Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

policy: initial new extension OIDs #715

Closed
wants to merge 2 commits into from
Closed

policy: initial new extension OIDs #715

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2a28a4d
policy: initial new extension OIDs
woodruffw Jul 24, 2023
f149a54
Merge branch 'main' into ww/new-exts
woodruffw Jul 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 27 additions & 8 deletions sigstore/verify/policy.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,12 +55,31 @@
_OIDC_GITHUB_WORKFLOW_REPOSITORY_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.5")
_OIDC_GITHUB_WORKFLOW_REF_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.6")
_OTHERNAME_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.7")
_OIDC_ISSUER_V2_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.8")
_OIDC_BUILD_SIGNER_URI_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.9")
_OIDC_BUILD_SIGNED_DIGEST_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.10")
_OIDC_RUNNER_ENVIRONMENT_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.11")
_OIDC_SOURCE_REPOSITORY_URI_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.12")
_OIDC_SOURCE_REPOSITORY_DIGEST_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.13")
_OIDC_SOURCE_REPOSITORY_REF_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.14")
_OIDC_SOURCE_REPOSITORY_IDENTIFIER_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.15")
_OIDC_SOURCE_REPOSITORY_OWNER_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.16")
_OIDC_SOURCE_REPOSITORY_OWNER_IDENTIFIER_OID = ObjectIdentifier(
"1.3.6.1.4.1.57264.1.17"
)
_OIDC_BUILD_CONFIG_URI_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.18")
_OIDC_BUILD_CONFIG_DIGEST_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.19")
_OIDC_BUILD_TRIGGER_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.20")
_OIDC_RUN_INVOCATION_URI_OID = ObjectIdentifier("1.3.6.1.4.1.57264.1.21")
_OIDC_SOURCE_REPOSITORY_VISIBILITY_AT_SIGNING_OID = ObjectIdentifier(
"1.3.6.1.4.1.57264.1.22"
)


class _SingleX509ExtPolicy(ABC):
class _SingleX509RawExtPolicy(ABC):
"""
An ABC for verification policies that boil down to checking a single
X.509 extension's value.
X.509 extension's *raw* value.
"""

oid: ObjectIdentifier
Expand Down Expand Up @@ -103,7 +122,7 @@ def verify(self, cert: Certificate) -> VerificationResult:
return VerificationSuccess()


class OIDCIssuer(_SingleX509ExtPolicy):
class OIDCIssuer(_SingleX509RawExtPolicy):
"""
Verifies the certificate's OIDC issuer, identified by
an X.509v3 extension tagged with `1.3.6.1.4.1.57264.1.1`.
Expand All @@ -112,7 +131,7 @@ class OIDCIssuer(_SingleX509ExtPolicy):
oid = _OIDC_ISSUER_OID


class GitHubWorkflowTrigger(_SingleX509ExtPolicy):
class GitHubWorkflowTrigger(_SingleX509RawExtPolicy):
"""
Verifies the certificate's GitHub Actions workflow trigger,
identified by an X.509v3 extension tagged with `1.3.6.1.4.1.57264.1.2`.
Expand All @@ -121,7 +140,7 @@ class GitHubWorkflowTrigger(_SingleX509ExtPolicy):
oid = _OIDC_GITHUB_WORKFLOW_TRIGGER_OID


class GitHubWorkflowSHA(_SingleX509ExtPolicy):
class GitHubWorkflowSHA(_SingleX509RawExtPolicy):
"""
Verifies the certificate's GitHub Actions workflow commit SHA,
identified by an X.509v3 extension tagged with `1.3.6.1.4.1.57264.1.3`.
Expand All @@ -130,7 +149,7 @@ class GitHubWorkflowSHA(_SingleX509ExtPolicy):
oid = _OIDC_GITHUB_WORKFLOW_SHA_OID


class GitHubWorkflowName(_SingleX509ExtPolicy):
class GitHubWorkflowName(_SingleX509RawExtPolicy):
"""
Verifies the certificate's GitHub Actions workflow name,
identified by an X.509v3 extension tagged with `1.3.6.1.4.1.57264.1.4`.
Expand All @@ -139,7 +158,7 @@ class GitHubWorkflowName(_SingleX509ExtPolicy):
oid = _OIDC_GITHUB_WORKFLOW_NAME_OID


class GitHubWorkflowRepository(_SingleX509ExtPolicy):
class GitHubWorkflowRepository(_SingleX509RawExtPolicy):
"""
Verifies the certificate's GitHub Actions workflow repository,
identified by an X.509v3 extension tagged with `1.3.6.1.4.1.57264.1.5`.
Expand All @@ -148,7 +167,7 @@ class GitHubWorkflowRepository(_SingleX509ExtPolicy):
oid = _OIDC_GITHUB_WORKFLOW_REPOSITORY_OID


class GitHubWorkflowRef(_SingleX509ExtPolicy):
class GitHubWorkflowRef(_SingleX509RawExtPolicy):
"""
Verifies the certificate's GitHub Actions workflow ref,
identified by an X.509v3 extension tagged with `1.3.6.1.4.1.57264.1.6`.
Expand Down