sigstore / sigstore-go

Go library for Sigstore signing and verification
Apache License 2.0
47 stars 25 forks source link

Support additional GeneralNames in the SubjectAlternativeName #55

Closed haydentherapper closed 3 months ago

haydentherapper commented 10 months ago

Description

See https://github.com/sigstore/sigstore-go/blob/main/pkg/fulcio/certificate/summarize.go#L64

cmurphy commented 4 months ago

https://github.com/sigstore/sigstore-go/pull/229 adds support for parsing OtherName in fulcio certificates.

The function linked is only used for parsing Fulcio certificates, and I don't think Fulcio can issue certificates with other GeneralNames as SANs: https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md

Does sigstore-go support "BYO PKI"? I'm wondering if the second bullet point needs to be completed if there's not yet an identifiable use case, or if we could elaborate on the expected workflow for a DNS-type identity.