sigstore / sigstore-java

java clients for sigstore
Apache License 2.0
37 stars 20 forks source link

Inclusion proof is required #658

Closed loosebazooka closed 5 months ago

loosebazooka commented 5 months ago

This makes inclusion proof on entry.verification not optional.

Verification of an entry implies the inclusion proof will also be verified.

Rework the code a bit to reflect this and update tests.

Why? Inclusion proof being optional was a function of rekor initially not providing an inclusion proof when an entry was inserted into the log. Now, at insertion time, the returned entry contains a proof.

Consequences? v1 bundles generated without an inclusion proof will fail to verify.