certDer == nil {
+			return nil, fmt.Errorf("error during PEM decoding: %w", err)
+		}
+
+		cert, err := x509.ParseCertificate(certDer.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("error during certificate parsing: %w", err)
+		}
+		result = append(result, cert)
+	}
+	return result, nil
+}

app/server/internal/hashedrekord/hashedrekord_test.go

@@ -0,0 +1,138 @@
+// Copyright 2023 OpenSSF Scorecard Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package hashedrekord
+
+import (
+	"os"
+	"testing"
+)
+
+func Test_Body_certs(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name      string
+		body      Body
+		wantCount int
+		wantErr   bool
+	}{
+		{
+			name: "basic",
+			body: Body{
+				APIVersion: "0.0.1",
+				Kind:       Kind,
+				Spec: Spec{
+					Data: Data{
+						Hash: map[string]string{
+							"algorithm": "sha256",
+							"value":     "cd8327d867fce04bc97e149da50c3746340869575f7bf959a67284e34bfd46bc",
+						},
+					},
+					Signature: Signature{
+						Content: "MEYCIQDC3HNuKX8km/7TOo+HQ1WGr/FITRoYD9fw5RCRqc7WIgIhANAn6+yz0ziGGHH/52pDm5vCuOQgHnQ0AkGqi6POkEUB",
+						PublicKey: PublicKey{
+							//nolint:lll
+							Content: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMwVENDQWxpZ0F3SUJBZ0lVZFh4WHRDa2NCdmt4UGhIc20yTzdxczJidnIwd0NnWUlLb1pJemowRUF3TXcKTnpFVk1CTUdBMVVFQ2hNTWMybG5jM1J2Y21VdVpHVjJNUjR3SEFZRFZRUURFeFZ6YVdkemRHOXlaUzFwYm5SbApjbTFsWkdsaGRHVXdIaGNOTWpNd05qRXpNVGN6T1RReVdoY05Nak13TmpFek1UYzBPVFF5V2pBQU1Ga3dFd1lICktvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVrUExsVkhGOFRURWM5YzMzbmxCWHFEelNqR3RPZUJoa0VXQ1AKNEw5c1hYdTQvNXdlYzN3eVY4Nkozazg5Ly9FVTQvSysreFI4ckpkZVFialpDUkFQaGFPQ0FYY3dnZ0Z6TUE0RwpBMVVkRHdFQi93UUVBd0lIZ0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREF6QWRCZ05WSFE0RUZnUVVWUk1MCklOUnpQZjBVTlF0T1RmVVpNMVNUUTNjd0h3WURWUjBqQkJnd0ZvQVUzOVBwejFZa0VaYjVxTmpwS0ZXaXhpNFkKWkQ4d0lRWURWUjBSQVFIL0JCY3dGWUVUYzNOamFISnZZMnRBWjI5dloyeGxMbU52YlRBc0Jnb3JCZ0VFQVlPLwpNQUVCQkI1b2RIUndjem92TDJkcGRHaDFZaTVqYjIwdmJHOW5hVzR2YjJGMWRHZ3dMZ1lLS3dZQkJBR0R2ekFCCkNBUWdEQjVvZEhSd2N6b3ZMMmRwZEdoMVlpNWpiMjB2Ykc5bmFXNHZiMkYxZEdnd2dZb0dDaXNHQVFRQjFua0MKQkFJRWZBUjZBSGdBZGdEZFBUQnF4c2NSTW1NWkhoeVpaemNDb2twZXVONDhyZitIaW5LQUx5bnVqZ0FBQVlpMQoxNDNUQUFBRUF3QkhNRVVDSUh3eXh1bHFJMm1JdU44ai94TlcrUmJxbGd0S2YzcVlxNzFjSDY4MWZFaHNBaUVBCmhlcVY3SVQzSzNkeEQxTzNXcElFczhsY1RhS1U4K2o1R2g3T1E4OVpOaTB3Q2dZSUtvWkl6ajBFQXdNRFp3QXcKWkFJd0JTT0R3YVJ1Q1hnY0VCRk1KQmh4OVYrSW92ZHdOOXp5SVJ6VWlvTlZrTHRQM281SHVvNVZjcExMcEI5bwpSUXNSQWpBVS9yRmFrU2dJamx4c2cwZWJJS280NVJwdGtDSkh6dUZWS3YzTDdMQitLczlRcnhWb2g4WmhhMVNhCjROemllNkU9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",
+						},
+					},
+				},
+			},
+			wantCount: 1,
+			wantErr:   false,
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			certs, err := tt.body.Certs()
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("(hashedRekordBody).certs() error = %v, wantErr %v", err, tt.wantErr)
+			}
+			if len(certs) != tt.wantCount {
+				t.Errorf("(hashedRekordBody).certs() parsed %d certs, wanted %d", len(certs), tt.wantCount)
+			}
+		})
+	}
+}
+
+func Test_Body_Matches(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		blobPath string
+		body     Body
+		want     bool
+	}{
+		{
+			name:     "valid match",
+			blobPath: "./testdata/uploaded-blob.md",
+			body: Body{
+				Spec: Spec{
+					Data: Data{
+						Hash: map[string]string{
+							"algorithm": "sha256",
+							"value":     "cd8327d867fce04bc97e149da50c3746340869575f7bf959a67284e34bfd46bc",
+						},
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name:     "not a match, mismatched hash",
+			blobPath: "./testdata/uploaded-blob.md",
+			body: Body{
+				Spec: Spec{
+					Data: Data{
+						Hash: map[string]string{
+							"algorithm": "sha256",
+							"value":     "foo",
+						},
+					},
+				},
+			},
+			want: false,
+		},
+		{
+			name:     "not sha256",
+			blobPath: "./testdata/uploaded-blob.md",
+			body: Body{
+				Spec: Spec{
+					Data: Data{
+						Hash: map[string]string{
+							"algorithm": "foo",
+							"value":     "bar",
+						},
+					},
+				},
+			},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			b, err := os.ReadFile(tt.blobPath)
+			if err != nil {
+				t.Fatalf("unable to read test file (%q): %v", tt.blobPath, err)
+			}
+			got := tt.body.Matches(b)
+			if got != tt.want {
+				t.Errorf("(hashedRekordBody).matches() got %t, wanted %t", got, tt.want)
+			}
+		})
+	}
+}

app/server/internal/hashedrekord/testdata/uploaded-blob.md

@@ -0,0 +1 @@
+This is the file uploaded to Rekor's transparency log.