Make the tuf init script properly add sigstore targets (#34)

.github/workflows/trust-root-test.yml

@@ -0,0 +1,38 @@
+name: Trust root init test
+on:
+  pull_request:
+    paths-ignore:
+      - "**.md"
+      - ".github/dependabot.yml"
+    branches: [develop]
+
+env:
+  # From-scratch builds with incremental compilation enabled adds unneeded performance and disk overhead.
+  CARGO_INCREMENTAL: "0"
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/cache@v4
+        with:
+          path: |
+            .cargo
+          # you can edit the .github/cache_bust file if you need to clear the cache
+          key: ${{ hashFiles('.github/cache_bust') }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ hashFiles('.github/cache_bust') }}
+      - run: rustup default stable
+      # This directory should already be in PATH for the default Github Action runners, but might not exist
+      - run: mkdir -p ${HOME}/.local/bin/
+      - run: cargo build --release && cp target/release/tuftool ${HOME}/.local/bin/
+      - run: |
+          ./rhtas/tuf-repo-init.sh --export-keys file:///tmp/exported-keys \
+            --fulcio-cert ./rhtas/test/fulcio-cert \
+            --tsa-cert ./rhtas/test/tsa-chain \
+            --ctlog-key ./rhtas/test/ctfe-pubkey \
+            --rekor-key ./rhtas/test/rekor-pubkey \
+            /tmp/testrepo
+      - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64" && mv cosign-linux-amd64 ${HOME}/.local/bin/cosign && sudo chmod +x ${HOME}/.local/bin/cosign
+      - run: cosign -d initialize --mirror=file:///tmp/testrepo --root=/tmp/testrepo/root.json

rhtas/test/ctfe-pubkey

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEH5dkcOcxAE1xrwPYTZymyAmgCiY9
+hbdIDwd72dRczxbLt5jKybHmZqZe7LZXYTjZAsMXFTd6fIzAyTKX0ayGqQ==
+-----END PUBLIC KEY-----

rhtas/test/fulcio-cert

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMw
+KjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y
+MjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3Jl
+LmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV7
+7LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS
+0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYB
+BQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjp
+KFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZI
+zj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJR
+nZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsP
+mygUY7Ii2zbdCdliiow=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMw
+KjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0y
+MTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3Jl
+LmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7
+XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxex
+X69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92j
+YzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRY
+wB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQ
+KsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCM
+WP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9
+TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ
+-----END CERTIFICATE-----

rhtas/test/rekor-pubkey

@@ -0,0 +1,13 @@
+-----BEGIN RSA PUBLIC KEY-----
+MIICCgKCAgEAu1Ah4n2P8JGt92Qg86FdR8f1pou43yndggMuRCX0JB+bLn1rUFRA
+KQVd+xnnd4PXJLLdml8ZohCr0lhBuMxZ7zBzt0T98kblUCxBgABPNpWIkTgacyC8
+MlIYY/yBSuDWAJOA5IKi4Hh9nI+Mmb/FXgbOz5a5mZx8w7pMiTMu0+Rd9cPzRkUZ
+DQfZsLONr6PwmyCAIL1oK80fevxKZPME0UV8bFPWnRxeVaFr5ddd/DOenV8H6SPy
+r4ODbSOItpl53y6Az0m3FTIUf8cSsyR7dfE4zpA3M4djjtoKDNFRsTjU2RWVQW9X
+MaxzznGVGhLEwkC+sYjR5NQvH5iiRvV18q+CGQqNX2+WWM3SPuty3nc86RBNR0FO
+gSQA0TL2OAs6bJNmfzcwZxAKYbj7/88tj6qrjLaQtFTbBm2a7+TAQfs3UTiQi00z
+EDYqeSj2WQvacNm1dWEAyx0QNLHiKGTn4TShGj8LUoGyjJ26Y6VPsotvCoj8jM0e
+aN8Pc9/AYywVI+QktjaPZa7KGH3XJHJkTIQQRcUxOtDstKpcriAefDs8jjL5ju9t
+5J3qEvgzmclNJKRnla4p3maM0vk+8cC7EXMV4P1zuCwr3akaHFJo5Y0aFhKsnHqT
+c70LfiFo//8/QsvyjLIUtEWHTkGeuf4PpbYXr5qpJ6tWhG2MARxdeg8CAwEAAQ==
+-----END RSA PUBLIC KEY-----

rhtas/test/tsa-chain

@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIB3DCCAWKgAwIBAgIUchkNsH36Xa04b1LqIc+qr9DVecMwCgYIKoZIzj0EAwMw
+MjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgaW50ZXJtZWRp
+YXRlMB4XDTIzMDQxNDAwMDAwMFoXDTI0MDQxMzAwMDAwMFowMjEVMBMGA1UEChMM
+R2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgVGltZXN0YW1waW5nMFkwEwYHKoZI
+zj0CAQYIKoZIzj0DAQcDQgAEUD5ZNbSqYMd6r8qpOOEX9ibGnZT9GsuXOhr/f8U9
+FJugBGExKYp40OULS0erjZW7xV9xV52NnJf5OeDq4e5ZKqNWMFQwDgYDVR0PAQH/
+BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMIMAwGA1UdEwEB/wQCMAAwHwYDVR0j
+BBgwFoAUaW1RudOgVt0leqY0WKYbuPr47wAwCgYIKoZIzj0EAwMDaAAwZQIwbUH9
+HvD4ejCZJOWQnqAlkqURllvu9M8+VqLbiRK+zSfZCZwsiljRn8MQQRSkXEE5AjEA
+g+VxqtojfVfu8DhzzhCx9GKETbJHb19iV72mMKUbDAFmzZ6bQ8b54Zb8tidy5aWe
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICEDCCAZWgAwIBAgIUX8ZO5QXP7vN4dMQ5e9sU3nub8OgwCgYIKoZIzj0EAwMw
+ODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2
+aWNlcyBSb290MB4XDTIzMDQxNDAwMDAwMFoXDTI4MDQxMjAwMDAwMFowMjEVMBMG
+A1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgaW50ZXJtZWRpYXRlMHYw
+EAYHKoZIzj0CAQYFK4EEACIDYgAEvMLY/dTVbvIJYANAuszEwJnQE1llftynyMKI
+Mhh48HmqbVr5ygybzsLRLVKbBWOdZ21aeJz+gZiytZetqcyF9WlER5NEMf6JV7ZN
+ojQpxHq4RHGoGSceQv/qvTiZxEDKo2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0T
+AQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUaW1RudOgVt0leqY0WKYbuPr47wAwHwYD
+VR0jBBgwFoAU9NYYlobnAG4c0/qjxyH/lq/wz+QwCgYIKoZIzj0EAwMDaQAwZgIx
+AK1B185ygCrIYFlIs3GjswjnwSMG6LY8woLVdakKDZxVa8f8cqMs1DhcxJ0+09w9
+5QIxAO+tBzZk7vjUJ9iJgD4R6ZWTxQWKqNm74jO99o+o9sv4FI/SZTZTFyMn0IJE
+HdNmyA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIB9DCCAXqgAwIBAgIUa/JAkdUjK4JUwsqtaiRJGWhqLSowCgYIKoZIzj0EAwMw
+ODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2
+aWNlcyBSb290MB4XDTIzMDQxNDAwMDAwMFoXDTMzMDQxMTAwMDAwMFowODEVMBMG
+A1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBS
+b290MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEf9jFAXxz4kx68AHRMOkFBhflDcMT
+vzaXz4x/FCcXjJ/1qEKon/qPIGnaURskDtyNbNDOpeJTDDFqt48iMPrnzpx6IZwq
+emfUJN4xBEZfza+pYt/iyod+9tZr20RRWSv/o0UwQzAOBgNVHQ8BAf8EBAMCAQYw
+EgYDVR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQU9NYYlobnAG4c0/qjxyH/lq/w
+z+QwCgYIKoZIzj0EAwMDaAAwZQIxALZLZ8BgRXzKxLMMN9VIlO+e4hrBnNBgF7tz
+7Hnrowv2NetZErIACKFymBlvWDvtMAIwZO+ki6ssQ1bsZo98O8mEAf2NZ7iiCgDD
+U0Vwjeco6zyeh0zBTs9/7gV6AHNQ53xD
+-----END CERTIFICATE-----

rhtas/tuf-repo-init.sh

@@ -139,26 +139,7 @@ echo "Signing the root file ${ROOT} ..."
 # sign root
 tuftool root sign "${ROOT}" -k "${KEYDIR}/root.pem"
 
-echo "Preparing targets in ${INPUTDIR} ..."
-
-# prepare targets
-if [ -n "${FULCIO_CERT}" ]; then
-  cp "${FULCIO_CERT}" "${INPUTDIR}"
-fi
-
-if [ -n "${TSA_CERT}" ]; then
-  cp "${TSA_CERT}" "${INPUTDIR}"
-fi
-
-if [ -n "${CTLOG_KEY}" ]; then
-  cp "${CTLOG_KEY}" "${INPUTDIR}"
-fi
-
-if [ -n "${REKOR_KEY}" ]; then
-  cp "${REKOR_KEY}" "${INPUTDIR}"
-fi
-
-echo "Creating repository with targets: $(ls -m "${INPUTDIR}") ..."
+echo "Initializing empty repository in ${OUTDIR} ..."
 
 # create the repo
 tuftool create \
@@ -176,6 +157,85 @@ tuftool create \
   --timestamp-version 1 \
   --outdir "${OUTDIR}"
 
+echo "Adding trust root targets ..."
+
+# prepare targets
+if [ -n "${FULCIO_CERT}" ]; then
+  echo "Adding Fulcio certificate chain ${FULCIO_CERT} ..."
+  tuftool rhtas \
+    --root "${ROOT}" \
+    --key "${KEYDIR}/snapshot.pem" \
+    --key "${KEYDIR}/targets.pem" \
+    --key "${KEYDIR}/timestamp.pem" \
+    --set-fulcio-target "${FULCIO_CERT}" \
+    --fulcio-uri "https://fulcio.rhtas" \
+    --targets-expires "${METADATA_EXPIRATION}" \
+    --targets-version 1 \
+    --snapshot-expires "${METADATA_EXPIRATION}" \
+    --snapshot-version 1 \
+    --timestamp-expires "${METADATA_EXPIRATION}" \
+    --timestamp-version 1 \
+    --outdir "${OUTDIR}" \
+    --metadata-url "file://${OUTDIR}"
+fi
+
+if [ -n "${TSA_CERT}" ]; then
+  echo "Adding TSA certificate chain ${TSA_CERT} ..."
+  tuftool rhtas \
+    --root "${ROOT}" \
+    --key "${KEYDIR}/snapshot.pem" \
+    --key "${KEYDIR}/targets.pem" \
+    --key "${KEYDIR}/timestamp.pem" \
+    --set-tsa-target "${TSA_CERT}" \
+    --tsa-uri "https://tsa.rhtas" \
+    --targets-expires "${METADATA_EXPIRATION}" \
+    --targets-version 1 \
+    --snapshot-expires "${METADATA_EXPIRATION}" \
+    --snapshot-version 1 \
+    --timestamp-expires "${METADATA_EXPIRATION}" \
+    --timestamp-version 1 \
+    --outdir "${OUTDIR}" \
+    --metadata-url "file://${OUTDIR}"
+fi
+
+if [ -n "${CTLOG_KEY}" ]; then
+  echo "Adding CTLog public key ${CTLOG_KEY} ..."
+  tuftool rhtas \
+    --root "${ROOT}" \
+    --key "${KEYDIR}/snapshot.pem" \
+    --key "${KEYDIR}/targets.pem" \
+    --key "${KEYDIR}/timestamp.pem" \
+    --set-ctlog-target "${CTLOG_KEY}" \
+    --ctlog-uri "https://ctlog.rhtas" \
+    --targets-expires "${METADATA_EXPIRATION}" \
+    --targets-version 1 \
+    --snapshot-expires "${METADATA_EXPIRATION}" \
+    --snapshot-version 1 \
+    --timestamp-expires "${METADATA_EXPIRATION}" \
+    --timestamp-version 1 \
+    --outdir "${OUTDIR}" \
+    --metadata-url "file://${OUTDIR}"
+fi
+
+if [ -n "${REKOR_KEY}" ]; then
+  echo "Adding Rekor public key ${REKOR_KEY} ..."
+  tuftool rhtas \
+    --root "${ROOT}" \
+    --key "${KEYDIR}/snapshot.pem" \
+    --key "${KEYDIR}/targets.pem" \
+    --key "${KEYDIR}/timestamp.pem" \
+    --set-rekor-target "${REKOR_KEY}" \
+    --fulcio-uri "https://rekor.rhtas" \
+    --targets-expires "${METADATA_EXPIRATION}" \
+    --targets-version 1 \
+    --snapshot-expires "${METADATA_EXPIRATION}" \
+    --snapshot-version 1 \
+    --timestamp-expires "${METADATA_EXPIRATION}" \
+    --timestamp-version 1 \
+    --outdir "${OUTDIR}" \
+    --metadata-url "file://${OUTDIR}"
+fi
+
 if [ "${EXPORT_KEYS:0:7}" = "file://" ]; then
   export EXPORT_DIR=${EXPORT_KEYS:7}
   echo "Exporting keys to directory ${EXPORT_DIR} ..."