Sigstore Integration

The Sigstore integration within the Tinfoil Verifier project provides a mechanism for verifying the code provenance and integrity of enclave-backed services. By leveraging Sigstore's transparency logs and certificate authorities, the system ensures that the code running inside a remote enclave (such as AMD SEV-SNP or Intel TDX) matches a trusted build originating from a specific GitHub repository and workflow.

This module acts as a bridge between the hardware-rooted remote attestation and the software supply chain. It fetches trusted roots, verifies signed attestation bundles, and extracts code measurements that are subsequently compared against the runtime measurements provided by the hardware enclave.

Sources: sigstore/sigstore.go, README.md:10-25

Architecture and Components

The Sigstore integration is primarily managed through a Client that interacts with the Sigstore ecosystem, including Rekor (transparency log) and Fulcio (certificate authority).

Sigstore Client

The sigstore.Client is the central component responsible for fetching the Sigstore trust root and performing cryptographic verification of signed bundles. It utilizes a root.TrustedRoot to establish trust in the signatures provided in the attestation documents.

Trusted Root Management

The system maintains a trusted_root.json file, which contains the public keys and metadata for Sigstore's transparency logs (Rekor), certificate authorities (Fulcio), and timestamping authorities.

Verification Logic

The core functionality of the integration is verifying signed attestations to extract "Source of Truth" measurements for enclave code.

Attestation Verification Flow

The VerifyAttestation function processes a Sigstore bundle and compares the contained digest against the expected repository and artifact digest.

1. Identity Pinning: The verifier pins the certificate identity to a specific GitHub OIDC issuer and a regex matching the repository's workflows (e.g., `^https://github.com/repo/.github/workflows/.%2A%40refs/tags/%2A%60).
2. Digest Matching: It ensures the artifact digest in the bundle matches the provided hex digest.
3. Predicate Extraction: It extracts the Measurement from the statement predicate, supporting multi-platform formats.

Support for Multi-Platform Measurements

The integration supports the snp-tdx-multiplatform/v1 predicate type. This allows a single code attestation to provide measurements for both AMD SEV-SNP (measurement) and Intel TDX (RTMR1, RTMR2).

case attestation.SnpTdxMultiPlatformV1:
    return &attestation.Measurement{
        Type: measurementType,
        Registers: []string{
            predicateFields["snp_measurement"].GetStringValue(),
            rtmrs["rtmr1"].GetStringValue(),
            rtmrs["rtmr2"].GetStringValue(),
        },
    }, nil

Sources: sigstore/sigstore.go:124-162, attestation/attestation.go:30-45

Hardware Measurement Integration

Sigstore is also used to verify hardware-specific measurements (MRTD and RTMR0) stored in a dedicated repository (tinfoilsh/hardware-measurements).

Sources: sigstore/sigstore.go:165-218

Integration with Enclave Attestation

In the standard verification flow, the Sigstore-verified "Source" measurements are compared against the hardware-produced "Runtime" measurements.

Implementation Details

Certificate Identities

Verification uses OpenID Connect (OIDC) identities provided by GitHub Actions. The verifier ensures the code was signed by a specific repository workflow.

certID, err := verify.NewShortCertificateIdentity(
    "https://token.actions.githubusercontent.com",
    "",
    "",
    "^https://github.com/%22+repo+%22/.github/workflows/.%2A%40refs/tags/%2A%22%2C
)

Sources: sigstore/sigstore.go:88-97

Predicate Types

The following predicate types are recognized during the Sigstore verification process:

Sources: attestation/attestation.go:23-32

Summary

The Sigstore Integration provides the cryptographic link between a trusted source code repository and the binary executing in a confidential enclave. By verifying GitHub-issued OIDC certificates and Sigstore transparency logs, it allows the verifier to confirm that the enclave measurements match a specific, authorized build of the software.