Support cpython bundles & fix dsse 0.0.1 entries (#125)

sigstore · Oct 1, 2024 · e9341d7 · e9341d7
1 parent bed56a6
commit e9341d7
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 2 deletions.
diff --git a/lib/sigstore/internal/x509.rb b/lib/sigstore/internal/x509.rb
@@ -308,6 +308,8 @@ def parse_value(value)
               tag = general_name.tag
 
               case tag
+              when 1
+                [:otherName, general_name.value]
               when 6
                 [:uniformResourceIdentifier, general_name.value]
               else

diff --git a/lib/sigstore/models.rb b/lib/sigstore/models.rb
@@ -262,7 +262,7 @@ def expected_dsse_0_0_1_tlog_entry
             dsse_envelope.signatures.map do |sig|
               {
                 "signature" => Internal::Util.base64_encode(sig.sig),
-                "verifier" => Internal::Util.base64_encode(certificate.to_pem)
+                "verifier" => Internal::Util.base64_encode(leaf_certificate.to_pem)
               }
             end
         }

diff --git a/lib/sigstore/policy.rb b/lib/sigstore/policy.rb
@@ -90,7 +90,7 @@ def verify(cert)
         san_ext = cert.extension(Sigstore::Internal::X509::Extension::SubjectAlternativeName)
         raise Error::InvalidCertificate, "Certificate does not contain subjectAltName extension" unless san_ext
 
-        verified = san_ext.general_names.include?([:uniformResourceIdentifier, @identity])
+        verified = san_ext.general_names.any? { |_, id| id == @identity }
         unless verified
           return VerificationFailure.new(
             "Certificate's SANs do not match #{@identity}; actual SANs: #{san_ext.general_names}"