Add support for verifying dsse-intoto #855
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
loosebazooka
force-pushed
the
dsse_support
branch
5 times, most recently
from
7a7e1b6 to
85dd2f1
Compare
|
I'm gonna split this up, make it a little easier to review. |
loosebazooka
force-pushed
the
dsse_support
branch
from
85dd2f1 to
5972db9
Compare
This was referenced Dec 18, 2024
loosebazooka
force-pushed
the
dsse_support
branch
3 times, most recently
from
299a6b0 to
d6b598c
Compare
- Verification should be able to correctly validate a bundle as cryptographically valid (VerificationOptions.empty()) - Verifiers may also include signer identity during verification - Verifiers should extract the embedded attestation to do further analysis on the attestation. Sigstore-java does not process those in any way - There is no signing options for DSSE bundles Signed-off-by: Appu Goundan <[email protected]>
loosebazooka
force-pushed
the
dsse_support
branch
from
d6b598c to
0ff3ffb
Compare
patflynn
reviewed
Dec 21, 2024
| var digestBytes = Hex.decode(subject.getDigest().get("sha256")); | ||
| return Arrays.equals(artifactDigest, digestBytes); | ||
| } catch (DecoderException de) { | ||
| // ignore (assume false) |
There was a problem hiding this comment.
I'm not super sure, if it fails then we'll see a keyless verification exception and users can debug at that point? I guess I can add one in a followup.
patflynn
approved these changes
Dec 21, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
needs #873 #872