verify.go

/*
   Copyright Docker attest authors

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
*/

package attest

import (
	"context"
	"fmt"
	"os"
	"path/filepath"
	"strings"
	"time"

	"github.com/distribution/reference"
	"github.com/docker/attest/attestation"
	"github.com/docker/attest/mapping"
	"github.com/docker/attest/oci"
	"github.com/docker/attest/policy"
	"github.com/docker/attest/tuf"
	"github.com/docker/attest/version"
	intoto "github.com/in-toto/in-toto-golang/in_toto"
)

type ImageVerifier struct {
	opts                *policy.Options
	tufClient           tuf.Downloader
	attestationVerifier attestation.Verifier
	versionFetcher      version.Fetcher
}

func NewImageVerifier(ctx context.Context, opts *policy.Options) (*ImageVerifier, error) {
	err := populateDefaultOptions(opts)
	if err != nil {
		return nil, err
	}
	var tufClient tuf.Downloader
	if !opts.DisableTUF {
		tufClient, err = tuf.NewClient(ctx, opts.TUFClientOptions)
		if err != nil {
			return nil, fmt.Errorf("failed to create TUF client: %w", err)
		}
	}
	attestationVerifier := opts.AttestationVerifier
	if attestationVerifier == nil {
		attestationVerifier, err = attestation.NewVerfier(attestation.WithTUFDownloader(tufClient))
		if err != nil {
			return nil, fmt.Errorf("failed to create attestation verifier: %w", err)
		}
	}
	return &ImageVerifier{
		opts:                opts,
		tufClient:           tufClient,
		attestationVerifier: attestationVerifier,
		versionFetcher:      version.NewGoVersionFetcher(),
	}, nil
}

func (verifier *ImageVerifier) Verify(ctx context.Context, src *oci.ImageSpec) (result *VerificationResult, err error) {
	// so that we can resolve mapping from the image name earlier
	detailsResolver, err := policy.CreateImageDetailsResolver(src)
	if err != nil {
		return nil, fmt.Errorf("failed to create image details resolver: %w", err)
	}
	imageName, err := detailsResolver.ImageName(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to resolve image name: %w", err)
	}
	policyResolver := policy.NewResolver(verifier.tufClient, verifier.opts)

	platform, err := detailsResolver.ImagePlatform(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get image platform: %w", err)
	}
	resolvedPolicy, err := policyResolver.ResolvePolicy(ctx, imageName, platform)
	if err != nil {
		return nil, fmt.Errorf("failed to resolve policy: %w", err)
	}

	if resolvedPolicy == nil {
		return &VerificationResult{
			Outcome: OutcomeNoPolicy,
		}, nil
	}
	// this is overriding the mapping with a referrers config. Useful for testing if nothing else
	if verifier.opts.ReferrersRepo != "" {
		resolvedPolicy.Mapping.Attestations = &mapping.AttestationConfig{
			Repo:  verifier.opts.ReferrersRepo,
			Style: mapping.AttestationStyleReferrers,
		}
	} else if verifier.opts.AttestationStyle == mapping.AttestationStyleAttached {
		resolvedPolicy.Mapping.Attestations = &mapping.AttestationConfig{
			Repo:  verifier.opts.ReferrersRepo,
			Style: mapping.AttestationStyleAttached,
		}
	}
	// because we have a mapping now, we can select a resolver based on its contents (ie. referrers or attached)
	resolver, err := policy.CreateAttestationResolver(detailsResolver, resolvedPolicy.Mapping)
	if err != nil {
		return nil, fmt.Errorf("failed to create attestation resolver: %w", err)
	}
	evaluator := policy.NewRegoEvaluator(verifier.opts.Debug, verifier.attestationVerifier)
	result, err = verifier.verifyAttestations(ctx, resolver, evaluator, resolvedPolicy)
	if err != nil {
		return nil, fmt.Errorf("failed to evaluate policy: %w", err)
	}
	return result, nil
}

func Verify(ctx context.Context, src *oci.ImageSpec, opts *policy.Options) (result *VerificationResult, err error) {
	verifier, err := NewImageVerifier(ctx, opts)
	if err != nil {
		return nil, err
	}
	return verifier.Verify(ctx, src)
}

func populateDefaultOptions(opts *policy.Options) (err error) {
	if opts.LocalPolicyDir == "" && opts.DisableTUF {
		return fmt.Errorf("local policy dir must be set if not using TUF")
	}
	if opts.LocalTargetsDir == "" {
		opts.LocalTargetsDir, err = defaultLocalTargetsDir()
		if err != nil {
			return err
		}
	}
	if opts.DisableTUF && opts.TUFClientOptions != nil {
		return fmt.Errorf("TUF client options set but TUF disabled")
	} else if opts.TUFClientOptions == nil && !opts.DisableTUF {
		opts.TUFClientOptions = tuf.NewDockerDefaultClientOptions(opts.LocalTargetsDir)
	}

	if opts.AttestationStyle == "" {
		opts.AttestationStyle = mapping.AttestationStyleReferrers
	}
	if opts.ReferrersRepo != "" && opts.AttestationStyle != mapping.AttestationStyleReferrers {
		return fmt.Errorf("referrers repo specified but attestation source not set to referrers")
	}
	return nil
}

func defaultLocalTargetsDir() (string, error) {
	homeDir, err := os.UserHomeDir()
	if err != nil {
		return "", fmt.Errorf("failed to get user home directory: %w", err)
	}
	return filepath.Join(homeDir, ".docker", "tuf"), nil
}

func toVerificationResult(p *policy.Policy, input *policy.Input, result *policy.Result, versionFetcher version.Fetcher) (*VerificationResult, error) {
	dgst, err := oci.SplitDigest(input.Digest)
	if err != nil {
		return nil, fmt.Errorf("failed to split digest: %w", err)
	}
	subject := intoto.Subject{
		Name:   input.PURL,
		Digest: dgst,
	}
	resourceURI, err := attestation.ToVSAResourceURI(subject)
	if err != nil {
		return nil, fmt.Errorf("failed to create resource uri: %w", err)
	}

	var outcome Outcome
	if result.Success {
		outcome = OutcomeSuccess
	} else {
		outcome = OutcomeFailure
	}

	outcomeStr, err := outcome.StringForVSA()
	if err != nil {
		return nil, err
	}

	vsaPolicy := attestation.VSAPolicy{URI: result.Summary.PolicyURI, DownloadLocation: p.URI, Digest: p.Digest}
	attestVersion, err := attestation.GetVerifierVersion(versionFetcher)
	if err != nil {
		return nil, fmt.Errorf("failed to get verifier version: %w", err)
	}

	return &VerificationResult{
		Policy:     p,
		Outcome:    outcome,
		Violations: result.Violations,
		Input:      input,
		VSA: &intoto.Statement{
			StatementHeader: intoto.StatementHeader{
				PredicateType: attestation.VSAPredicateType,
				Type:          intoto.StatementInTotoV01,
				Subject:       result.Summary.Subjects,
			},
			Predicate: attestation.VSAPredicate{
				Verifier: attestation.VSAVerifier{
					ID:      result.Summary.Verifier,
					Version: attestVersion,
				},
				TimeVerified:       time.Now().UTC().Format(time.RFC3339),
				ResourceURI:        resourceURI,
				Policy:             vsaPolicy,
				VerificationResult: outcomeStr,
				VerifiedLevels:     result.Summary.SLSALevels,
				InputAttestations:  result.Summary.Inputs,
			},
		},
	}, nil
}

func (verifier *ImageVerifier) verifyAttestations(ctx context.Context, resolver attestation.Resolver, evaluator policy.Evaluator, resolvedPolicy *policy.Policy) (*VerificationResult, error) {
	desc, err := resolver.ImageDescriptor(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get image descriptor: %w", err)
	}
	digest := desc.Digest.String()
	name, err := resolver.ImageName(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get image name: %w", err)
	}
	platform, err := resolver.ImagePlatform(ctx)
	if err != nil {
		return nil, err
	}

	if resolvedPolicy.ResolvedName != "" {
		// this means the name we have is not the one we want to use for policy evaluation
		// so we need to replace it with the one we resolved during policy resolution.
		// this can happen if the name is an alias for another image, e.g. if it is a mirror
		ref, err := reference.ParseNormalizedNamed(name)
		if err != nil {
			return nil, fmt.Errorf("failed to parse image name: %w", err)
		}
		oldName := ref.Name()
		name = strings.Replace(name, oldName, resolvedPolicy.ResolvedName, 1)
		resolver = WithImageName(resolver, resolvedPolicy.ResolvedName)
	}

	ref, err := reference.ParseNormalizedNamed(name)
	if err != nil {
		return nil, fmt.Errorf("failed to parse ref %q: %w", ref, err)
	}
	purl, canonical, err := oci.RefToPURL(ref, platform)
	if err != nil {
		return nil, fmt.Errorf("failed to convert ref to purl: %w", err)
	}
	var tag string
	if !canonical {
		// unlike the function name indicates, this adds latest if no tag is present
		ref = reference.TagNameOnly(ref)
	}

	if tagged, ok := ref.(reference.Tagged); ok {
		tag = tagged.Tag()
	}
	input := &policy.Input{
		Digest:         digest,
		PURL:           purl,
		Platform:       platform.String(),
		Domain:         reference.Domain(ref),
		NormalizedName: reference.Path(ref),
		FamiliarName:   reference.FamiliarName(ref),
		Parameters:     verifier.opts.Parameters,
	}
	// rego has null strings
	if tag != "" {
		input.Tag = tag
	}
	result, err := evaluator.Evaluate(ctx, resolver, resolvedPolicy, input)
	if err != nil {
		return nil, fmt.Errorf("policy evaluation failed: %w", err)
	}
	verificationResult, err := toVerificationResult(resolvedPolicy, input, result, verifier.versionFetcher)
	if err != nil {
		return nil, fmt.Errorf("failed to convert to policy result: %w", err)
	}
	verificationResult.SubjectDescriptor = desc
	return verificationResult, nil
}

// WithImageName returns a new resolver that will return the given image name as this can be updated by the mapping file.
func WithImageName(resolver attestation.Resolver, s string) attestation.Resolver {
	return &wrappedResolver{
		Resolver:  resolver,
		imageName: s,
	}
}