verifyCertSignature validates the signing certificate against the trusted root chain and verifies the DSSE envelope signature with the certificate's key.
(ctx context.Context, bundle *protobundle.Bundle, signingCert *x509.Certificate, tr *TrustedRoot)
| 95 | // verifyCertSignature validates the signing certificate against the trusted root |
| 96 | // chain and verifies the DSSE envelope signature with the certificate's key. |
| 97 | func verifyCertSignature(ctx context.Context, bundle *protobundle.Bundle, signingCert *x509.Certificate, tr *TrustedRoot) error { |
| 98 | akiSum := sha256.Sum256(signingCert.AuthorityKeyId) |
| 99 | aki := hex.EncodeToString(akiSum[:]) |
| 100 | chain, ok := tr.Keys[aki] |
| 101 | if !ok { |
| 102 | return fmt.Errorf("trusted root not found for signing key with AKI %s", aki) |
| 103 | } |
| 104 | |
| 105 | verifier, err := cosign.ValidateAndUnpackCertWithChain(signingCert, chain, &cosign.CheckOpts{IgnoreSCT: true}) |
| 106 | if err != nil { |
| 107 | return fmt.Errorf("validating the certificate: %w", err) |
| 108 | } |
| 109 | |
| 110 | dsseVerifier, err := dsse.NewEnvelopeVerifier(&sigdsee.VerifierAdapter{SignatureVerifier: verifier}) |
| 111 | if err != nil { |
| 112 | return fmt.Errorf("creating DSSE verifier: %w", err) |
| 113 | } |
| 114 | |
| 115 | if _, err := dsseVerifier.Verify(ctx, attestation.DSSEEnvelopeFromBundle(bundle)); err != nil { |
| 116 | return fmt.Errorf("validating the DSSE envelope: %w", err) |
| 117 | } |
| 118 | |
| 119 | return nil |
| 120 | } |
no test coverage detected