search

sigstore / sigstore-rs

An experimental Rust crate for sigstore
https://sigstore.github.io/sigstore-rs/sigstore/
Apache License 2.0
156 stars 48 forks source link

blob verification fails when used with unsanitized base64 signature strings #288

Open jleightcap opened 11 months ago

jleightcap commented 11 months ago

Description

When verifying a signature passed via a file, trailing newlines are not sanitized.

Using the verify_blob API with a signature file generated by sigstore-python, verify_signature fails with

Error: Invalid byte 10, offset 96.

the root issue seems to be differing signature files generated between sigstore-python and cosign (e.g. https://github.com/sigstore/sigstore-rs/tree/main/examples/cosign/verify-blob#sign-the-artifacttxt-file-using-cosign).

(byte 10 == '\n')

This is pretty easily fixed with a .trim() at the fs::read_to_string callsite, but compatibility doesn't seem guaranteed between sigstore clients.

Version

https://github.com/sigstore/sigstore-rs/commit/e23046c72ecaf3d4fd63540ed538d8972ac61468

jleightcap commented 11 months ago

(CC @woodruffw)