GitHub - kern-werk/cosign-verify · GitHub
/" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading. Please reload this page.
kern-werk
cosign-verify
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>2 Commits<br>2 Commits
.github/workflows
.github/workflows
test
test
third_party
third_party
.gitignore
.gitignore
LICENSE
LICENSE
Makefile
Makefile
README.md
README.md
cosign_verify.h
cosign_verify.h
cv.c
cv.c
View all files
Repository files navigation
cosign-verify
Verify Cosign blob signatures in ~150 lines of freestanding C — no libc required, no allocation, no RNG, no dependencies beyond the vendored sources in this folder. Small enough to run inside a kernel module.
More info on our Sigstore blogpost.
Compatibility contract
The supported subset of cosign is exactly key-pair blob signatures :
--tlog-upload=false \<br>--output-signature blob.sig blob<br># cosign >= 3.x additionally needs: --use-signing-config=false
# what this library verifies is bit-for-bit what this accepts:<br>cosign verify-blob --key pub.pem --signature blob.sig \<br>--insecure-ignore-tlog=true blob">cosign sign-blob --key priv|kms-uri> --tlog-upload=false \<br>--output-signature blob.sig blob<br># cosign >= 3.x additionally needs: --use-signing-config=false
# what this library verifies is bit-for-bit what this accepts:<br>cosign verify-blob --key pub.pem --signature blob.sig \<br>--insecure-ignore-tlog=true blob
Wire format: blob.sig is base64(DER ECDSA-Sig-Value{r,s}) — an ECDSA-P256 signature over SHA-256(blob). Cosign only generates ECDSA-P256/SHA-256 keys, so this is the only algorithm pair implemented.
API
Everything is in cosign_verify.h (header-only, static inline), on top of the vendored sources:
/* digest: SHA-256 of the blob. sig: raw .sig file contents.<br>* pk: raw 64-byte P-256 point X||Y.<br>* Returns 0 on a good signature, -1 on anything else. */<br>int cosignverify_verify_digest(const uint8_t *sig, unsigned long sig_len,<br>const uint8_t digest[32],<br>const uint8_t pk[64]);
Extract the raw 64-byte public key from cosign's PEM:
pub.raw64">openssl pkey -pubin -in cosign.pub -outform DER | tail -c 64 > pub.raw64
Stack use is a few hundred bytes; the base64 decoder is strict (canonical encodings only) and the DER unpacking is mincrypt's dsa_sig_unpack.
Testing
make test
Dependencies sources
what<br>source
third_party/p256/<br>AOSP libmincrypt @ 669ecc2f
third_party/sha256/<br>AOSP libmincrypt @ same commit
The vendored files carry minimal, documented local changes (flattened include paths, unused libc includes dropped) so they compile freestanding. Everything else is byte-identical to upstream. The mincrypt P-256 code is the verifier Android used for verified boot: integer-only, constant time, no heap.
About<br>No description, website, or topics provided.<br>Resources<br>Readme<br>MIT license<br>Activity<br>Custom properties<br>Stars<br>1 star<br>Watchers<br>0 watching<br>Forks<br>0 forks<br>Report repository
Releases
Packages
Contributors
Languages
You can’t perform that action at this time.