add GRPC interface #472

bobcallaway · 2022-03-12T16:52:05Z

This adds a GRPC interface to fulcio and moves the HTTP interface to be a wrapper around GRPC (via grpc-gateway) to ensure compatibility.

The purpose of this is to provide a simpler, cleaner interface for client code generation across sigstore libraries/services and other consumers. I am also looking to move Rekor over to a similar model but wanted to start here since the API is simpler.

Signed-off-by: Bob Callaway bcallaway@google.com

codecov-commenter · 2022-03-12T21:52:58Z

Codecov Report

Merging #472 (b57e30e) into main (2605dbf) will decrease coverage by 10.25%.
The diff coverage is 25.51%.

@@             Coverage Diff             @@
##             main     #472       +/-   ##
===========================================
- Coverage   43.91%   33.65%   -10.26%     
===========================================
  Files          16       18        +2     
  Lines        1273     1352       +79     
===========================================
- Hits          559      455      -104     
- Misses        633      834      +201     
+ Partials       81       63       -18

Impacted Files	Coverage Δ
pkg/api/client.go	`0.00% <0.00%> (-75.23%)`	⬇️
pkg/api/legacy_server.go	`0.00% <0.00%> (ø)`
pkg/api/version.go	`0.00% <0.00%> (ø)`
pkg/challenges/challenges.go	`21.47% <0.00%> (-1.55%)`	⬇️
pkg/api/grpc_server.go	`44.72% <44.72%> (ø)`
pkg/api/error.go	`100.00% <100.00%> (+50.00%)`	⬆️
pkg/ca/fileca/load.go	`68.96% <0.00%> (+10.34%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2605dbf...b57e30e. Read the comment docs.

dlorenc · 2022-03-13T00:19:26Z

This adds a GRPC interface to fulcio and moves the HTTP interface to be a wrapper around GRPC (via grpc-gateway) to ensure compatibility.

The purpose of this is to provide a simpler, cleaner interface for client code generation across sigstore libraries/services and other consumers. I am also looking to move Rekor over to a similar model but wanted to start here since the API is simpler.

Big +1, OpenAPI/swagger just don't add enough value for the complexity.

bobcallaway · 2022-03-13T18:42:24Z

@loosebazooka @mattmoor @dlorenc any chance I can get one of you to look at and/or recreate the failed test in kind outside of CI? I can't seem to reproduce it running locally (either with kind or docker-compose).

The error from the check-oidc job in the latest run is:

2022-03-13T18:32:08.144448806Z stderr F Generating ephemeral keys...
2022-03-13T18:32:08.14469571Z stderr F Retrieving signed certificate...
2022-03-13T18:32:08.759737048Z stderr F tlog entry created with index: 1651798
2022-03-13T18:32:08.75984375Z stderr F Error: signing [registry.local:5000/fulcio/fulcio-bd4d600f674b081a535a886a15cb8d9a@sha256:cb7bf620bb822701f48b440114f846a0aef307bab344346a7d676777467a2f88]: signing digest: error during PEM decoding
2022-03-13T18:32:08.759853651Z stderr F main.go:46: error during command execution: signing [registry.local:5000/fulcio/fulcio-bd4d600f674b081a535a886a15cb8d9a@sha256:cb7bf620bb822701f48b440114f846a0aef307bab344346a7d676777467a2f88]: signing digest: error during PEM decoding

I read this as: cosign's interaction with fulcio went fine (denoted by the fact we were successfully able to upload the signature to rekor), the failure seems to occur when adding the signature back to the registry for the container where there is some issue parsing the cert or the chain for the OCI signature.

I'm also able to query and parse the root cert for fulcio just fine:

[bcallawa@bcallawa-m900z cosign]$ curl -s http://127.0.0.1:5555/api/v1/rootCert | openssl x509 -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            b6:4d:00:f1:5d:c4:73:f0:8d:e0:e5:a0:3c:32:60:28:40:3b:fe
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: O = sigstore.dev, CN = sigstore
        Validity
            Not Before: Oct  7 13:56:59 2021 GMT
            Not After : Oct  5 13:56:58 2031 GMT
        Subject: O = sigstore.dev, CN = sigstore
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (384 bit)
                pub:
                    04:fb:5d:e1:53:e2:b6:f7:3d:01:b0:4b:82:1a:8e:
                    d2:e4:df:f3:a5:9e:98:1a:9e:06:81:72:56:29:b1:
                    80:6b:e6:2f:b8:ca:70:74:ed:c7:9b:dc:b3:f4:38:
                    83:99:77:17:b1:5f:af:5c:e6:25:6e:c8:94:50:f8:
                    7c:f4:e7:28:be:50:5d:ee:05:60:25:1e:98:92:e6:
                    c8:74:f8:7d:86:1c:4e:d2:5e:b9:35:10:2e:66:d5:
                    3a:f5:f4:bf:60:83:dd
                ASN1 OID: secp384r1
                NIST CURVE: P-384
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                58:C0:1E:5F:91:45:A5:66:A9:7A:CC:90:A1:93:22:D0:2A:C5:C5:FA
            X509v3 Authority Key Identifier: 
                keyid:58:C0:1E:5F:91:45:A5:66:A9:7A:CC:90:A1:93:22:D0:2A:C5:C5:FA

    Signature Algorithm: ecdsa-with-SHA384
         30:66:02:31:00:8f:59:c7:79:76:69:fb:5d:cd:58:13:5a:f8:
         40:ec:0c:ff:06:d5:65:a0:d6:d0:8c:58:ff:d6:1c:fa:a9:69:
         5a:34:8e:1b:30:78:d1:59:81:2b:34:78:4e:f0:60:8e:2a:02:
         31:00:d9:60:7d:a2:df:7c:b0:89:28:17:7b:d9:61:d7:77:fd:
         5b:56:07:96:fd:4c:d3:1e:6b:b2:31:fe:cb:49:e5:37:dc:2c:
         b7:80:04:b1:38:04:d2:4e:b1:0e:2f:9c:11:c9

mattmoor

Generally +1, but I didn't review it super thoroughly.

The dance we have to do for the weird content types some of the APIs use is unfortunate, but hopefully we can switch the main consumers to the GRPC path.

cc @nsmith5 @tstromberg

mattmoor · 2022-03-14T22:23:24Z

fulcio.proto

+    /**
+     * Returns information about the current state of the transparency log
+     */
+    rpc GetSigningCert(CertificateRequest) returns (CertificateResponse){
+        option (google.api.http) = {
+          post: "/api/v1/signingCert"
+          body: "*"
+        };
+    }


Can we document some of the custom response munging we have to do on the HTTP path? I could see folks naively trying to reimplement this proto API and having a bad time.

I could resurrect the old openapi.yaml doc and make sure it is up to date

Oh, I was just talking about in the rpc comment. Pretty sure you can generate swagger docs from these as well, although if I've done it it's been years...

pkg/api/error.go

fulcio.proto

haydentherapper · 2022-03-14T23:10:38Z

Left a bunch of API-specific comments. The main consumer annoyance I predict is around consuming a certificate chain. I think we should try to resolve that here with a repeated field.

Signed-off-by: Bob Callaway <bcallaway@google.com>

Signed-off-by: Bob Callaway <bob.callaway@gmail.com>

Signed-off-by: Bob Callaway <bcallaway@google.com>

nsmith5

Super awesome work ❤️ Really excited for this to land and mega kudos for not breaking the v1 API in the process. Extra special high-fives to wiring up the OIDC token into the context and passing context through to the CTlog client!

Feedback is just nits and questions for my own learning mostly

cmd/app/http.go

config/ctfe/root.pem

fulcio.proto

nsmith5 · 2022-03-29T17:21:24Z

fulcio.proto

+}
+
+enum PublicKeyAlgorithm {
+    PUBLIC_KEY_ALGORITHM_UNSPECIFIED = 0;


Question: Do we actually support anything outside ECDSA key-pairs right now? I've seen places around sigstore project where its sort of hard coded to ECDSA and wasn't sure if there is actually flexibility there

We support RSA, ECDSA, and ED25519 keys. There may be a couple lingering places in Cosign that still hardcode ECDSA, but most code paths should use the helper function from Sigstore that builds the signer/verifier regardless of type.

FWIW, this algorithm is ignored currently, the functions Fulcio calls can parse the key regardless of type.

Right right, is there even a need for this ever? What is the API even supposed to do if there is a mismatch? The alg type is always available in the public key anyways right?

pkg/ctl/ctl_logging.go

pkg/ctl/interface.go

Signed-off-by: Bob Callaway <bcallaway@google.com>

haydentherapper · 2022-03-30T03:46:11Z

cmd/app/serve.go

@@ -64,12 +66,31 @@ func newServeCmd() *cobra.Command {
 	cmd.Flags().String("fileca-key", "", "Path to CA encrypted private key")
 	cmd.Flags().String("fileca-key-passwd", "", "Password to decrypt CA private key")
 	cmd.Flags().Bool("fileca-watch", true, "Watch filesystem for updates")
-	cmd.Flags().String("host", "0.0.0.0", "The host on which to serve requests")
-	cmd.Flags().String("port", "8080", "The port on which to serve requests")
+	cmd.Flags().String("host", "0.0.0.0", "The host on which to serve requests for HTTP; --http-host is alias")


What handles routing to the correct host? Is Nginx/Kubernetes aware of if the request is a GRPC or HTTP request?

two lines below, there is a separate listener on a different port for grpc requests VS http requests.

I was wondering what handles routing, since both will be accessible from https://fulcio.sigstore.dev

Nginx should be able to handle it

cmd/app/serve.go

config/logid.sh

fulcio.proto

pkg/api/legacy_server.go

.github/workflows/verify-k8s.yml

lukehinds · 2022-03-30T08:21:01Z

cmd/app/http.go

+	if legacyGRPCServer != nil {
+		endpoint := fmt.Sprintf("unix:%v", legacyGRPCServer.grpcServerEndpoint)
+		if err := legacy_gw.RegisterCAHandlerFromEndpoint(ctx, mux, endpoint, opts); err != nil {
+			log.Logger.Fatal(err)
+		}
+	}


What determines if legacyGRPCServer is set , does this bubble up from config?

it doesn't bubble up from config (yet), but if we wanted to deprecate and turn that off we could just set it to nil

gotcha, I was thinking there might be a flag/config leveraged that would decide on what runs (restAPI or gPRC (or even both)).

hmm, interesting thought. let me noodle on that for a bit.

fulcio.proto

Signed-off-by: Bob Callaway <bcallaway@google.com>

config/logid.sh

nsmith5

❤️ Looks good to me!

fulcio.proto

config/logid.sh

pkg/api/client.go

pkg/api/grpc_server.go

dlorenc · 2022-04-12T23:02:30Z

I'm happy with this whenever you're all ready for the merge!

Signed-off-by: Bob Callaway <bcallaway@google.com>

dlorenc · 2022-04-13T23:52:18Z

Merge when ready!

Signed-off-by: Bob Callaway <bcallaway@google.com>

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

Also renames Fulcio Client -> LegacyClient in response to sigstore/fulcio#472 (we can switch to the gRPC client in another PR).

Also renames Fulcio Client -> LegacyClient in response to sigstore/fulcio#472 (we can switch to the gRPC client in another PR). Signed-off-by: Billy Lynch <billy@chainguard.dev>

bobcallaway requested review from loosebazooka and mattmoor March 12, 2022 16:52

mattmoor reviewed Mar 14, 2022

View reviewed changes

haydentherapper reviewed Mar 14, 2022

View reviewed changes

bobcallaway and others added 9 commits March 29, 2022 12:53

initial grpc impl

3a373cd

Signed-off-by: Bob Callaway <bcallaway@google.com>

fix cmd line arg with viper alias

89720ae

Signed-off-by: Bob Callaway <bcallaway@google.com>

add debugging, install protoc via apt

37d7f4b

Signed-off-by: Bob Callaway <bcallaway@google.com>

remove debugging and trailing newline

9ac8334

Signed-off-by: Bob Callaway <bcallaway@google.com>

write header and value together

caf3d61

Signed-off-by: Bob Callaway <bcallaway@google.com>

fix docker-compose, revert last fix

eb728b7

Signed-off-by: Bob Callaway <bob.callaway@gmail.com>

fix logging, add grpc mw

44ae7d8

Signed-off-by: Bob Callaway <bcallaway@google.com>

update protobuf defs, implement legacy interface

0ec96a9

Signed-off-by: Bob Callaway <bcallaway@google.com>

fix spacing

a945daa

Signed-off-by: Bob Callaway <bcallaway@google.com>

bobcallaway force-pushed the grpc branch from dba5995 to a945daa Compare March 29, 2022 16:54

use abstract unix domain socket

48fe1c7

Signed-off-by: Bob Callaway <bcallaway@google.com>

nsmith5 approved these changes Mar 29, 2022

View reviewed changes

haydentherapper mentioned this pull request Mar 29, 2022

gRPC interface #492

Closed

bobcallaway added 5 commits March 29, 2022 15:21

send 201 and SCT with response

28b18e6

Signed-off-by: Bob Callaway <bcallaway@google.com>

address code review comments

d877c0f

Signed-off-by: Bob Callaway <bcallaway@google.com>

debugging k8s failure

b64354c

Signed-off-by: Bob Callaway <bcallaway@google.com>

trim space on chain before sending

310e054

Signed-off-by: Bob Callaway <bcallaway@google.com>

trim space on CSC call as well

415bcd1

Signed-off-by: Bob Callaway <bcallaway@google.com>

haydentherapper reviewed Mar 30, 2022

View reviewed changes

lukehinds reviewed Mar 30, 2022

View reviewed changes

bobcallaway commented Mar 30, 2022

View reviewed changes

fulcio.proto Outdated Show resolved Hide resolved

fix prom and address review comments

1b86826

Signed-off-by: Bob Callaway <bcallaway@google.com>

haydentherapper reviewed Apr 11, 2022

View reviewed changes

config/logid.sh Outdated Show resolved Hide resolved

nsmith5 approved these changes Apr 12, 2022

View reviewed changes

haydentherapper reviewed Apr 12, 2022

View reviewed changes

bobcallaway added 2 commits April 12, 2022 19:09

address review comments

921c124

Signed-off-by: Bob Callaway <bcallaway@google.com>

commit generated file

64ce8f1

Signed-off-by: Bob Callaway <bcallaway@google.com>

dlorenc approved these changes Apr 13, 2022

View reviewed changes

Merge remote-tracking branch 'upstream/main' into grpc

01a7c33

Signed-off-by: Bob Callaway <bcallaway@google.com>

dlorenc approved these changes Apr 13, 2022

View reviewed changes

Merge remote-tracking branch 'upstream/main' into grpc

2dcae0a

Signed-off-by: Bob Callaway <bcallaway@google.com>

dlorenc approved these changes Apr 14, 2022

View reviewed changes

opt for message with 0 fields over empty for forward compatibility

b57e30e

Signed-off-by: Bob Callaway <bcallaway@google.com>

bobcallaway merged commit d464219 into sigstore:main Apr 14, 2022

k4leung4 added a commit to k4leung4/scaffolding that referenced this pull request Apr 19, 2022

Updated ctlog config to include CodeSigning usage.

2c00a0c

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

k4leung4 added a commit to k4leung4/scaffolding that referenced this pull request Apr 19, 2022

Updated ctlog config to include CodeSigning usage.

ce18853

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

k4leung4 mentioned this pull request Apr 19, 2022

Updated ctlog config to include CodeSigning usage. sigstore/scaffolding#125

Merged

k4leung4 added a commit to k4leung4/scaffolding that referenced this pull request Apr 19, 2022

Updated ctlog config to include CodeSigning usage.

6e52980

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

k4leung4 added a commit to k4leung4/scaffolding that referenced this pull request Apr 20, 2022

Updated ctlog config to include CodeSigning usage.

bbe2a3d

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

k4leung4 added a commit to k4leung4/scaffolding that referenced this pull request Apr 20, 2022

Updated ctlog config to include CodeSigning usage.

b18f961

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

k4leung4 added a commit to k4leung4/scaffolding that referenced this pull request Apr 20, 2022

Updated ctlog config to include CodeSigning usage.

9e0fa3a

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

k4leung4 added a commit to k4leung4/scaffolding that referenced this pull request Apr 20, 2022

Updated ctlog config to include CodeSigning usage.

0ec1154

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

k4leung4 added a commit to k4leung4/scaffolding that referenced this pull request Apr 20, 2022

Updated ctlog config to include CodeSigning usage.

8cc485e

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

k4leung4 added a commit to k4leung4/scaffolding that referenced this pull request Apr 20, 2022

Updated ctlog config to include CodeSigning usage.

5c91622

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

vaikas pushed a commit to sigstore/scaffolding that referenced this pull request Apr 20, 2022

Updated ctlog config to include CodeSigning usage. (#125)

6011614

This mirrors the change from sigstore/fulcio#472 Signed-off-by: Kenny Leung <kleung@chainguard.dev>

wlynch added a commit to wlynch/gitsign that referenced this pull request Sep 20, 2022

Bump cosign to 1.12.

a6a2f10

Also renames Fulcio Client -> LegacyClient in response to sigstore/fulcio#472 (we can switch to the gRPC client in another PR).

wlynch mentioned this pull request Sep 20, 2022

Bump cosign to 1.12. sigstore/gitsign#140

Merged

wlynch added a commit to wlynch/gitsign that referenced this pull request Sep 20, 2022

Bump cosign to 1.12.

ffa34a2

Also renames Fulcio Client -> LegacyClient in response to sigstore/fulcio#472 (we can switch to the gRPC client in another PR). Signed-off-by: Billy Lynch <billy@chainguard.dev>

priyawadhwa mentioned this pull request Dec 20, 2022

Add in --duplex flag to run HTTP and GRPC servers on the same port #931

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add GRPC interface #472

add GRPC interface #472

bobcallaway commented Mar 12, 2022 •

edited

Loading

codecov-commenter commented Mar 12, 2022 •

edited

Loading

dlorenc commented Mar 13, 2022

bobcallaway commented Mar 13, 2022

mattmoor left a comment

mattmoor Mar 14, 2022

bobcallaway Mar 15, 2022

mattmoor Mar 17, 2022

haydentherapper commented Mar 14, 2022

nsmith5 left a comment

nsmith5 Mar 29, 2022

haydentherapper Mar 29, 2022

nsmith5 Mar 29, 2022

haydentherapper Mar 30, 2022

bobcallaway Mar 30, 2022

haydentherapper Mar 30, 2022

bobcallaway Mar 30, 2022

lukehinds Mar 30, 2022

bobcallaway Mar 30, 2022

lukehinds Mar 30, 2022

bobcallaway Mar 30, 2022

nsmith5 left a comment

dlorenc commented Apr 12, 2022

dlorenc commented Apr 13, 2022

add GRPC interface #472

add GRPC interface #472

Conversation

bobcallaway commented Mar 12, 2022 • edited Loading

codecov-commenter commented Mar 12, 2022 • edited Loading

Codecov Report

dlorenc commented Mar 13, 2022

bobcallaway commented Mar 13, 2022

mattmoor left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

haydentherapper commented Mar 14, 2022

nsmith5 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nsmith5 left a comment

Choose a reason for hiding this comment

dlorenc commented Apr 12, 2022

dlorenc commented Apr 13, 2022

bobcallaway commented Mar 12, 2022 •

edited

Loading

codecov-commenter commented Mar 12, 2022 •

edited

Loading