policy: add HTTP PGP signature verification builtin

Add verify_http_pgp_signature Rego builtin for HTTP sources using
pgpsign with checksum-request/response flow through policy resolution.
Wire sourcemeta HTTP checksum request/response conversion and add tests.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

util/sourcemeta/convert.go

@@ -33,6 +33,14 @@ func ToResolverOpt(req *gwpb.ResolveSourceMetaRequest, defaultPlatform *ocispecs
 	if req != nil && req.Git != nil {
 		opt.GitOpt = &sourceresolver.ResolveGitOpt{ReturnObject: req.Git.ReturnObject}
 	}
+	if req != nil && req.HTTP != nil && req.HTTP.ChecksumRequest != nil {
+		opt.HTTPOpt = &sourceresolver.ResolveHTTPOpt{
+			ChecksumReq: &sourceresolver.ResolveHTTPChecksumRequest{
+				Algo:   toResolverChecksumAlgo(req.HTTP.ChecksumRequest.Algo),
+				Suffix: append([]byte(nil), req.HTTP.ChecksumRequest.Suffix...),
+			},
+		}
+	}
 	return opt
 }
 
@@ -64,10 +72,27 @@ func ToGatewayMetaResponse(resp *sourceresolver.MetaResponse) *gwpb.ResolveSourc
 			Filename:     resp.HTTP.Filename,
 			LastModified: lastModified,
 		}
+		if resp.HTTP.ChecksumResponse != nil {
+			out.HTTP.ChecksumResponse = &gwpb.ChecksumResponse{
+				Digest: resp.HTTP.ChecksumResponse.Digest,
+				Suffix: append([]byte(nil), resp.HTTP.ChecksumResponse.Suffix...),
+			}
+		}
 	}
 	return out
 }
 
+func toResolverChecksumAlgo(in gwpb.ChecksumRequest_ChecksumAlgo) sourceresolver.ResolveHTTPChecksumAlgo {
+	switch in {
+	case gwpb.ChecksumRequest_CHECKSUM_ALGO_SHA384:
+		return sourceresolver.ResolveHTTPChecksumAlgoSHA384
+	case gwpb.ChecksumRequest_CHECKSUM_ALGO_SHA512:
+		return sourceresolver.ResolveHTTPChecksumAlgoSHA512
+	default:
+		return sourceresolver.ResolveHTTPChecksumAlgoSHA256
+	}
+}
+
 func toGatewayDescriptor(desc ocispecs.Descriptor) *gwpb.Descriptor {
 	return &gwpb.Descriptor{
 		MediaType:   desc.MediaType,

util/sourcemeta/convert_test.go

@@ -0,0 +1,43 @@
+package sourcemeta
+
+import (
+	"testing"
+
+	"github.com/moby/buildkit/client/llb/sourceresolver"
+	gwpb "github.com/moby/buildkit/frontend/gateway/pb"
+	"github.com/moby/buildkit/solver/pb"
+	"github.com/stretchr/testify/require"
+)
+
+func TestToResolverOptHTTPChecksumRequest(t *testing.T) {
+	opt := ToResolverOpt(&gwpb.ResolveSourceMetaRequest{
+		Source: &pb.SourceOp{Identifier: "https://example.com/a"},
+		HTTP: &gwpb.ResolveSourceHTTPRequest{
+			ChecksumRequest: &gwpb.ChecksumRequest{
+				Algo:   gwpb.ChecksumRequest_CHECKSUM_ALGO_SHA512,
+				Suffix: []byte{0x01, 0x02},
+			},
+		},
+	}, nil)
+	require.NotNil(t, opt.HTTPOpt)
+	require.NotNil(t, opt.HTTPOpt.ChecksumReq)
+	require.Equal(t, sourceresolver.ResolveHTTPChecksumAlgoSHA512, opt.HTTPOpt.ChecksumReq.Algo)
+	require.Equal(t, []byte{0x01, 0x02}, opt.HTTPOpt.ChecksumReq.Suffix)
+}
+
+func TestToGatewayMetaResponseHTTPChecksumResponse(t *testing.T) {
+	out := ToGatewayMetaResponse(&sourceresolver.MetaResponse{
+		Op: &pb.SourceOp{Identifier: "https://example.com/a"},
+		HTTP: &sourceresolver.ResolveHTTPResponse{
+			Digest: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+			ChecksumResponse: &sourceresolver.ResolveHTTPChecksumResponse{
+				Digest: "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+				Suffix: []byte{0x03, 0x04},
+			},
+		},
+	})
+	require.NotNil(t, out.HTTP)
+	require.NotNil(t, out.HTTP.ChecksumResponse)
+	require.Equal(t, "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", out.HTTP.ChecksumResponse.Digest)
+	require.Equal(t, []byte{0x03, 0x04}, out.HTTP.ChecksumResponse.Suffix)
+}