feat: add support attaching a Rekor bundle to a container

cmd/cosign/cli/attach.go

@@ -49,7 +49,7 @@ func attachSignature() *cobra.Command {
 		PersistentPreRun: options.BindViper,
 		Args:             cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return attach.SignatureCmd(cmd.Context(), o.Registry, o.Signature, o.Payload, o.Cert, o.CertChain, o.TimeStampedSig, args[0])
+			return attach.SignatureCmd(cmd.Context(), o.Registry, o.Signature, o.Payload, o.Cert, o.CertChain, o.TimeStampedSig, o.RekorBundle, args[0])
 		},
 	}
 

cmd/cosign/cli/attach/sig.go

@@ -31,7 +31,7 @@ import (
 	"github.com/sigstore/cosign/v2/pkg/oci/static"
 )
 
-func SignatureCmd(ctx context.Context, regOpts options.RegistryOptions, sigRef, payloadRef, certRef, certChainRef, timeStampedSigRef, imageRef string) error {
+func SignatureCmd(ctx context.Context, regOpts options.RegistryOptions, sigRef, payloadRef, certRef, certChainRef, timeStampedSigRef, rekorBundleRef, imageRef string) error {
 	b64SigBytes, err := signatureBytes(sigRef)
 	if err != nil {
 		return err
@@ -74,6 +74,7 @@ func SignatureCmd(ctx context.Context, regOpts options.RegistryOptions, sigRef,
 	var cert []byte
 	var certChain []byte
 	var timeStampedSig []byte
+	var rekorBundle *bundle.RekorBundle
 
 	if certRef != "" {
 		cert, err = os.ReadFile(filepath.Clean(certRef))
@@ -95,9 +96,21 @@ func SignatureCmd(ctx context.Context, regOpts options.RegistryOptions, sigRef,
 			return err
 		}
 	}
-	bundle := bundle.TimestampToRFC3161Timestamp(timeStampedSig)
+	TSBundle := bundle.TimestampToRFC3161Timestamp(timeStampedSig)
 
-	newSig, err := mutate.Signature(sig, mutate.WithCertChain(cert, certChain), mutate.WithRFC3161Timestamp(bundle))
+	if rekorBundleRef != "" {
+		rekorBundleByte, err := os.ReadFile(filepath.Clean(rekorBundleRef))
+		if err != nil {
+			return err
+		}
+
+		rekorBundle, err = bundle.BytesToRekorBundle(rekorBundleByte)
+		if err != nil {
+			return err
+		}
+	}
+
+	newSig, err := mutate.Signature(sig, mutate.WithCertChain(cert, certChain), mutate.WithRFC3161Timestamp(TSBundle), mutate.WithBundle(rekorBundle))
 	if err != nil {
 		return err
 	}

cmd/cosign/cli/options/attach.go

@@ -32,6 +32,7 @@ type AttachSignatureOptions struct {
 	Cert           string
 	CertChain      string
 	TimeStampedSig string
+	RekorBundle    string
 	Registry       RegistryOptions
 }
 
@@ -57,6 +58,8 @@ func (o *AttachSignatureOptions) AddFlags(cmd *cobra.Command) {
 			"signing certificate and end with the root certificate. Included in the OCI Signature")
 	cmd.Flags().StringVar(&o.TimeStampedSig, "tsr", "",
 		"path to the Time Stamped Signature Response from RFC3161 compliant TSA")
+	cmd.Flags().StringVar(&o.RekorBundle, "rekor", "",
+		"path to the rekor bundle")
 }
 
 // AttachSBOMOptions is the top level wrapper for the attach sbom command.

pkg/cosign/bundle/rekor.go

@@ -14,7 +14,12 @@
 
 package bundle
 
-import "github.com/sigstore/rekor/pkg/generated/models"
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/sigstore/rekor/pkg/generated/models"
+)
 
 // RekorBundle holds metadata about recording a Signature's ephemeral key to
 // a Rekor transparency log.
@@ -44,3 +49,13 @@ func EntryToBundle(entry *models.LogEntryAnon) *RekorBundle {
 		},
 	}
 }
+
+func BytesToRekorBundle(data []byte) (*RekorBundle, error) {
+	var rekorBundle RekorBundle
+	err := json.Unmarshal(data, &rekorBundle)
+	if err != nil {
+		return nil, fmt.Errorf("invalid rekor bundle provided: %w", err)
+	}
+
+	return &rekorBundle, nil
+}

test/e2e_test.go

@@ -908,7 +908,7 @@ func TestAttachWithRFC3161Timestamp(t *testing.T) {
 	rfc3161TSRef := mkfile(string(tsBytes), td, t)
 
 	// Upload it!
-	err = attach.SignatureCmd(ctx, options.RegistryOptions{}, sigRef, payloadref, pemleafRef, certchainRef, rfc3161TSRef, imgName)
+	err = attach.SignatureCmd(ctx, options.RegistryOptions{}, sigRef, payloadref, pemleafRef, certchainRef, rfc3161TSRef, "", imgName)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1598,7 +1598,7 @@ func TestUploadDownload(t *testing.T) {
 				sigRef = signature
 			}
 			// Upload it!
-			err := attach.SignatureCmd(ctx, options.RegistryOptions{}, sigRef, payloadPath, "", "", "", imgName)
+			err := attach.SignatureCmd(ctx, options.RegistryOptions{}, sigRef, payloadPath, "", "", "", "", imgName)
 			if testCase.expectedErr {
 				mustErr(err, t)
 			} else {