Add layout package for writing and loading signatures from disk

pkg/oci/layout/image.go

@@ -0,0 +1,103 @@
+//
+// Copyright 2021 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package layout
+
+import (
+	"fmt"
+
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/google/go-containerregistry/pkg/v1/layout"
+	"github.com/google/go-containerregistry/pkg/v1/partial"
+	"github.com/sigstore/cosign/pkg/oci"
+	"github.com/sigstore/cosign/pkg/oci/siglayer"
+)
+
+// SignedImage provides access to a remote image reference, and its signatures.
+func SignedImage(path string) (oci.SignedImage, error) {
+	p, err := layout.FromPath(imagePath(path))
+	if err != nil {
+		return nil, err
+	}
+	img, err := p.Image(v1.Hash{})
+	if err != nil {
+		return nil, err
+	}
+
+	return &image{
+		Image: img,
+		path:  path,
+	}, nil
+}
+
+type image struct {
+	path string
+	v1.Image
+}
+
+var _ oci.SignedImage = (*image)(nil)
+
+type sigs struct {
+	v1.Image
+}
+
+var _ oci.Signatures = (*sigs)(nil)
+
+// Get implements oci.Signatures
+func (s *sigs) Get() ([]oci.Signature, error) {
+	layers, err := s.Image.Layers()
+	if err != nil {
+		return nil, err
+	}
+	var signatures []oci.Signature
+	for _, l := range layers {
+		d, err := partial.Descriptor(l)
+		if err != nil {
+			return nil, err
+		}
+		if d == nil {
+			continue
+		}
+		signatures = append(signatures, siglayer.New(l, s, *d))
+	}
+	return signatures, nil
+}
+
+// Signatures implements oci.SignedImage
+func (i *image) Signatures() (oci.Signatures, error) {
+	sigPath, err := layout.FromPath(signaturesPath(i.path))
+	if err != nil {
+		return nil, err
+	}
+	img, err := sigPath.Image(v1.Hash{})
+	if err != nil {
+		return nil, err
+	}
+	return &sigs{
+		Image: img,
+	}, nil
+}
+
+// Attestations implements oci.SignedImage
+// TODO (priyawadhwa@)
+func (i *image) Attestations() (oci.Signatures, error) {
+	return nil, fmt.Errorf("not yet implemented")
+}
+
+// Attestations implements oci.SignedImage
+// TODO (priyawadhwa@)
+func (i *image) Attachment(name string) (oci.File, error) {
+	return nil, fmt.Errorf("not yet implemented")
+}

pkg/oci/layout/write.go

@@ -0,0 +1,67 @@
+//
+// Copyright 2021 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package layout
+
+import (
+	"path/filepath"
+
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/google/go-containerregistry/pkg/v1/empty"
+	"github.com/google/go-containerregistry/pkg/v1/layout"
+	"github.com/pkg/errors"
+	"github.com/sigstore/cosign/pkg/oci"
+)
+
+// WriteSignedImage writes the image and all related signatures, attestations and attachments
+func WriteSignedImage(path string, si oci.SignedImage) error {
+	// First, write the image
+	if err := write(path, imagePath, si); err != nil {
+		return errors.Wrap(err, "writing image")
+	}
+	sigs, err := si.Signatures()
+	if err != nil {
+		return errors.Wrap(err, "getting signatures")
+	}
+	if err := write(path, signaturesPath, sigs); err != nil {
+		return errors.Wrap(err, "writing signatures")
+	}
+	// TODO (priyawadhwa@) write attestations and attachments
+	return nil
+}
+
+func imagePath(path string) string {
+	return filepath.Join(path, "image")
+}
+
+func signaturesPath(path string) string {
+	return filepath.Join(path, "signatures")
+}
+
+type pathFunc func(string) string
+
+func write(path string, pf pathFunc, img v1.Image) error {
+	p := pf(path)
+	// write empty image
+	layoutPath, err := layout.Write(p, empty.Index)
+	if err != nil {
+		return err
+	}
+	// write image to disk
+	if err := layoutPath.AppendImage(img); err != nil {
+		return err
+	}
+	return nil
+}

pkg/oci/remote/remote.go

@@ -26,13 +26,6 @@ import (
 	"github.com/sigstore/cosign/pkg/oci"
 )
 
-const (
-	sigkey    = "dev.cosignproject.cosign/signature"
-	certkey   = "dev.sigstore.cosign/certificate"
-	chainkey  = "dev.sigstore.cosign/chain"
-	BundleKey = "dev.sigstore.cosign/bundle"
-)
-
 // These enable mocking for unit testing without faking an entire registry.
 var (
 	remoteImage = remote.Image

pkg/oci/remote/remote_test.go

@@ -16,7 +16,6 @@
 package remote
 
 import (
-	"encoding/base64"
 	"testing"
 
 	"github.com/google/go-containerregistry/pkg/name"
@@ -25,21 +24,6 @@ import (
 	"github.com/pkg/errors"
 )
 
-func must(img v1.Image, err error) v1.Image {
-	if err != nil {
-		panic(err.Error())
-	}
-	return img
-}
-
-func mustDecode(s string) []byte {
-	b, err := base64.StdEncoding.DecodeString(s)
-	if err != nil {
-		panic(err.Error())
-	}
-	return b
-}
-
 func TestTagMethods(t *testing.T) {
 	rg := remoteGet
 	defer func() {

pkg/oci/remote/signatures.go

@@ -24,6 +24,7 @@ import (
 	"github.com/pkg/errors"
 	"github.com/sigstore/cosign/pkg/oci"
 	"github.com/sigstore/cosign/pkg/oci/empty"
+	"github.com/sigstore/cosign/pkg/oci/siglayer"
 )
 
 // Signatures fetches the signatures image represented by the named reference.
@@ -63,11 +64,7 @@ func (s *sigs) Get() ([]oci.Signature, error) {
 		if err != nil {
 			return nil, err
 		}
-		signatures = append(signatures, &sigLayer{
-			Layer: layer,
-			img:   s,
-			desc:  desc,
-		})
+		signatures = append(signatures, siglayer.New(layer, s, desc))
 	}
 	return signatures, nil
 }

pkg/oci/remote/layer.go → pkg/oci/siglayer/siglayer.go

@@ -13,7 +13,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package remote
+package siglayer
 
 import (
 	"crypto/x509"
@@ -28,12 +28,27 @@ import (
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 )
 
+const (
+	sigkey    = "dev.cosignproject.cosign/signature"
+	certkey   = "dev.sigstore.cosign/certificate"
+	chainkey  = "dev.sigstore.cosign/chain"
+	BundleKey = "dev.sigstore.cosign/bundle"
+)
+
 type sigLayer struct {
 	v1.Layer
-	img  *sigs
+	img  oci.Signatures
 	desc v1.Descriptor
 }
 
+func New(l v1.Layer, img oci.Signatures, desc v1.Descriptor) *sigLayer {
+	return &sigLayer{
+		Layer: l,
+		img:   img,
+		desc:  desc,
+	}
+}
+
 var _ oci.Signature = (*sigLayer)(nil)
 
 // Annotations implements oci.Signature

pkg/oci/remote/layer_test.go → pkg/oci/siglayer/siglayer_test.go

@@ -13,10 +13,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package remote
+package siglayer
 
 import (
 	"bytes"
+	"encoding/base64"
 	"fmt"
 	"testing"
 
@@ -30,6 +31,46 @@ import (
 	ociempty "github.com/sigstore/cosign/pkg/oci/empty"
 )
 
+type sigs struct {
+	v1.Image
+}
+
+// Get implements oci.Signatures
+func (s *sigs) Get() ([]oci.Signature, error) {
+	m, err := s.Manifest()
+	if err != nil {
+		return nil, err
+	}
+	signatures := make([]oci.Signature, 0, len(m.Layers))
+	for _, desc := range m.Layers {
+		layer, err := s.Image.LayerByDigest(desc.Digest)
+		if err != nil {
+			return nil, err
+		}
+		signatures = append(signatures, &sigLayer{
+			Layer: layer,
+			img:   s,
+			desc:  desc,
+		})
+	}
+	return signatures, nil
+}
+
+func must(img v1.Image, err error) v1.Image {
+	if err != nil {
+		panic(err.Error())
+	}
+	return img
+}
+
+func mustDecode(s string) []byte {
+	b, err := base64.StdEncoding.DecodeString(s)
+	if err != nil {
+		panic(err.Error())
+	}
+	return b
+}
+
 func TestSignature(t *testing.T) {
 	layer, err := random.Layer(300 /* byteSize */, types.DockerLayer)
 	if err != nil {