feat: Add option for configuring trust when validating identity assertions (CAI-7980) #1239
Conversation
…ather than a reference (Supports upcoming work I'm planning around configuring trust for reading CAWG identity assertions.)
|
This builds on #1238. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1239 +/- ##
==========================================
+ Coverage 78.28% 78.33% +0.05%
==========================================
Files 153 153
Lines 39157 39243 +86
==========================================
+ Hits 30653 30742 +89
+ Misses 8504 8501 -3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
I would _expect_ cose_verifier.verify_signature_async to log an error but not abort out if the cert is untrusted.
Need to plumb assertion label through to sig validation
Will have to consult with Gavin to figure out how to re-enable these.
scouten-adobe
changed the title
|
@gpeacock when you're back, I'll need your advice on how to approach the c2patool tests that I disabled. |
cli/tests/integration.rs
Outdated
| Ok(()) | ||
| } | ||
|
|
||
| // DO NOT MERGE with this test disabled. The problem is that the |
There was a problem hiding this comment.
Why not let if fail then to block merging?
cli/tests/integration.rs
Outdated
| // underlying CAWG code now enforces trust list checks on any X.509 | ||
| // certificate used in an identity assertion. I _think_ this test | ||
| // asset uses a test-quality cert and that isn't enabled by default. | ||
| // Will need to consult with Gavin on a new fix approach before |
There was a problem hiding this comment.
I updated this recently I created it with the cawg_identity example,
cargo r --example cawg_identity tests/fixtures/C.jpg target/C_with_CAWG_data.jpg
It uses test certs like this:
For testing we allow test certs to be in the trust list. Ask Maurice about that.
const CAWG_CERTS: &[u8] = include_bytes!("../../sdk/tests/fixtures/certs/ed25519.pub");
const CAWG_PRIVATE_KEY: &[u8] = include_bytes!("../../sdk/tests/fixtures/certs/ed25519.pem");
sdk/src/cose_sign.rs
Outdated
| let mut passthrough_cap = CertificateTrustPolicy::default(); | ||
|
|
||
| // allow user EKUs through this check if configured | ||
| // TODO: Need to determine if we're using C2PA or CAWG trust config here. |
There was a problem hiding this comment.
Do you have a different set of EKUs?
|
Per conversation with @gpeacock and @mauricefisher64, this is ready to go once the c2patool issues are resolved. Use |
scouten-adobe
added
the
check-release
No description provided.