From 283468c6b4144d3b64d5f89f72ad900349fc7c83 Mon Sep 17 00:00:00 2001 From: aryadeepta Date: Sun, 23 Aug 2026 13:13:27 -0400 Subject: [PATCH] tests: verify current issuer certificates Signed-off-by: aryadeepta --- test/assets/new_bundle.txt | 1 + test/assets/new_bundle.txt.sigstore.json | 1 + test/unit/verify/test_verifier.py | 7 +++++++ 3 files changed, 9 insertions(+) create mode 100644 test/assets/new_bundle.txt create mode 100644 test/assets/new_bundle.txt.sigstore.json diff --git a/test/assets/new_bundle.txt b/test/assets/new_bundle.txt new file mode 100644 index 000000000..5a31fff92 --- /dev/null +++ b/test/assets/new_bundle.txt @@ -0,0 +1 @@ +Sigstore current issuer certificate regression test diff --git a/test/assets/new_bundle.txt.sigstore.json b/test/assets/new_bundle.txt.sigstore.json new file mode 100644 index 000000000..d95104202 --- /dev/null +++ b/test/assets/new_bundle.txt.sigstore.json @@ -0,0 +1 @@ +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIDKzCCArGgAwIBAgIUJiGJMelrs1z3dgQuQIeDVK8WBsAwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwODIzMTcwMTU5WhcNMjYwODIzMTcxMTU5WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECKQdwaQrghOdjlVU4d77nMsYD5XpAfoEm1z83NKYfUnFV50Nw1wE1wPliPZsPcLYXoassXSMfdVszqkohCf9sqOCAdAwggHMMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUirE3C5S9D2942AYmz2kwW72cUw0wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wJAYDVR0RAQH/BBowGIEWYXJ5YWRlZXB0YWRlQGdtYWlsLmNvbTAsBgorBgEEAYO/MAEBBB5odHRwczovL2dpdGh1Yi5jb20vbG9naW4vb2F1dGgwLgYKKwYBBAGDvzABCAQgDB5odHRwczovL2dpdGh1Yi5jb20vbG9naW4vb2F1dGgwUwYKKwYBBAGDvzABGARFDENDZ2d6T0RnME5qVTNOeEltYUhSMGNITTZKVEpHSlRKR1oybDBhSFZpTG1OdmJTVXlSbXh2WjJsdUpUSkdiMkYxZEdnMIGLBgorBgEEAdZ5AgQCBH0EewB5AHcA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGgL5JqjgAABAMASDBGAiEArZVhgUnG20asXAYj9WoFJyCEv6mqqZOEAAvtueJehZ0CIQCSfuQOcQyY7Sng425/vW53AAjbwqy+EQr+79U8GGxIwTAKBggqhkjOPQQDAwNoADBlAjBxwssyt5SLzGIRLQFJeSTvV9TurQ2GtT5oE+TMAV3iGklq6jU//AbjkeP2I8pr5pUCMQD3sJ0lx7jMooCKubWUVD6ZvVYC6C9wjfKmks2bTcfx3O6hsPXKGKDDc+wNnrYrAFA="},"tlogEntries":[{"logIndex":"2574120827","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"hashedrekord","version":"0.0.1"},"integratedTime":"1787504520","inclusionPromise":{"signedEntryTimestamp":"MEQCIBwEA8wIsu6qTwwIp7QC+iPZtdu7FyILt7pbqN2R6AntAiBMctC4TiR51i8fy1j4BVPgFdhCyUHHSs1DxIu0HZItNA=="},"inclusionProof":{"logIndex":"2452216565","rootHash":"bZRdG2DzhbAM0tXVNm4NLZzG8jXjYdzCKTxkKGf2HFM=","treeSize":"2452216574","hashes":["NpmdUGXNwgqHuxWwZKsIm/ST7pn4xZK0h9//91fZSs0=","iZvpWmECS6hAGvCwCNDsrcy+efHlMLipx3bbuMVsRLk=","wj9iP8xd7c6sVqxlxQJq3+/ywgyw33n/RTt3RvBCdjU=","cgRBJINWj/O5PDxO2SpZzGxSaEgPvMAlWr3Bj1dJUdw=","+ULalR8+1XOzr93gN7MKsewBplUnOkX2eMbW5WR3r70=","y3oRUL0fsQRVq0m6AjHVrTWZvCPMk59B9Qj9mIlMGDM=","AgQmD6v+WhM9rU+6q3qjxUgwMKeiFmVxZ0JXb42hX8I=","QIF6axtIw8xYmoMkIlcOVfZcOL1bHJu02MutkGXFxg8=","2G+WoIWgZXFK854yAwq+yGYMkh3X3IDYV3bd/J5HQ14=","iaSq9DDbHyCQMrvKPWK1ICVU6wtJTMyXSxT/nI3ExZk=","+NL7cNmFP6DMG3a8VwQendTYKu2q1y4EOVG2xW6Wi0M=","j81M8zXYxbAn0OslcxQXwMQjz3r6VF3FOQ8hZrpAg/k=","OO08UQf1SoA9x6RkUY95+CVBFpBK995rFyejrGQNXLQ=","a038EffyREAq1TRVeWn52k/C5q9QCPwltQhYu6ZhOnQ=","3E6tOWc9nApPxgmBB/oWCo2wMMidTnBnApvCV0gHTqw=","BhEuzCVJpbDOuqS72hVuBU6zdoGBIUFXfNPh54jFq4c=","b80/J/68RC8/tx5xRdlKk6MmTpZiVRotquWBrE/z1pI=","SndbMKVtcTenAkwi2JBfGzD+mhexp1qJbRIY+A1JRIU=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2452216574\nbZRdG2DzhbAM0tXVNm4NLZzG8jXjYdzCKTxkKGf2HFM=\n\n— rekor.sigstore.dev wNI9ajBEAiBhr696IzcDtU4TdMeY2+OLss7fzbvkrs4Lz81epuE2swIgTj48m22doAKpi8TE7yzF4MGPEew2Lj9QlEsLYtTgfYU=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhN2RkYmJlM2ZhYWQxZTk2NDZmMDdkOTIzMTFiYTk1MGQxMGMyYzQ0NDFlNThlYTk5MzVkYThkZDcwMTc5NGRhIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJQm1PalMzQzlyY1FFYktGN0liUmJCOTIwRjQyZTNLbUl3SGJXVVV6SG0ya0FpQTdQWEg0VWpQQVBLVW5QU1FkcVd3aXZlNWI4QW9Nekk5emtCbEdNb29mR2c9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUkxla05EUVhKSFowRjNTVUpCWjBsVlNtbEhTazFsYkhKek1Yb3paR2RSZFZGSlpVUldTemhYUW5OQmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlFU1hwTlZHTjNUVlJWTlZkb1kwNU5hbGwzVDBSSmVrMVVZM2hOVkZVMVYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZEUzFGa2QyRlJjbWRvVDJScWJGWlZOR1EzTjI1TmMxbEVOVmh3UVdadlJXMHhlamdLTTA1TFdXWlZia1pXTlRCT2R6RjNSVEYzVUd4cFVGcHpVR05NV1ZodllYTnpXRk5OWm1SV2MzcHhhMjlvUTJZNWMzRlBRMEZrUVhkblowaE5UVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZwY2tVekNrTTFVemxFTWprME1rRlpiWG95YTNkWE56SmpWWGN3ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBwQldVUldVakJTUVZGSUwwSkNiM2RIU1VWWFdWaEtOVmxYVW14YVdFSXdXVmRTYkZGSFpIUlpWMnh6VEcxT2RtSlVRWE5DWjI5eVFtZEZSUXBCV1U4dlRVRkZRa0pDTlc5a1NGSjNZM3B2ZGt3eVpIQmtSMmd4V1drMWFtSXlNSFppUnpsdVlWYzBkbUl5UmpGa1IyZDNUR2RaUzB0M1dVSkNRVWRFQ25aNlFVSkRRVkZuUkVJMWIyUklVbmRqZW05MlRESmtjR1JIYURGWmFUVnFZakl3ZG1KSE9XNWhWelIyWWpKR01XUkhaM2RWZDFsTFMzZFpRa0pCUjBRS2RucEJRa2RCVWtaRVJVNUVXakprTmxRd1VtNU5SVFZ4VmxST1QyVkZiSFJaVldoVFRVZE9TVlJVV2t0V1JYQklVMnhTUzFJeGIzbGlSRUpvVTBaYWNBcFVSekZQWkcxS1ZGWlliRk5pV0dneVYycEtjMlJWY0ZWVGEyUnBUV3RaZUZwRlpHNU5TVWRNUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJTUVWbGQwSTFDa0ZJWTBFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIyZE1OVXB4YW1kQlFVSkJUVUVLVTBSQ1IwRnBSVUZ5V2xab1oxVnVSekl3WVhOWVFWbHFPVmR2UmtwNVEwVjJObTF4Y1ZwUFJVRkJkblIxWlVwbGFGb3dRMGxSUTFObWRWRlBZMUY1V1FvM1UyNW5OREkxTDNaWE5UTkJRV3BpZDNGNUswVlJjaXMzT1ZVNFIwZDRTWGRVUVV0Q1oyZHhhR3RxVDFCUlVVUkJkMDV2UVVSQ2JFRnFRbmgzYzNONUNuUTFVMHg2UjBsU1RGRkdTbVZUVkhaV09WUjFjbEV5UjNSVU5XOUZLMVJOUVZZemFVZHJiSEUyYWxVdkwwRmlhbXRsVURKSk9IQnlOWEJWUTAxUlJETUtjMG93YkhnM2FrMXZiME5MZFdKWFZWWkVObHAyVmxsRE5rTTVkMnBtUzIxcmN6SmlWR05tZUROUE5taHpVRmhMUjB0RVJHTXJkMDV1Y2xseVFVWkJQUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In19fX0="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIIE6TADAgEAMIIE4AYJKoZIhvcNAQcCoIIE0TCCBM0CAQMxDTALBglghkgBZQMEAgEwgcEGCyqGSIb3DQEJEAEEoIGxBIGuMIGrAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgJKld1pIeS27syu919c1Tts/BLmedCnrq1nhtDlsv5pECFDhjE7XLe5luF/0vdoB6VSOHxvOSGA8yMDI2MDgyMzE3MDIwMFowAwIBAQIIFqbAD3T64pWgMqQwMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhoIICFDCCAhAwggGWoAMCAQICFDoTVC8MkGHuvMFDL8uKjosqI4sMMAoGCCqGSM49BAMDMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQwHhcNMjUwNDA4MDY1OTQzWhcNMzUwNDA2MDY1OTQzWjAuMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxFTATBgNVBAMTDHNpZ3N0b3JlLXRzYTB2MBAGByqGSM49AgEGBSuBBAAiA2IABOK2tmfISjYoNk/ZBYwgE6Bht9I5MvlkL9wcy/pir4dUijUf1MLsLHzQoOLK8qGAHfBOorKL1QNzOGqDXZvUA4udGfJ0xMr6oHwz7UyMFyLX4lvwBX9Ve7sJG5AKI9McXKNqMGgwDgYDVR0PAQH/BAQDAgeAMB0GA1UdDgQWBBSJ/XlDh8/QZUbDAkbHLHNbfbTrAzAfBgNVHSMEGDAWgBSY7AHvf7tR/9SVHm+KiJhTB4nOvzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAKBggqhkjOPQQDAwNoADBlAjA7abFf+imjtKshf1DLF9mklFykBXaBk6bUBnNH7atXLLpRzxhunbJsjDXdyQfhtxECMQDmo7wXI6SZim+Db/tk2qI/FHOfm+ooehVwgiq2kqrqXtO86rMDHFyU3tXBMbx775cxggHbMIIB1wIBATBRMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQCFDoTVC8MkGHuvMFDL8uKjosqI4sMMAsGCWCGSAFlAwQCAaCB/DAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MDgyMzE3MDIwMFowLwYJKoZIhvcNAQkEMSIEIFiv2oC+bmmYnu7s0Q9AMHci+4iBjppjBiS8WYquXDGaMIGOBgsqhkiG9w0BCRACLzF/MH0wezB5BCCF+Se8B6tiysO0Q1bBDvyBssaIP9p6uebYcNnROs0FtzBVMD2kOzA5MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIDAeBgNVBAMTF3NpZ3N0b3JlLXRzYS1zZWxmc2lnbmVkAhQ6E1QvDJBh7rzBQy/Lio6LKiOLDDAKBggqhkjOPQQDAgRnMGUCMQCw0Wfd3pAUlIxkIRjHQZfIdctZqAmLG1MzBGhgm2DL8SxrtUKC4pOeSAm91lC5ZVkCMAtxsVoGvUH6+lkdkYNSS+7tqSnT/Nl6ah5ZuZ3YhPoPIvjSpOXwkGW/068AyWQY/g=="}]}},"messageSignature":{"messageDigest":{"algorithm":"SHA2_256","digest":"p9274/qtHpZG8H2SMRupUNEMLERB5Y6pk12o3XAXlNo="},"signature":"MEQCIBmOjS3C9rcQEbKF7IbRbB920F42e3KmIwHbWUUzHm2kAiA7PXH4UjPAPKUnPSQdqWwive5b8AoMzI9zkBlGMoofGg=="}} diff --git a/test/unit/verify/test_verifier.py b/test/unit/verify/test_verifier.py index 81287e7f6..2f6763ec4 100644 --- a/test/unit/verify/test_verifier.py +++ b/test/unit/verify/test_verifier.py @@ -123,6 +123,13 @@ def test_verifier_bundle_offline(signing_bundle, null_policy, filename): verifier.verify_artifact(file.read_bytes(), bundle, null_policy) +def test_verifier_current_issuer_certificate(signing_bundle, null_policy): + (file, bundle) = signing_bundle("new_bundle.txt") + + verifier = Verifier.production(offline=True) + verifier.verify_artifact(file.read_bytes(), bundle, null_policy) + + def test_verifier_certificate_chain_rejects_invalid_time(signing_bundle): _, bundle = signing_bundle("bundle.txt") verifier = Verifier.staging(offline=True)