CycloneDX / CycloneDX/cyclonedx-cli

Cannot verify multiple signatures on SBOM

Open
#228 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

The cli will allow a user to sign a bom with multiple keys by specifying a different private key in the `--key-file` argument when run multiple times, (It will also allow the user to sign it multiple times with the same private key)
```
cyclonedx-cli sign bom bom.xml
Loading private key...
Loading XML BOM...
Generating signature...
Saving signature...

cyclonedx-cli sign bom bom.xml --key-file private2.key
Loading private key...
Loading XML BOM...
Generating signature...
Saving signature...
```

However when validating the signatures, the cli doesnt allow multiple public keys to be passed in to verify each signature. it fails with a validate error.
```
cyclonedx-cli verify all bom.xml --key-file public.key public2.key
Unrecognized command or argument 'public2.key'

all
Verify all signatures in a BOM

Usage:
cyclonedx-cli [options] verify all

Arguments:
BOM filename

Options:
--key-file Public key filename (RSA public key in PEM format, defaults to "public.key")
-?, -h, --help Show help and usage information

```
when the first key (public,key from the above example) is provided, signature verification fails for all sigs
```
cyclonedx-cli verify all bom.xml --key-file public.key
Loading public key...
Loading XML BOM...
Reading signatures...
Found 2 signatures...
Verifying signature 1... failed verification
Verifying signature 2... failed verification

Signatures failed verification
```
when the second public key is provided, the second sig verifes but the first fails. All are marked as a failure
```
cyclonedx-cli verify all bom.xml --key-file public2.key
Loading public key...
Loading XML BOM...
Reading signatures...
Found 2 signatures...
Verifying signature 1... failed verification
Verifying signature 2... verified

Signatures failed verification
```

Is the ability to sign the SBOM multiple times a feature?
We are looking to leverage the ability to sign the sbom multiple times as it passes through our pipelines, however the lack of verifiability breaks that. any advice would be appreciated.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.