diff --git a/cmd/add.go b/cmd/add.go index 6d6282182d526b7dab7880d54034ff561a6faa85..e84d9cef3c2a3cb41e1b1157ac79e61aa80ca4e8 100644 --- a/cmd/add.go +++ b/cmd/add.go @@ -97,7 +97,6 @@ For more information, visit [domain]`, if err != nil { log.Fatal(err) } - fmt.Println(string(content)) }, } diff --git a/cmd/get.go b/cmd/get.go index 2c045b7b902b8d2c871100dd874c0a5119e5695b..fc715953b2c0a342415dbcd90194608df7f06b47 100644 --- a/cmd/get.go +++ b/cmd/get.go @@ -17,17 +17,32 @@ package cmd import ( "context" + "crypto" + "crypto/x509" + "encoding/json" "fmt" "io/ioutil" "net/http" "time" + tcrypto "github.com/google/trillian/crypto" + + tclient "github.com/google/trillian/client" + + "github.com/google/trillian" + "github.com/google/trillian/merkle" + "github.com/google/trillian/merkle/rfc6962" "github.com/projectrekor/rekor-cli/log" "github.com/spf13/viper" "github.com/spf13/cobra" ) +type getProofResponse struct { + Proof *trillian.GetInclusionProofByHashResponse + Key []byte +} + // getCmd represents the get command var getCmd = &cobra.Command{ Use: "get", @@ -38,7 +53,7 @@ For more information, visit [domain]`, Run: func(cmd *cobra.Command, args []string) { log := log.Logger rekorServer := viper.GetString("rekor_server") - url := rekorServer + "/api/v1/get" + url := rekorServer + "/api/v1/getproof" linkfile := viper.GetString("linkfile") // Set Context with Timeout for connects to thde log rpc server @@ -63,12 +78,40 @@ For more information, visit [domain]`, defer response.Body.Close() content, err := ioutil.ReadAll(response.Body) - if err != nil { log.Fatal(err) } fmt.Println(string(content)) + + resp := getProofResponse{} + if err := json.Unmarshal(content, &resp); err != nil { + log.Fatal(err) + } + + pub, err := x509.ParsePKIXPublicKey(resp.Key) + if err != nil { + log.Fatal(err) + } + + f, err := ioutil.ReadFile(linkfile) + if err != nil { + log.Fatal(err) + } + + leafHash := rfc6962.DefaultHasher.HashLeaf(f) + verifier := tclient.NewLogVerifier(rfc6962.DefaultHasher, pub, crypto.SHA256) + root, err := tcrypto.VerifySignedLogRoot(verifier.PubKey, verifier.SigHash, resp.Proof.SignedLogRoot) + if err != nil { + log.Fatal(err) + } + + v := merkle.NewLogVerifier(rfc6962.DefaultHasher) + proof := resp.Proof.Proof[0] + if err := v.VerifyInclusionProof(proof.LeafIndex, int64(root.TreeSize), proof.Hashes, root.RootHash, leafHash); err != nil { + log.Fatal(err) + } + log.Info("proof correct!") }, }