8000 Backport 1424, prepare 3.6.3 release (#1425) · sigstore/sigstore-python@0f88940 · GitHub
[go: up one dir, main page]
Skip to content

Commit 0f88940

Browse files
jkujku
authored
Backport 1424, prepare 3.6.3 release (#1425)
* Backport #1424 Don't fail hard if trusted root contains an unknown key type: Verification may still succeed so warning is enough. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Prep 3.6.3 This release only contains a small fix for handling of unsupported keytypes in the trusted root. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> --------- Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
1 parent 6937b05 commit 0f88940

File tree

5 files changed

+37
-5
lines changed

5 files changed

+37
-5
lines changed

‎CHANGELOG.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,14 @@ All versions prior to 0.9.0 are untracked.
88

99
## [Unreleased]
1010

11+
## [3.6.3]
12+
13+
### Fixed
14+
15+
* Verify: Avoid hard failure if trusted root contains unsupported keytypes (as verification
16+
may succeed without that key).
17+
[#1425](https://github.com/sigstore/sigstore-python/pull/1425)
18+
1119
## [3.6.2]
1220

1321
### Fixed
@@ -608,7 +616,8 @@ This is a corrective release for [2.1.1].
608616

609617

610618
<!--Release URLs -->
611-
[Unreleased]: https://github.com/sigstore/sigstore-python/compare/v3.6.2...HEAD
619+
[Unreleased]: https://github.com/sigstore/sigstore-python/compare/v3.6.3...HEAD
620+
[3.6.3]: https://github.com/sigstore/sigstore-python/compare/v3.6.2...v3.6.3
612621
[3.6.2]: https://github.com/sigstore/sigstore-python/compare/v3.6.1...v3.6.2
613622
[3.6.1]: https://github.com/sigstore/sigstore-python/compare/v3.6.0...v3.6.1
614623
[3.6.0]: https://github.com/sigstore/sigstore-python/compare/v3.5.3...v3.6.0

‎sigstore/__init__.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,4 @@
2525
* `sigstore.sign`: creation of Sigstore signatures
2626
"""
2727

28-
__version__ = "3.6.2"
28+
__version__ = "3.6.3"

‎sigstore/_internal/trust.py

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
from __future__ import annotations
2020

21+
import logging
2122
from collections.abc import Iterable
2223
from dataclasses import dataclass
2324
from datetime import datetime, timezone
@@ -60,6 +61,8 @@
6061
)
6162
from sigstore.errors import Error, MetadataError, VerificationError
6263

64+
_logger = logging.getLogger(__name__)
65+
6366

6467
def _is_timerange_valid(period: TimeRange | None, *, allow_expired: bool) -> bool:
6568
"""
@@ -167,8 +170,11 @@ def __init__(self, public_keys: list[_PublicKey] = []):
167170
self._keyring: dict[KeyID, Key] = {}
168171

169172
for public_key in public_keys:
170-
key = Key(public_key)
171-
self._keyring[key.key_id] = key
173+
try:
174+
key = Key(public_key)
175+
self._keyring[key.key_id] = key
176+
except VerificationError as e:
177+
_logger.warning(f"Failed to load a trusted root key: {e}")
172178

173179
def verify(self, *, key_id: KeyID, signature: bytes, data: bytes) -> None:
174180
"""

‎test/assets/trusted_root/trustedroot.v1.json

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,20 @@
1414
"logId": {
1515
"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
1616
}
17+
},
18+
{
19+
"baseUrl": "https://example.com/unsupported_key",
20+
"hashAlgorithm": "SHA2_256",
21+
"publicKey": {
22+
"rawBytes": "",
23+
"keyDetails": "PKIX_ED25519",
24+
"validFor": {
25+
"start": "2021-01-12T11:53:27.000Z"
26+
}
27+
},
28+
"logId": {
29+
"keyId": "xNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
30+
}
1731
}
1832
],
1933
"certificateAuthorities": [

‎test/unit/internal/test_trust.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,14 @@ def test_good(self, asset):
5454
assert (
5555
root._inner.media_type == TrustedRoot.TrustedRootType.TRUSTED_ROOT_0_1.value
5656
)
57-
assert len(root._inner.tlogs) == 1
57+
assert len(root._inner.tlogs) == 2
5858
assert len(root._inner.certificate_authorities) == 2
5959
assert len(root._inner.ctlogs) == 2
6060
assert len(root._inner.timestamp_authorities) == 1
6161

62+
# only one of the two rekor keys is actually supported
63+
assert len(root.rekor_keyring(KeyringPurpose.VERIFY)._keyring) == 1
64+
6265
def test_bad_media_type(self, asset):
6366
path = asset("trusted_root/trustedroot.badtype.json")
6467

0 commit comments

Comments
 (0)
0