Pass verifier

cmd/gcp/main.go

@@ -200,13 +200,13 @@ func awaitSignal(doneFn func()) {
 	doneFn()
 }
 
-func newGCPStorage(ctx context.Context, signer note.Signer) (*sctfe.CTStorage, error) {
+func newGCPStorage(ctx context.Context, signer note.Signer, verifier note.Verifier) (*sctfe.CTStorage, error) {
 	gcpCfg := gcpTessera.Config{
 		ProjectID: *projectID,
 		Bucket:    *bucket,
 		Spanner:   *spannerDB,
 	}
-	tesseraStorage, err := gcpTessera.New(ctx, gcpCfg, tessera.WithCheckpointSignerVerifier(signer, nil), tessera.WithCTLayout())
+	tesseraStorage, err := gcpTessera.New(ctx, gcpCfg, tessera.WithCheckpointSignerVerifier(signer, verifier), tessera.WithCTLayout())
 	if err != nil {
 		return nil, fmt.Errorf("Failed to initialize GCP Tessera storage: %v", err)
 	}

go.mod

@@ -42,6 +42,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cisco/go-tls-syntax v0.0.0-20200617162716-46b0cfb76b9b // indirect
 	github.com/cncf/xds/go v0.0.0-20240905190251-b4127c9b8d78 // indirect
 	github.com/envoyproxy/go-control-plane v0.13.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.1.0 // indirect

go.sum

@@ -664,6 +664,8 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cisco/go-tls-syntax v0.0.0-20200617162716-46b0cfb76b9b h1:Ves2turKTX7zruivAcUOQg155xggcbv3suVdbKCBQNM=
+github.com/cisco/go-tls-syntax v0.0.0-20200617162716-46b0cfb76b9b/go.mod h1:0AZAV7lYvynZQ5ErHlGMKH+4QYMyNCFd+AiL9MlrCYA=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=

instance.go

@@ -25,16 +25,19 @@ import (
 	"github.com/google/certificate-transparency-go/asn1"
 	"github.com/google/certificate-transparency-go/x509util"
 	"github.com/google/trillian/monitoring"
+	tnote "github.com/transparency-dev/formats/note"
 	"golang.org/x/mod/sumdb/note"
 )
 
+type createStorageFunc func(context.Context, note.Signer, note.Verifier) (*CTStorage, error)
+
 // InstanceOptions describes the options for a log instance.
 type InstanceOptions struct {
 	// Validated holds the original configuration options for the log, and some
 	// of its fields parsed as a result of validating it.
 	Validated *ValidatedLogConfig
 	// CreateStorage instantiates a Tessera storage implementation with a signer option.
-	CreateStorage func(context.Context, note.Signer) (*CTStorage, error)
+	CreateStorage createStorageFunc
 	// Deadline is a timeout for Tessera requests.
 	Deadline time.Duration
 	// MetricFactory allows creating metrics.
@@ -92,10 +95,19 @@ func SetUpInstance(ctx context.Context, opts InstanceOptions) (*Instance, error)
 	timeSource := new(SystemTimeSource)
 	ctSigner := NewCpSigner(cfg.Signer, cfg.Origin, logID, timeSource)
 
+	vkey, err := tnote.RFC6962VerifierString(cfg.Origin, cfg.Signer.Public())
+	if err != nil {
+		return nil, fmt.Errorf("failed to create verifier key: %v", err)
+	}
+	ctVerifier, err := tnote.NewRFC6962Verifier(vkey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create verifier: %v", err)
+	}
+
 	if opts.CreateStorage == nil {
 		return nil, fmt.Errorf("failed to initiate storage backend: nil createStorage")
 	}
-	storage, err := opts.CreateStorage(ctx, ctSigner)
+	storage, err := opts.CreateStorage(ctx, ctSigner, ctVerifier)
 	if err != nil {
 		return nil, fmt.Errorf("failed to initiate storage backend: %v", err)
 	}

instance_test.go

@@ -30,7 +30,7 @@ import (
 	"golang.org/x/mod/sumdb/note"
 )
 
-func fakeCTStorage(_ context.Context, _ note.Signer) (*CTStorage, error) {
+func fakeCTStorage(_ context.Context, _ note.Signer, _ note.Verifier) (*CTStorage, error) {
 	return &CTStorage{}, nil
 }
 
@@ -52,7 +52,7 @@ func TestSetUpInstance(t *testing.T) {
 		extKeyUsages     string
 		rejectExtensions string
 		signer           crypto.Signer
-		ctStorage        func(context.Context, note.Signer) (*CTStorage, error)
+		ctStorage        createStorageFunc
 		wantErr          string
 	}{
 		{
@@ -150,7 +150,7 @@ func TestSetUpInstance(t *testing.T) {
 			spannerDB:    "spanner",
 			rootsPemFile: "./testdata/fake-ca.cert",
 			signer:       signer,
-			ctStorage: func(_ context.Context, _ note.Signer) (*CTStorage, error) {
+			ctStorage: func(_ context.Context, _ note.Signer, _ note.Verifier) (*CTStorage, error) {
 				return nil, fmt.Errorf("I failed")
 			},
 			wantErr: "failed to initiate storage backend",