hey @dlorenc , opening this issue for us to round up the approach for the CLI app and its role (and current sub commands / flags).
Currently as it stands:
% rekor-cli --help
add Rekor Add Command
get Rekor get command
getleaf Rekor Get Leaf Command
help Help about any command
update Rekor update command
We have discussed extending the following commands
rekor upload --signature=<signature-file> --public-key=<public-key-file> --artifact=<URL or file> # generates the rekord file (This would used by the node maintainer or the user in fact)
rekor verify --signature=<signature-file> (optional) --artifact <URL or file> # this would be run by the user. This would require the public key.
rekor lookup-signatures-by-artifact --artifact=<URL or file> # It looks up all signature entries for this artifact and returns them. This requires a map[sha][]RekorLeaf
rekor lookup-signatures-by-public-key --public-key=<public-key>
I propose we do the following.
rekor-cli
changes its binary namespace to just rekor
rekor
then becomes the main tool that oss project maintainers use to record into the rekor server their release artifacts and verify entry.
- We remove (or refactor when possible) all of the commands:
add
, get
, getleaf
, update
and we create a new tool called rekorctl
as a home for these subcommands along side get signatures by artifact / public key we discussed and added recently.
This then makes the developer tool simple and we maintain this with stability as key (and a lower attack surface as a result of its simple implementation). The tool just uploads and verifies. Anyone wanting more of a swiss army knife style tool can use rekorctl
which I will go into a little futher down (and will be home to the commands removed from the maintainers tool rekor
).
rekor
Upload
% rekor upload --help
Upload a signed artifact into the rekor transparency log.
Usage:
rekor upload [flags]
Flags:
-h, --help help for upload
--signature string The signature generated during artifact signing
--public-key string The public key, of the GPG key pair used to sign the artifact
--artifact-url string The url of where the artifact is stored
--artifact-path string The file location of the artifact
--artifact-sha Mandatory if using `--artifact-url`
Verify
% rekor verify --help
Verify a signed entry exists within rekor
Usage:
rekor upload [flags]
Flags:
-h, --help help for upload
--signature string The signature generated during artifact signing (optional)
--public-key string The public key, of the GPG key pair used to sign the artifact
--artifact-url string The url of where the artifact is stored
--artifact-path string The file location of the artifact
rekorctl
We then migrate / refactor the commands removed from rekor
and the new commands to a binary namespace / project called rekorctl
(or rekoradm
for admin, I am open to naming). This will be a tool used by those wanting to query the rekor instance a bit deeper beyond just making and verifying entries like our project maintainers (like a said a swiss army knife). Possible audience could be server admins or security researchers / auditors.
% rekorctl --help
get
getleaf Get Leafs
sigs-by-artifact Look up all signature entries for this artifact and returns them.
sigs-by-pubkey Look up signatures by public key
help Help about any command
update Rekor update command
% rekorctl getleaf --help
Get a leaf by either the index or by the artifact
Usage:
rekor getleaf [flags]
Flags:
-h, --help help for upload
--leafindex string The signature generated during artifact signing (optional)
--artifact-url string The url of where the artifact is stored
--artifact-path string The file location of the artifact
This will then do the same as the current getleaf
command and download the provenance file to the users drive using $<random_string>.txt
The server CLI will remain largely as it is, with the serve
flag (although we could add some stuff over time like running in DEBUG mode etc).