Add functionality to sign DSSE envelopes with arbitrary payloads

sigstore/dsse.py

@@ -1,4 +1,5 @@
 # Copyright 2022 The Sigstore Authors
+# Copyright (c) 2024, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -210,6 +211,23 @@ def _from_json(cls, contents: bytes | str) -> Envelope:
         inner = _Envelope().from_json(contents)
         return cls(inner)
 
+    @classmethod
+    def from_payload(cls, payload_type: str, payload: bytes) -> Envelope:
+        """Return an unsigned DSSE envelope.
+
+        Args:
+            payload_type (str): The envelope's payload type
+            payload (bytes): The envelope's payload
+
+        Returns:
+            Envelope: An unsigned DSSE envelope
+        """
+        inner = _Envelope(
+            payload=payload,
+            payload_type=payload_type,
+        )
+        return cls(inner)
+
     def to_json(self) -> str:
         """
         Return a JSON string with this DSSE envelope's contents.
@@ -256,6 +274,18 @@ def _sign(key: ec.EllipticCurvePrivateKey, stmt: Statement) -> Envelope:
     )
 
 
+def _sign_envelope(
+        key: ec.EllipticCurvePrivateKey, envelope: Envelope) -> Envelope:
+    """
+    Sign the given envelope's payload and set the signature field
+    with the generated signature.
+    """
+    pae = _pae(envelope._inner.payload_type, envelope._inner.payload)
+    signature = key.sign(pae, ec.ECDS(hashes.SHA256()))
+    envelope._inner.signaures = [Signature(sig=signature)]
+    return envelope
+
+
 def _verify(key: ec.EllipticCurvePublicKey, evp: Envelope) -> bytes:
     """
     Verify the given in-toto `Envelope`, returning the verified inner payload.

sigstore/sign.py

@@ -1,4 +1,5 @@
 # Copyright 2022 The Sigstore Authors
+# Copyright (c) 2024, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -229,6 +230,45 @@ def sign_dsse(
 
         return self._finalize_sign(cert, content, proposed_entry)
 
+    def sign_dsse_envelope(
+            self,
+            envelope: dsse.Envelope,
+    ) -> Bundle:
+        """
+        Signs the provided envelope's payload, and returns a
+        `Bundle containing the signed envelope and the verification
+        material.
+
+        Args:
+            envelope (dsse.Envelope): The envelope to be signed.
+
+        Returns:
+            Bundle: The bundle containing the signed DSSE envelope.
+        """
+        cert = self._signing_cert()
+
+        b64_cert = base64.b64encode(
+            cert.public_bytes(encoding=serialization.Encoding.PEM)
+        )
+        envelope = dsse._sign_envelope(
+            self._private_key,
+            envelope,
+        )
+
+        proposed_entry = rekor_types.Dsse(
+            spec=rekor_types.dsse.DsseSchema(
+                # NOTE: mypy can't see that this kwarg is correct due to two interacting
+                # behaviors/bugs (one pydantic, one datamodel-codegen):
+                # See: <https://github.com/pydantic/pydantic/discussions/7418#discussioncomment-9024927>
+                # See: <https://github.com/koxudaxi/datamodel-code-generator/issues/1903>
+                proposed_content=rekor_types.dsse.ProposedContent(  # type: ignore[call-arg]
+                    envelope=envelope.to_json(),
+                    verifiers=[b64_cert.decode()],
+                ),
+            ),
+        )
+        return self._finalize_sign(cert, envelope, proposed_entry)
+
     def sign_artifact(
         self,
         input_: bytes | sigstore_hashes.Hashed,

test/unit/test_sign.py

@@ -1,4 +1,5 @@
 # Copyright 2022 The Sigstore Authors
+# Copyright (c) 2024, NVIDIA CORPORATION.  All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,7 +21,7 @@
 from sigstore_protobuf_specs.dev.sigstore.common.v1 import HashAlgorithm
 
 import sigstore.oidc
-from sigstore.dsse import _StatementBuilder, _Subject
+from sigstore.dsse import _StatementBuilder, _Subject, Envelope
 from sigstore.errors import VerificationError
 from sigstore.hashes import Hashed
 from sigstore.sign import SigningContext
@@ -169,3 +170,20 @@ def test_sign_dsse(staging):
         bundle = signer.sign_dsse(stmt)
         # Ensures that all of our inner types serialize as expected.
         bundle.to_json()
+
+
+@pytest.mark.staging
+@pytest.mark.ambient_oidc
+def test_sign_dsse_envelope(staging):
+    sign_ctx, _, identity = staging
+
+    ctx = sign_ctx()
+    payload = b"Hello World!"
+    payload_type = "type/custom/my_payload"
+
+    env = Envelope.from_payload(payload_type, payload)
+
+    with ctx.signer(identity) as signer:
+        bundle = signer.sign_dsse_envelope(env)
+
+        bundle.to_json()