Skip to content

Commit 8f6e42f

Browse files
woodruffwwoodruffw
committed
enforce media types, unit tests
Signed-off-by: William Woodruff <william@trailofbits.com>
1 parent 4bb731c commit 8f6e42f

File tree

4 files changed

+300
-1
lines changed

4 files changed

+300
-1
lines changed

‎sigstore/_internal/trust.py

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,13 +222,37 @@ class TrustedRoot:
222222
The cryptographic root(s) of trust for a Sigstore instance.
223223
"""
224224

225+
class TrustedRootType(str, Enum):
226+
"""
227+
Known Sigstore trusted root media types.
228+
"""
229+
230+
TRUSTED_ROOT_0_1 = "application/vnd.dev.sigstore.trustedroot+json;version=0.1"
231+
232+
def __str__(self) -> str:
233+
"""Returns the variant's string value."""
234+
return self.value
235+
225236
def __init__(self, inner: _TrustedRoot):
226237
"""
227238
Construct a new `TrustedRoot`.
228239
229240
@api private
230241
"""
231242
self._inner = inner
243+
self._verify()
244+
245+
def _verify(self) -> None:
246+
"""
247+
Performs various feats of heroism to ensure that the trusted root
248+
is well-formed.
249+
"""
250+
251+
# The trusted root must have a recognized media type.
252+
try:
253+
TrustedRoot.TrustedRootType(self._inner.media_type)
254+
except ValueError:
255+
raise Error(f"unsupported trusted root format: {self._inner.media_type}")
232256

233257
@classmethod
234258
def from_file(

‎test/unit/assets/trust_config/config.badtype.json

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
{
2+
"mediaType": "bad-media-type",
3+
"trustedRoot": {
4+
"mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
5+
"tlogs": [
6+
{
7+
"baseUrl": "https://rekor.sigstore.dev",
8+
"hashAlgorithm": "SHA2_256",
9+
"publicKey": {
10+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==",
11+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
12+
"validFor": {
13+
"start": "2021-01-12T11:53:27.000Z"
14+
}
15+
},
16+
"logId": {
17+
"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
18+
}
19+
}
20+
],
21+
"certificateAuthorities": [
22+
{
23+
"subject": {
24+
"organization": "sigstore.dev",
25+
"commonName": "sigstore"
26+
},
27+
"uri": "https://fulcio.sigstore.dev",
28+
"certChain": {
29+
"certificates": [
30+
{
31+
"rawBytes": "MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ=="
32+
}
33+
]
34+
},
35+
"validFor": {
36+
"start": "2021-03-07T03:20:29.000Z",
37+
"end": "2022-12-31T23:59:59.999Z"
38+
}
39+
},
40+
{
41+
"subject": {
42+
"organization": "sigstore.dev",
43+
"commonName": "sigstore"
44+
},
45+
"uri": "https://fulcio.sigstore.dev",
46+
"certChain": {
47+
"certificates": [
48+
{
49+
"rawBytes": "MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="
50+
},
51+
{
52+
"rawBytes": "MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"
53+
}
54+
]
55+
},
56+
"validFor": {
57+
"start": "2022-04-13T20:06:15.000Z"
58+
}
59+
}
60+
],
61+
"ctlogs": [
62+
{
63+
"baseUrl": "https://ctfe.sigstore.dev/test",
64+
"hashAlgorithm": "SHA2_256",
65+
"publicKey": {
66+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbfwR+RJudXscgRBRpKX1XFDy3PyudDxz/SfnRi1fT8ekpfBd2O1uoz7jr3Z8nKzxA69EUQ+eFCFI3zeubPWU7w==",
67+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
68+
"validFor": {
69+
"start": "2021-03-14T00:00:00.000Z",
70+
"end": "2022-10-31T23:59:59.999Z"
71+
}
72+
},
73+
"logId": {
74+
"keyId": "CGCS8ChS/2hF0dFrJ4ScRWcYrBY9wzjSbea8IgY2b3I="
75+
}
76+
},
77+
{
78+
"baseUrl": "https://ctfe.sigstore.dev/2022",
79+
"hashAlgorithm": "SHA2_256",
80+
"publicKey": {
81+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNKAaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==",
82+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
83+
"validFor": {
84+
"start": "2022-10-20T00:00:00.000Z"
85+
}
86+
},
87+
"logId": {
88+
"keyId": "3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4="
89+
}
90+
}
91+
],
92+
"timestampAuthorities": [
93+
{
94+
"subject": {
95+
"organization": "GitHub, Inc.",
96+
"commonName": "Internal Services Root"
97+
},
98+
"certChain": {
99+
"certificates": [
100+
{
101+
"rawBytes": "MIIB3DCCAWKgAwIBAgIUchkNsH36Xa04b1LqIc+qr9DVecMwCgYIKoZIzj0EAwMwMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgaW50ZXJtZWRpYXRlMB4XDTIzMDQxNDAwMDAwMFoXDTI0MDQxMzAwMDAwMFowMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgVGltZXN0YW1waW5nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUD5ZNbSqYMd6r8qpOOEX9ibGnZT9GsuXOhr/f8U9FJugBGExKYp40OULS0erjZW7xV9xV52NnJf5OeDq4e5ZKqNWMFQwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMIMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUaW1RudOgVt0leqY0WKYbuPr47wAwCgYIKoZIzj0EAwMDaAAwZQIwbUH9HvD4ejCZJOWQnqAlkqURllvu9M8+VqLbiRK+zSfZCZwsiljRn8MQQRSkXEE5AjEAg+VxqtojfVfu8DhzzhCx9GKETbJHb19iV72mMKUbDAFmzZ6bQ8b54Zb8tidy5aWe"
102+
},
103+
{
104+
"rawBytes": "MIICEDCCAZWgAwIBAgIUX8ZO5QXP7vN4dMQ5e9sU3nub8OgwCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MB4XDTIzMDQxNDAwMDAwMFoXDTI4MDQxMjAwMDAwMFowMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEvMLY/dTVbvIJYANAuszEwJnQE1llftynyMKIMhh48HmqbVr5ygybzsLRLVKbBWOdZ21aeJz+gZiytZetqcyF9WlER5NEMf6JV7ZNojQpxHq4RHGoGSceQv/qvTiZxEDKo2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUaW1RudOgVt0leqY0WKYbuPr47wAwHwYDVR0jBBgwFoAU9NYYlobnAG4c0/qjxyH/lq/wz+QwCgYIKoZIzj0EAwMDaQAwZgIxAK1B185ygCrIYFlIs3GjswjnwSMG6LY8woLVdakKDZxVa8f8cqMs1DhcxJ0+09w95QIxAO+tBzZk7vjUJ9iJgD4R6ZWTxQWKqNm74jO99o+o9sv4FI/SZTZTFyMn0IJEHdNmyA=="
105+
},
106+
{
107+
"rawBytes": "MIIB9DCCAXqgAwIBAgIUa/JAkdUjK4JUwsqtaiRJGWhqLSowCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MB4XDTIzMDQxNDAwMDAwMFoXDTMzMDQxMTAwMDAwMFowODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEf9jFAXxz4kx68AHRMOkFBhflDcMTvzaXz4x/FCcXjJ/1qEKon/qPIGnaURskDtyNbNDOpeJTDDFqt48iMPrnzpx6IZwqemfUJN4xBEZfza+pYt/iyod+9tZr20RRWSv/o0UwQzAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQU9NYYlobnAG4c0/qjxyH/lq/wz+QwCgYIKoZIzj0EAwMDaAAwZQIxALZLZ8BgRXzKxLMMN9VIlO+e4hrBnNBgF7tz7Hnrowv2NetZErIACKFymBlvWDvtMAIwZO+ki6ssQ1bsZo98O8mEAf2NZ7iiCgDDU0Vwjeco6zyeh0zBTs9/7gV6AHNQ53xD"
108+
}
109+
]
110+
},
111+
"validFor": {
112+
"start": "2023-04-14T00:00:00.000Z"
113+
}
114+
}
115+
]
116+
},
117+
"signingConfig": {
118+
"caUrl": "https://fakeca.example.com",
119+
"oidcUrl": "https://fakeoidc.example.com",
120+
"tlogUrls": [
121+
"https://fakelog.example.com"
122+
],
123+
"tsaUrls": [
124+
"https://faketsa.example.com"
125+
]
126+
}
127+
}

‎test/unit/assets/trust_config/config.v1.json

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
{
2+
"mediaType": "application/vnd.dev.sigstore.clienttrustconfig.v0.1+json",
3+
"trustedRoot": {
4+
"mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
5+
"tlogs": [
6+
{
7+
"baseUrl": "https://rekor.sigstore.dev",
8+
"hashAlgorithm": "SHA2_256",
9+
"publicKey": {
10+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==",
11+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
12+
"validFor": {
13+
"start": "2021-01-12T11:53:27.000Z"
14+
}
15+
},
16+
"logId": {
17+
"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
18+
}
19+
}
20+
],
21+
"certificateAuthorities": [
22+
{
23+
"subject": {
24+
"organization": "sigstore.dev",
25+
"commonName": "sigstore"
26+
},
27+
"uri": "https://fulcio.sigstore.dev",
28+
"certChain": {
29+
"certificates": [
30+
{
31+
"rawBytes": "MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ=="
32+
}
33+
]
34+
},
35+
"validFor": {
36+
"start": "2021-03-07T03:20:29.000Z",
37+
"end": "2022-12-31T23:59:59.999Z"
38+
}
39+
},
40+
{
41+
"subject": {
42+
"organization": "sigstore.dev",
43+
"commonName": "sigstore"
44+
},
45+
"uri": "https://fulcio.sigstore.dev",
46+
"certChain": {
47+
"certificates": [
48+
{
49+
"rawBytes": "MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="
50+
},
51+
{
52+
"rawBytes": "MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"
53+
}
54+
]
55+
},
56+
"validFor": {
57+
"start": "2022-04-13T20:06:15.000Z"
58+
}
59+
}
60+
],
61+
"ctlogs": [
62+
{
63+
"baseUrl": "https://ctfe.sigstore.dev/test",
64+
"hashAlgorithm": "SHA2_256",
65+
"publicKey": {
66+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbfwR+RJudXscgRBRpKX1XFDy3PyudDxz/SfnRi1fT8ekpfBd2O1uoz7jr3Z8nKzxA69EUQ+eFCFI3zeubPWU7w==",
67+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
68+
"validFor": {
69+
"start": "2021-03-14T00:00:00.000Z",
70+
"end": "2022-10-31T23:59:59.999Z"
71+
}
72+
},
73+
"logId": {
74+
"keyId": "CGCS8ChS/2hF0dFrJ4ScRWcYrBY9wzjSbea8IgY2b3I="
75+
}
76+
},
77+
{
78+
"baseUrl": "https://ctfe.sigstore.dev/2022",
79+
"hashAlgorithm": "SHA2_256",
80+
"publicKey": {
81+
"rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNKAaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==",
82+
"keyDetails": "PKIX_ECDSA_P256_SHA_256",
83+
"validFor": {
84+
"start": "2022-10-20T00:00:00.000Z"
85+
}
86+
},
87+
"logId": {
88+
"keyId": "3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4="
89+
}
90+
}
91+
],
92+
"timestampAuthorities": [
93+
{
94+
"subject": {
95+
"organization": "GitHub, Inc.",
96+
"commonName": "Internal Services Root"
97+
},
98+
"certChain": {
99+
"certificates": [
100+
{
101+
"rawBytes": "MIIB3DCCAWKgAwIBAgIUchkNsH36Xa04b1LqIc+qr9DVecMwCgYIKoZIzj0EAwMwMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgaW50ZXJtZWRpYXRlMB4XDTIzMDQxNDAwMDAwMFoXDTI0MDQxMzAwMDAwMFowMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgVGltZXN0YW1waW5nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUD5ZNbSqYMd6r8qpOOEX9ibGnZT9GsuXOhr/f8U9FJugBGExKYp40OULS0erjZW7xV9xV52NnJf5OeDq4e5ZKqNWMFQwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMIMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUaW1RudOgVt0leqY0WKYbuPr47wAwCgYIKoZIzj0EAwMDaAAwZQIwbUH9HvD4ejCZJOWQnqAlkqURllvu9M8+VqLbiRK+zSfZCZwsiljRn8MQQRSkXEE5AjEAg+VxqtojfVfu8DhzzhCx9GKETbJHb19iV72mMKUbDAFmzZ6bQ8b54Zb8tidy5aWe"
102+
},
103+
{
104+
"rawBytes": "MIICEDCCAZWgAwIBAgIUX8ZO5QXP7vN4dMQ5e9sU3nub8OgwCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MB4XDTIzMDQxNDAwMDAwMFoXDTI4MDQxMjAwMDAwMFowMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEvMLY/dTVbvIJYANAuszEwJnQE1llftynyMKIMhh48HmqbVr5ygybzsLRLVKbBWOdZ21aeJz+gZiytZetqcyF9WlER5NEMf6JV7ZNojQpxHq4RHGoGSceQv/qvTiZxEDKo2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUaW1RudOgVt0leqY0WKYbuPr47wAwHwYDVR0jBBgwFoAU9NYYlobnAG4c0/qjxyH/lq/wz+QwCgYIKoZIzj0EAwMDaQAwZgIxAK1B185ygCrIYFlIs3GjswjnwSMG6LY8woLVdakKDZxVa8f8cqMs1DhcxJ0+09w95QIxAO+tBzZk7vjUJ9iJgD4R6ZWTxQWKqNm74jO99o+o9sv4FI/SZTZTFyMn0IJEHdNmyA=="
105+
},
106+
{
107+
"rawBytes": "MIIB9DCCAXqgAwIBAgIUa/JAkdUjK4JUwsqtaiRJGWhqLSowCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MB4XDTIzMDQxNDAwMDAwMFoXDTMzMDQxMTAwMDAwMFowODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZJbnRlcm5hbCBTZXJ2aWNlcyBSb290MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEf9jFAXxz4kx68AHRMOkFBhflDcMTvzaXz4x/FCcXjJ/1qEKon/qPIGnaURskDtyNbNDOpeJTDDFqt48iMPrnzpx6IZwqemfUJN4xBEZfza+pYt/iyod+9tZr20RRWSv/o0UwQzAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQU9NYYlobnAG4c0/qjxyH/lq/wz+QwCgYIKoZIzj0EAwMDaAAwZQIxALZLZ8BgRXzKxLMMN9VIlO+e4hrBnNBgF7tz7Hnrowv2NetZErIACKFymBlvWDvtMAIwZO+ki6ssQ1bsZo98O8mEAf2NZ7iiCgDDU0Vwjeco6zyeh0zBTs9/7gV6AHNQ53xD"
108+
}
109+
]
110+
},
111+
"validFor": {
112+
"start": "2023-04-14T00:00:00.000Z"
113+
}
114+
}
115+
]
116+
},
117+
"signingConfig": {
118+
"caUrl": "https://fakeca.example.com",
119+
"oidcUrl": "https://fakeoidc.example.com",
120+
"tlogUrls": [
121+
"https://fakelog.example.com"
122+
],
123+
"tsaUrls": [
124+
"https://faketsa.example.com"
125+
]
126+
}
127+
}

‎test/unit/internal/test_trust.py

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,13 @@
2222
from sigstore_protobuf_specs.dev.sigstore.common.v1 import TimeRange
2323

2424
from sigstore._internal.trust import (
25+
ClientTrustConfig,
2526
KeyringPurpose,
2627
TrustedRoot,
2728
_is_timerange_valid,
2829
)
2930
from sigstore._utils import load_pem_public_key
30-
from sigstore.errors import RootError
31+
from sigstore.errors import Error, RootError
3132

3233

3334
def test_trust_root_tuf_caches_and_requests(mock_staging_tuf, tuf_dirs):
@@ -242,3 +243,23 @@ def test_trust_root_fulcio_certs_error(tuf_asset, monkeypatch):
242243
Exception, match="Fulcio certificates not found in trusted root"
243244
):
244245
trust_root.get_fulcio_certs()
246+
247+
248+
class TestClientTrustConfig:
249+
def test_good(self, asset):
250+
path = asset("trust_config/config.v1.json")
251+
config = ClientTrustConfig.from_json(path.read_text())
252+
253+
assert config._inner.signing_config.ca_url == "https://fakeca.example.com"
254+
assert config._inner.signing_config.oidc_url == "https://fakeoidc.example.com"
255+
assert config._inner.signing_config.tlog_urls == ["https://fakelog.example.com"]
256+
assert config._inner.signing_config.tsa_urls == ["https://faketsa.example.com"]
257+
assert isinstance(config.trusted_root, TrustedRoot)
258+
259+
def test_bad_media_type(self, asset):
260+
path = asset("trust_config/config.badtype.json")
261+
262+
with pytest.raises(
263+
Error, match="unsupported client trust config format: bad-media-type"
264+
):
265+
ClientTrustConfig.from_json(path.read_text())

0 commit comments

Comments
 (0)