Add prober for verifying Rekor write correctness (#390)

Signed-off-by: Cody Soyland <[email protected]>

Signed-off-by: Cody Soyland <[email protected]>

cmd/prober/prober.go

@@ -60,7 +60,7 @@ func main() {
 	fmt.Printf("running create_ct_config Version: %s GitCommit: %s BuildDate: %s", versionInfo.GitVersion, versionInfo.GitCommit, versionInfo.BuildDate)
 
 	reg := prometheus.NewRegistry()
-	reg.MustRegister(endpointLatenciesSummary, endpointLatenciesHistogram)
+	reg.MustRegister(endpointLatenciesSummary, endpointLatenciesHistogram, verificationCounter)
 	reg.MustRegister(NewVersionCollector("sigstore_prober"))
 
 	go runProbers(ctx, frequency, oneTime)

cmd/prober/prometheus.go

@@ -26,6 +26,7 @@ var (
 	hostLabel       = "host"
 	statusCodeLabel = "status_code"
 	methodLabel     = "method"
+	verifiedLabel   = "verified"
 )
 
 var (
@@ -45,6 +46,14 @@ var (
 		Buckets: []float64{0.0, 200.0, 400.0, 600.0, 800.0, 1000.0},
 	},
 		[]string{endpointLabel, hostLabel, statusCodeLabel, methodLabel})
+
+	verificationCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "verification",
+			Help: "Rekor verification correctness counter",
+		},
+		[]string{verifiedLabel},
+	)
 )
 
 func exportDataToPrometheus(resp *http.Response, host, endpoint, method string, latency int64) {

cmd/prober/write.go

@@ -25,16 +25,17 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
 	"time"
 
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
+	"github.com/prometheus/client_golang/prometheus"
 
 	"github.com/sigstore/cosign/pkg/cosign"
 	"github.com/sigstore/cosign/pkg/providers"
 	"github.com/sigstore/fulcio/pkg/api"
+	rclient "github.com/sigstore/rekor/pkg/client"
 	"github.com/sigstore/rekor/pkg/generated/models"
 	hashedrekord "github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
@@ -121,17 +122,33 @@ func rekorWriteEndpoint(ctx context.Context) error {
 	t := time.Now()
 	resp, err := http.DefaultClient.Do(req)
 	latency := time.Since(t).Milliseconds()
+	exportDataToPrometheus(resp, rekorURL, endpoint, POST, latency)
 	if err != nil {
-		fmt.Printf("error adding entry: %v\n", err.Error())
+		return fmt.Errorf("error adding entry: %w", err)
 	}
 
-	// Export data to prometheus
-	exportDataToPrometheus(resp, rekorURL, endpoint, POST, latency)
-
+	// If entry was added successfully, we should verify it
+	rekorClient, err := rclient.GetRekorClient(rekorURL, rclient.WithUserAgent(fmt.Sprintf("Sigstore_Scaffolding_Prober/%s", versionInfo.GitVersion)))
+	if err != nil {
+		return fmt.Errorf("creating rekor client: %w", err)
+	}
 	defer resp.Body.Close()
-	body, _ = io.ReadAll(resp.Body)
-	fmt.Println(string(body))
-	return nil
+	var logEntry models.LogEntry
+	err = json.NewDecoder(resp.Body).Decode(&logEntry)
+	if err != nil {
+		return fmt.Errorf("unmarshal: %w", err)
+	}
+	var logEntryAnon models.LogEntryAnon
+	for _, e := range logEntry {
+		logEntryAnon = e
+		break
+	}
+	verified := "true"
+	if err = cosign.VerifyTLogEntry(ctx, rekorClient, &logEntryAnon); err != nil {
+		verified = "false"
+	}
+	verificationCounter.With(prometheus.Labels{verifiedLabel: verified}).Inc()
+	return err
 }
 
 func rekorEntryRequest() ([]byte, error) {