sigstore: add new verification policies for missing extensions #1004
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
facutuesca
force-pushed
the
add-new-x509-extensions
branch
from
99ab1f6
to
0bf44fc
Compare
Signed-off-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>
facutuesca
force-pushed
the
add-new-x509-extensions
branch
from
0bf44fc
to
70e1ac4
Compare
woodruffw
reviewed
May 7, 2024
sigstore/verify/policy.py
Outdated
| @@ -93,6 +112,41 @@ def verify(self, cert: Certificate) -> None: | |||
| ) | |||
|
|
|||
|
|
|||
| class _SingleX509ExtPolicyDer(_SingleX509ExtPolicy): | |||
There was a problem hiding this comment.
Let's call this V2 or something, since they're both technically DER and Fulcio refers to these as "V2":
Suggested change
| class _SingleX509ExtPolicyDer(_SingleX509ExtPolicy): | |
| class _SingleX509ExtPolicyV2(_SingleX509ExtPolicy): |
|
/gcbrun |
woodruffw
added
component:verification
Signed-off-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>
woodruffw
reviewed
May 7, 2024
Co-authored-by: William Woodruff <william@yossarian.net> Signed-off-by: Facundo Tuesca <facu@tuesca.com>
|
/gcbrun |
woodruffw
approved these changes
May 7, 2024
There was a problem hiding this comment.
LGTM!
@facutuesca if you want to send a follow-up PR for another RC release as well, that would be great 🙂
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The missing extensions (and their OIDCs) are documented here.
This PR adds an extra base class for verification classes,
_SingleX509ExtPolicyV2which is inherits from_SingleX509ExtPolicy, but expects the extension being verified to have a DER-encoded value (as opposed to just the raw strings). See here for more details.This new base class is used for the extensions
1.3.6.1.4.1.57264.1.8through1.3.6.1.4.1.57264.1.22. Also, a new test is added that checks that a GHA-signed artifact can be verified using all (old and new) extensions.cc @woodruffw
Closes #425.