# 验证容器镜像签名（密钥模式）
cosign verify \
  --key cosign.pub \
  ghcr.io/myorg/myimage:v1.0.0

# 预期输出：
# Verification for ghcr.io/myorg/myimage:v1.0.0 --
# The following checks were performed:
#   - The cosign claims were validated
#   - The signatures were verified against the specified public key
#   - Any certificates were verified against the Fulcio roots.
#
# [{"critical":{"identity":{"docker-reference":"ghcr.io/myorg/myimage"},...}}]

# 验证无密钥签名（需要指定身份信息）
cosign verify \
  --certificate-identity=[email protected] \
  --certificate-oidc-issuer=https://accounts.google.com \
  ghcr.io/myorg/myimage:v1.0.0

# 验证 GitHub Actions 签名
cosign verify \
  --certificate-identity=https://github.com/myorg/myrepo/.github/workflows/build.yml@refs/heads/main \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  ghcr.io/myorg/myimage:v1.0.0

# 验证带通配符的证书身份
cosign verify \
  --certificate-identity-regexp=".*@mycompany.com$" \
  --certificate-oidc-issuer-regexp="https://accounts.google.com" \
  ghcr.io/myorg/myimage:v1.0.0

# 验证文件签名
cosign verify-blob \
  --key cosign.pub \
  --signature myartifact.sig \
  --certificate myartifact.cert \
  myartifact.tar.gz

# 使用无密钥签名验证 Blob
cosign verify-blob \
  --certificate-identity=[email protected] \
  --certificate-oidc-issuer=https://accounts.google.com \
  --signature myartifact.sig \
  --certificate myartifact.cert \
  myartifact.tar.gz

# 获取公共 Rekor 的日志信息
rekor-cli loginfo

# 输出示例：
# [rekor root hash]: 4b8e2b5a45e3abc...
# [tree size]: 534,218,392
# [tree ID]: 3747744012

# 获取 JSON 格式
rekor-cli loginfo --format=json

# 使用 API
curl -s https://rekor.sigstore.dev/api/v1/log | jq '{
  rootHash: .rootHash,
  treeSize: .treeSize,
  signedTreeHead: .signedTreeHead
}'

# 使用 API 获取签名的树头
curl -s https://rekor.sigstore.dev/api/v1/log | jq '.signedTreeHead'

# 验证树头签名（使用 Rekor 公钥）
# Rekor 的公钥可以通过 TUF 获取
cosign initialize
# 公钥缓存在 ~/.sigstore/root/ 目录下

{
  "treeSize": 534218392,
  "rootHash": "4b8e2b5a45e3abc...",
  "timestampNanos": 1704067200000000000,
  "signature": {
    "keyId": "rekor-signer-key",
    "algorithm": "ecdsa-sha2-nistp256",
    "value": "MEUCIQDx..."
  }
}

# 通过 rekor-cli 验证条目包含
rekor-cli verify --log-index=12345678

# 通过 API 获取包含证明
curl -s "https://rekor.sigstore.dev/api/v1/log/entries/<ENTRY_UUID>/proof" | jq '.'

# 获取条目详情（包含包含证明）
rekor-cli get --log-index=12345678 --format=json | jq '.verification.inclusionProof'

{
  "hashes": [
    "a1b2c3d4e5f6...",
    "b2c3d4e5f6a1...",
    "c3d4e5f6a1b2...",
    "d4e5f6a1b2c3...",
    "e5f6a1b2c3d4..."
  ],
  "logIndex": 12345678,
  "rootHash": "4b8e2b5a45e3abc...",
  "treeSize": 534218392,
  "checkpoint": {
    "envelope": "rekor.sigstore.dev ...\ntree size: 534218392\n..."
  }
}

#!/usr/bin/env python3
"""
手动验证 Rekor 包含证明
"""

import hashlib
import json
import sys
import requests

def sha256(data: bytes) -> bytes:
    return hashlib.sha256(data).digest()

def verify_inclusion_proof(
    leaf_hash: bytes,
    proof_hashes: list[bytes],
    log_index: int,
    root_hash: bytes,
) -> bool:
    """验证包含证明"""
    current_hash = leaf_hash
    index = log_index
    
    for sibling_hash in proof_hashes:
        if index % 2 == 0:
            current_hash = sha256(current_hash + sibling_hash)
        else:
            current_hash = sha256(sibling_hash + current_hash)
        index //= 2
    
    return current_hash == root_hash

def main():
    # 获取条目
    entry_uuid = sys.argv[1] if len(sys.argv) > 1 else None
    if not entry_uuid:
        print("Usage: python verify_inclusion.py <entry_uuid>")
        sys.exit(1)
    
    # 从 Rekor 获取条目
    resp = requests.get(
        f"https://rekor.sigstore.dev/api/v1/log/entries/{entry_uuid}"
    )
    entry = resp.json()
    
    # 提取包含证明
    proof = entry["verification"]["inclusionProof"]
    leaf_hash = bytes.fromhex(entry["body"])  # 简化处理
    
    # 验证
    proof_hashes = [bytes.fromhex(h) for h in proof["hashes"]]
    root_hash = bytes.fromhex(proof["rootHash"])
    
    result = verify_inclusion_proof(
        leaf_hash=sha256(leaf_hash.encode()),
        proof_hashes=proof_hashes,
        log_index=proof["logIndex"],
        root_hash=root_hash,
    )
    
    if result:
        print("✅ 包含证明验证成功")
    else:
        print("❌ 包含证明验证失败")
        sys.exit(1)

if __name__ == "__main__":
    main()

# 获取一致性证明（从树大小 firstSize 到 lastSize）
curl -s "https://rekor.sigstore.dev/api/v1/log/proof?firstSize=1000&lastSize=2000" | jq '.'

# 预期输出：
# {
#   "hashes": ["...", "...", ...],
#   "firstSize": 1000,
#   "lastSize": 2000
# }

def verify_consistency_proof(
    first_hash: bytes,      # 旧树根哈希
    second_hash: bytes,     # 新树根哈希
    first_size: int,        # 旧树大小
    second_size: int,       # 新树大小
    proof_hashes: list[bytes],  # 一致性证明哈希
) -> bool:
    """验证一致性证明"""
    # 使用 RFC 6962 中的验证算法
    # 简化实现，实际验证逻辑更复杂
    if first_size == second_size:
        return first_hash == second_hash
    
    if first_size > second_size:
        return False
    
    # ... 完整验证逻辑参见 RFC 6962
    # https://datatracker.ietf.org/doc/html/rfc6962#section-8.1
    pass

#!/bin/bash
# Rekor 日志审计脚本

set -e

REKOR_SERVER="https://rekor.sigstore.dev"
AUDIT_DIR="./rekor-audit-$(date +%Y%m%d)"
mkdir -p "$AUDIT_DIR"

echo "=== Rekor 日志审计 ==="
echo "审计目录: $AUDIT_DIR"

# 步骤 1: 记录当前日志状态
echo ">>> 步骤 1: 记录当前日志状态"
curl -s "$REKOR_SERVER/api/v1/log" | jq '.' > "$AUDIT_DIR/log-status.json"
cat "$AUDIT_DIR/log-status.json" | jq '{treeSize, rootHash}'

# 步骤 2: 获取日志信息
echo ">>> 步骤 2: 获取日志信息"
rekor-cli loginfo > "$AUDIT_DIR/loginfo.txt"
cat "$AUDIT_DIR/loginfo.txt"

# 步骤 3: 验证特定条目
echo ">>> 步骤 3: 验证条目"
ENTRY_INDEX=12345678
rekor-cli get --log-index=$ENTRY_INDEX --format=json > "$AUDIT_DIR/entry-$ENTRY_INDEX.json"
rekor-cli verify --log-index=$ENTRY_INDEX && echo "✅ 条目 $ENTRY_INDEX 包含证明验证通过" || echo "❌ 验证失败"

# 步骤 4: 记录审计时间戳
echo ">>> 步骤 4: 记录审计时间"
echo "审计时间: $(date -u '+%Y-%m-%d %H:%M:%S UTC')" > "$AUDIT_DIR/audit-timestamp.txt"
echo "审计员: $(whoami)" >> "$AUDIT_DIR/audit-timestamp.txt"

# 步骤 5: 生成审计报告
echo ">>> 步骤 5: 生成审计报告"
cat > "$AUDIT_DIR/audit-report.md" << EOF
# Rekor 审计报告

## 基本信息
- 审计时间: $(date -u '+%Y-%m-%d %H:%M:%S UTC')
- Rekor 服务器: $REKOR_SERVER
- 树大小: $(jq -r '.treeSize' "$AUDIT_DIR/log-status.json")
- 根哈希: $(jq -r '.rootHash' "$AUDIT_DIR/log-status.json")

## 验证结果
- 条目 $ENTRY_INDEX: $(rekor-cli verify --log-index=$ENTRY_INDEX 2>/dev/null && echo "✅ 通过" || echo "❌ 失败")
EOF

echo "=== 审计完成 ==="
echo "审计文件保存在: $AUDIT_DIR/"

#!/bin/bash
# 批量验证容器镜像签名

IMAGES=(
  "ghcr.io/myorg/app:v1.0.0"
  "ghcr.io/myorg/app:v1.1.0"
  "ghcr.io/myorg/service:latest"
  "ghcr.io/myorg/api:v2.0.0"
)

CERTIFICATE_IDENTITY="https://github.com/myorg/myrepo/.github/workflows/build.yml@refs/heads/main"
CERTIFICATE_OIDC_ISSUER="https://token.actions.githubusercontent.com"

PASS_COUNT=0
FAIL_COUNT=0

for image in "${IMAGES[@]}"; do
  echo -n "验证 $image ... "
  if cosign verify \
    --certificate-identity="$CERTIFICATE_IDENTITY" \
    --certificate-oidc-issuer="$CERTIFICATE_OIDC_ISSUER" \
    "$image" > /dev/null 2>&1; then
    echo "✅ 通过"
    ((PASS_COUNT++))
  else
    echo "❌ 失败"
    ((FAIL_COUNT++))
  fi
done

echo ""
echo "=== 验证结果 ==="
echo "通过: $PASS_COUNT"
echo "失败: $FAIL_COUNT"
echo "总计: ${#IMAGES[@]}"

if [ $FAIL_COUNT -gt 0 ]; then
  exit 1
fi

#!/bin/bash
# 批量验证文件签名

KEY_FILE="cosign.pub"
ARTIFACT_DIR="./artifacts"
SIG_DIR="./signatures"

PASS_COUNT=0
FAIL_COUNT=0

for artifact in "$ARTIFACT_DIR"/*.tar.gz; do
  basename=$(basename "$artifact")
  sig_file="$SIG_DIR/${basename}.sig"
  cert_file="$SIG_DIR/${basename}.cert"
  
  if [ ! -f "$sig_file" ]; then
    echo "⚠️  签名文件不存在: $sig_file"
    continue
  fi
  
  echo -n "验证 $basename ... "
  if cosign verify-blob \
    --key "$KEY_FILE" \
    --signature "$sig_file" \
    --certificate "$cert_file" \
    "$artifact" > /dev/null 2>&1; then
    echo "✅"
    ((PASS_COUNT++))
  else
    echo "❌"
    ((FAIL_COUNT++))
  fi
done

echo ""
echo "=== 结果: $PASS_COUNT 通过, $FAIL_COUNT 失败 ==="

#!/bin/bash
# 批量验证 Rekor 条目包含证明

INDICES=(12345678 12345679 12345680 12345681 12345682)

for index in "${INDICES[@]}"; do
  echo -n "验证条目 $index ... "
  if rekor-cli verify --log-index=$index > /dev/null 2>&1; then
    echo "✅"
  else
    echo "❌"
  fi
done

# 启用详细日志
COSIGN_EXPERIMENTAL=1 cosign verify \
  --certificate-identity=[email protected] \
  --certificate-oidc-issuer=https://accounts.google.com \
  --output=text \
  ghcr.io/myorg/myimage:v1.0.0 2>&1 | head -50

# 查看证书详情
cosign verify \
  --certificate-identity=[email protected] \
  --certificate-oidc-issuer=https://accounts.google.com \
  --output-certificate=/tmp/cert.pem \
  ghcr.io/myorg/myimage:v1.0.0

# 解析证书
openssl x509 -in /tmp/cert.pem -text -noout

# Kubernetes 验证策略示例
apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: image-verification-policy
spec:
  images:
    - glob: "ghcr.io/myorg/**"
  authorities:
    # 策略 1: 无密钥签名验证
    - keyless:
        url: https://fulcio.sigstore.dev
        identities:
          - issuer: https://token.actions.githubusercontent.com
            subjectRegExp: ".*myorg/myrepo.*"
      ctlog:
        url: https://rekor.sigstore.dev
      tuf:
        url: https://tuf-repo-cdn.sigstore.dev
    # 策略 2: 密钥签名验证（备选）
    - key:
        data: |
          -----BEGIN PUBLIC KEY-----
          MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
          -----END PUBLIC KEY-----