Class: Sigstore::Policy::Identity

Inherits:
Object
  • Object
show all
Defined in:
lib/sigstore/policy.rb

Instance Method Summary collapse

Constructor Details

#initialize(identity:, issuer:) ⇒ Identity

Returns a new instance of Identity.



83
84
85
86
 
# File 'lib/sigstore/policy.rb', line 83

def initialize(identity:, issuer:)
  @identity = identity
  @issuer = AnyOf.new(OIDCIssuer.new(issuer), OIDCIssuerV2.new(issuer))
end

Instance Method Details

#verify(cert) ⇒ Object

Raises:



88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'lib/sigstore/policy.rb', line 88

def verify(cert)
  issuer_verified = @issuer.verify(cert)
  return issuer_verified unless issuer_verified.verified?

  san_ext = cert.extension(Sigstore::Internal::X509::Extension::SubjectAlternativeName)
  raise Error::InvalidCertificate, "Certificate does not contain subjectAltName extension" unless san_ext

  verified = san_ext.general_names.any? { |_, id| id == @identity }
  unless verified
    return VerificationFailure.new(
      "Certificate's SANs do not match #{@identity}; actual SANs: #{san_ext.general_names}"
    )
  end

  VerificationSuccess.new
end