Bypass the short-lived embedded TUF root in sigstore/sigstore wheneve…#827
Open
raacar wants to merge 3 commits into
Open
Bypass the short-lived embedded TUF root in sigstore/sigstore wheneve…#827raacar wants to merge 3 commits into
raacar wants to merge 3 commits into
Conversation
…r a local sigstore-go trusted_root.json is available, and stop rejecting legitimate signatures on a redundant TSA-window check. internal/sigstore/localcache/localcache.go locates a sigstore-go-style cache at ~/.sigstore/root/<mirror>/targets/trusted_root.json by reading the mirror URL from remote.json and translating it to the on-disk directory the same way sigstore-go does. internal/fulcio/fulcioroots/fulcioroots.go learns to load Fulcio root and intermediate certs from that local trusted root when present, ahead of the TUF source. internal/rekor/client.go injects Rekor public keys from the local trusted root into the gitsign Rekor client, keyed the same way cosign keys them so downstream verification helpers see an identical map. internal/gitsign/gitsign.go routes both CT log key lookups (legacy verifier and experimental sigstore-go path) through a new helper that prefers the local trusted root and falls back to cosign's TUF-backed loader. internal/fork/ietf-cms/verify.go switches the TSA timestamp vs. signer-cert validity check to compare against GenTime directly with inclusive bounds, instead of the accuracy-padded bounds that were producing false negatives on ten-minute Fulcio certs with small Fulcio-vs-TSA clock skew.
…"maybe before/after", expected to error) now expect success — they're the inclusive-boundary cases. Added two new cases at NotBefore - 1s and NotAfter + 1s that still expect the expired error, pinning down strict rejection outside the window. The pre-existing NotBefore + 31s and NotAfter - 31s (inside window) cases are kept (still expect success). Dropped the now-irrelevant info.Accuracy.Seconds = 30 since the check no longer uses Accuracy, and refreshed the ASCII diagrams to show GenTime as a point rather than a sig-min/sig-max interval
…e/localcache and modifications to fulcioroots, gitsign, client. And ietf-cms/verify.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bypass the short-lived embedded TUF root in sigstore/sigstore whenever a local sigstore-go trusted_root.json is available, and stop rejecting legitimate signatures o
n a redundant TSA-window check.
internal/sigstore/localcache/localcache.go locates a sigstore-go-style cache at ~/.sigstore/root//targets/trusted_root.json by reading the mirror URL from remote.json and translating it to the on-disk
directory the same way sigstore-go does.
internal/fulcio/fulcioroots/fulcioroots.go learns to load Fulcio root and intermediate certs from that local trusted root when present, ahead of the TUF source.
internal/rekor/client.go injects Rekor public keys from the local trusted root into the gitsign Rekor client, keyed the same way cosign keys them so downstream verification helpers see an identical map.
internal/gitsign/gitsign.go routes both CT log key lookups (legacy verifier and experimental sigstore-go path) through a new helper that prefers the local trusted root and falls back to cosign's TUF-backed
loader.
internal/fork/ietf-cms/verify.go switches the TSA timestamp vs. signer-cert validity check to compare against GenTime directly with inclusive bounds, instead of the accuracy-padded bounds that were producing
false negatives on ten-minute Fulcio certs with small Fulcio-vs-TSA clock skew.