The verifier runs parameter substitution multiple times until the output string is the same as the input string. This allows for nested parameter substitution as seen in the current npm-sigstore example. However, the implementation lacked a check to ensure a parameter's value didn't refer to the same parameter.
The verifier runs parameter substitution multiple times until the output string is the same as the input string. This allows for nested parameter substitution as seen in the current npm-sigstore example. However, the implementation lacked a check to ensure a parameter's value didn't refer to the same parameter.