Create NoteVerifier, verification library functions (v2) #119
Conversation
Signed-off-by: Hayden B <8418760+haydentherapper@users.noreply.github.com>
Refactor keyid calculation out of both constructors Also remove the unused context argument Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
* Use SafeInt64 * fix VerifyLogEntry error return value Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #119 +/- ##
==========================================
+ Coverage 21.61% 26.84% +5.23%
==========================================
Files 27 29 +2
Lines 1712 1892 +180
==========================================
+ Hits 370 508 +138
- Misses 1308 1346 +38
- Partials 34 38 +4 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
tessera functions accept the sumdb Verifier so this likely makes client
code more consistent: it does mean caller needs to handle
v, e := note.NewNoteVerifier(origin, verifier)
if they have a signature.Verifier.
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
| switch pk := pubKey.(type) { | ||
| var err error | ||
|
|
||
| switch pk := key.(type) { | ||
| case *ecdsa.PublicKey: | ||
| keyID, err = ecdsaKeyHash(pk) |
There was a problem hiding this comment.
unlike other keytypes, ecdsaKeyHash does not hash "origin". I don't have the context to understand if this is an issue or no
There was a problem hiding this comment.
This is correct. This is the context:
https://github.com/C2SP/C2SP/blob/8991f70ddf8a11de3a68d5a081e7be27e59d87c8/signed-note.md#:~:text=Note%20that%20the%20key%20ID%20for%20these%20signatures%20is%20the%20truncated%20SHA%2D256%20hash%20of%20the%20DER%20encoded%20public%20key%20in%20SPKI%20format.
sigstore/rekor#2062
|
I've had a first look at the tests and I think I will need a bit of help there, I'm not really sure how to generate the test data. I will have another go on monday but feel free to leave ideas here if you have some |
There was a problem hiding this comment.
I looked into testing here, we kind of have 2 options:
- we assume the underlying note library is reliable and just ensure we are calling it correctly by calling it directly in a test and comparing the result.
- manually generate a note and sign it and then compare the result from an out of band signing.
|
@jku here's a starting point for the tests: https://gist.github.com/cmurphy/30e1beb758fe952959a27320c0a8d141 For For |
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
* Tests are roughly like TestInclusion TestCheckpoint in https://github.com/sigstore/rekor/blob/main/pkg/verify/verify_test.go (the entry content is from there as well) * The signed checkpoint envelope creation in TestVerifyCheckpoint is from https://github.com/transparency-dev/trillian-tessera/blob/ae724376e1ace4046767511c72c6006bde3ec87e/append_lifecycle.go#L298-L316 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Also refactor a bit, to avoid unnecessary error handling Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
This comment was marked as outdated.
This comment was marked as outdated.
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
This replaces #114:
note.Verifieras argument on colleens suggestionverify