|
|
|
@ -28,52 +28,6 @@ option objc_class_prefix = "GRA"; |
|
|
|
|
message BuildNote { |
|
|
|
|
// Required. Immutable. Version of the builder which produced this build. |
|
|
|
|
string builder_version = 1; |
|
|
|
|
|
|
|
|
|
// Signature of the build in occurrences pointing to this build note |
|
|
|
|
// containing build details. |
|
|
|
|
BuildSignature signature = 2; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// Message encapsulating the signature of the verified build. |
|
|
|
|
message BuildSignature { |
|
|
|
|
// Public key of the builder which can be used to verify that the related |
|
|
|
|
// findings are valid and unchanged. If `key_type` is empty, this defaults |
|
|
|
|
// to PEM encoded public keys. |
|
|
|
|
// |
|
|
|
|
// This field may be empty if `key_id` references an external key. |
|
|
|
|
// |
|
|
|
|
// For Cloud Build based signatures, this is a PEM encoded public |
|
|
|
|
// key. To verify the Cloud Build signature, place the contents of |
|
|
|
|
// this field into a file (public.pem). The signature field is base64-decoded |
|
|
|
|
// into its binary representation in signature.bin, and the provenance bytes |
|
|
|
|
// from `BuildDetails` are base64-decoded into a binary representation in |
|
|
|
|
// signed.bin. OpenSSL can then verify the signature: |
|
|
|
|
// `openssl sha256 -verify public.pem -signature signature.bin signed.bin` |
|
|
|
|
string public_key = 1; |
|
|
|
|
|
|
|
|
|
// Required. Signature of the related `BuildProvenance`. In JSON, this is |
|
|
|
|
// base-64 encoded. |
|
|
|
|
bytes signature = 2; |
|
|
|
|
|
|
|
|
|
// An ID for the key used to sign. This could be either an ID for the key |
|
|
|
|
// stored in `public_key` (such as the ID or fingerprint for a PGP key, or the |
|
|
|
|
// CN for a cert), or a reference to an external key (such as a reference to a |
|
|
|
|
// key in Cloud Key Management Service). |
|
|
|
|
string key_id = 3; |
|
|
|
|
|
|
|
|
|
// Public key formats. |
|
|
|
|
enum KeyType { |
|
|
|
|
// `KeyType` is not set. |
|
|
|
|
KEY_TYPE_UNSPECIFIED = 0; |
|
|
|
|
// `PGP ASCII Armored` public key. |
|
|
|
|
PGP_ASCII_ARMORED = 1; |
|
|
|
|
// `PKIX PEM` public key. |
|
|
|
|
PKIX_PEM = 2; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// The type of the key, either stored in `public_key` or referenced in |
|
|
|
|
// `key_id`. |
|
|
|
|
KeyType key_type = 4; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// Details of a build occurrence. |
|
|
|
|