| 46 | ) |
| 47 | |
| 48 | func VerifyTimestamps(sb *bundle.Bundle, tr *TrustedRoot) error { |
| 49 | signedTimestamps, err := sb.Timestamps() |
| 50 | if err != nil { |
| 51 | if errors.Is(err, bundle.ErrMissingVerificationMaterial) { |
| 52 | return ErrMissingVerificationMaterial |
| 53 | } |
| 54 | return fmt.Errorf("could not get timestamps: %w", err) |
| 55 | } |
| 56 | if len(signedTimestamps) == 0 { |
| 57 | return ErrMissingVerificationMaterial |
| 58 | } |
| 59 | |
| 60 | if len(tr.TimestampAuthorities) == 0 { |
| 61 | return ErrNoTSARootsConfigured |
| 62 | } |
| 63 | |
| 64 | sc, err := sb.SignatureContent() |
| 65 | if err != nil { |
| 66 | return fmt.Errorf("could not get signature material: %w", err) |
| 67 | } |
| 68 | |
| 69 | signature := sc.Signature() |
| 70 | // See bug: https://github.com/chainloop-dev/chainloop/issues/1832 |
| 71 | // signature might be encoded twice. Let's try to fix it first. |
| 72 | // TODO: remove this once the bug is fixed |
| 73 | sigBytes := signature |
| 74 | dst := make([]byte, base64.RawURLEncoding.DecodedLen(len(signature))) |
| 75 | i, err := base64.StdEncoding.Decode(dst, signature) |
| 76 | if err == nil { |
| 77 | sigBytes = dst[:i] |
| 78 | } |
| 79 | |
| 80 | vc, vcErr := sb.VerificationContent() |
| 81 | if vcErr != nil && !errors.Is(vcErr, bundle.ErrMissingVerificationMaterial) { |
| 82 | return fmt.Errorf("could not get verification material: %w", vcErr) |
| 83 | } |
| 84 | |
| 85 | for _, st := range signedTimestamps { |
| 86 | if err := verifyTimestamp(st, sigBytes, vc, tr); err != nil { |
| 87 | return err |
| 88 | } |
| 89 | } |
| 90 | return nil |
| 91 | } |
| 92 | |
| 93 | // verifyTimestamp tries to verify a single signed timestamp against every |
| 94 | // configured TSA. Returns the error from the last attempted TSA on failure. |