verifyTimestamp tries to verify a single signed timestamp against every configured TSA. Returns the error from the last attempted TSA on failure.
(st []byte, sigBytes []byte, vc verify.VerificationContent, tr *TrustedRoot)
| 93 | // verifyTimestamp tries to verify a single signed timestamp against every |
| 94 | // configured TSA. Returns the error from the last attempted TSA on failure. |
| 95 | func verifyTimestamp(st []byte, sigBytes []byte, vc verify.VerificationContent, tr *TrustedRoot) error { |
| 96 | var lastErr error |
| 97 | for _, tsa := range tr.TimestampAuthorities { |
| 98 | tsaCert := tsa[0] |
| 99 | var roots []*x509.Certificate |
| 100 | var intermediates []*x509.Certificate |
| 101 | if len(tsa) > 1 { |
| 102 | roots = tsa[len(tsa)-1:] |
| 103 | intermediates = tsa[1 : len(tsa)-1] |
| 104 | } |
| 105 | |
| 106 | ts, err := verification.VerifyTimestampResponse(st, bytes.NewReader(sigBytes), |
| 107 | verification.VerifyOpts{ |
| 108 | TSACertificate: tsaCert, |
| 109 | Intermediates: intermediates, |
| 110 | Roots: roots, |
| 111 | }) |
| 112 | if err != nil { |
| 113 | lastErr = fmt.Errorf("%w: %w", ErrTSAResponseInvalid, err) |
| 114 | continue |
| 115 | } |
| 116 | |
| 117 | if ts.Time.After(tsaCert.NotAfter) || ts.Time.Before(tsaCert.NotBefore) { |
| 118 | lastErr = fmt.Errorf("%w: timestamp=%s, cert validity=[%s, %s]", |
| 119 | ErrTimestampOutsideTSAValidity, ts.Time, tsaCert.NotBefore, tsaCert.NotAfter) |
| 120 | continue |
| 121 | } |
| 122 | |
| 123 | if vc != nil && vc.Certificate() != nil && !vc.ValidAtTime(ts.Time, nil) { |
| 124 | lastErr = fmt.Errorf("%w: timestamp=%s", ErrSigningCertNotValidAtTimestamp, ts.Time) |
| 125 | continue |
| 126 | } |
| 127 | |
| 128 | return nil |
| 129 | } |
| 130 | return lastErr |
| 131 | } |