Verify manifest timestamps

IB-8180

Signed-off-by: Raul Metsma <raul@metsma.ee>

Author: metsma

.github/workflows/build.yml

@@ -17,7 +17,7 @@ jobs:
         target: [macos, iphoneos, iphonesimulator]
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Install dependencies
       run: |
         brew update
@@ -81,7 +81,7 @@ jobs:
           triplet: x64-android
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Expose Android NDK env
       shell: bash
       run: |
@@ -118,14 +118,14 @@ jobs:
     container: fedora:${{ matrix.container }}
     strategy:
       matrix:
-        container: [41, 42, rawhide]
+        container: [41, 42, 43, rawhide]
     steps:
     - name: Install Deps
       run: |
         dnf install -y --setopt=install_weak_deps=False \
           ${FEDORA_DEPS} doxygen boost-test swig python3-devel java-21-openjdk-devel rpm-build
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Build
       run: |
         cmake -DCMAKE_INSTALL_SYSCONFDIR=/etc -B build -S .
@@ -142,7 +142,7 @@ jobs:
     container: ubuntu:${{ matrix.container }}
     strategy:
       matrix:
-        container: ['22.04', '24.04', '25.04']
+        container: ['22.04', '24.04', '25.04', '25.10']
         arch: ['amd64', 'arm64']
     env:
       DEBIAN_FRONTEND: noninteractive
@@ -152,7 +152,7 @@ jobs:
     - name: Install dependencies
       run: apt update -qq && apt install --no-install-recommends -y lsb-release build-essential devscripts debhelper lintian pkg-config ${UBUNTU_DEPS} doxygen swig openjdk-17-jdk-headless libpython3-dev python3-setuptools libboost-test-dev
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Setup changelog
       run: |
         export VERSION=$(grep project CMakeLists.txt | egrep -o "([0-9]{1,}\.)+[0-9]{1,}")
@@ -188,7 +188,7 @@ jobs:
       CXXFLAGS: '/D_DISABLE_CONSTEXPR_MUTEX_CONSTRUCTOR' # https://github.com/actions/runner-images/issues/10004
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Cache vcpkg
       uses: actions/cache@v4
       with:
@@ -235,7 +235,7 @@ jobs:
       contents: write
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Install dependencies
       run: sudo apt update -qq && sudo apt install --no-install-recommends -y doxygen ${UBUNTU_DEPS}
     - name: Build docs
@@ -257,7 +257,7 @@ jobs:
       PROJECTNAME: ${{ github.repository }}
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Install dependencies
       run: sudo apt update -qq && sudo apt install --no-install-recommends -y curl ca-certificates ${UBUNTU_DEPS}
     - name: Download Coverity Build Tool
@@ -292,7 +292,7 @@ jobs:
       security-events: write
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Install dependencies
       run: sudo apt update -qq && sudo apt install --no-install-recommends -y ${UBUNTU_DEPS}
     - name: Initialize CodeQL

src/SignatureTST.cpp

@@ -39,6 +39,8 @@
 using namespace digidoc;
 using namespace std;
 
+constexpr const char* TST_MIMETYPE {"application/vnd.etsi.timestamp-token"};
+
 struct SignatureTST::Data {
     string name, mime, data;
     unique_ptr<map<string, vector<unsigned char>>> cache = make_unique<map<string, vector<unsigned char>>>();
@@ -59,7 +61,7 @@ struct SignatureTST::Data {
         if (auto it = cache->find(method); it != cache->cend()) {
             return it->second;
         }
-        return (*cache)[std::move(method)] = digest({method}).result();
+        return (*cache)[std::move(method)] = digest(Digest(method)).result();
     }
 };
 
@@ -94,7 +96,7 @@ SignatureTST::SignatureTST(bool manifest, const ZipSerialize &z, ASiC_S *asicSDo
             }
         }
     }
-    metadata.emplace_back("META-INF/timestamp.tst", "application/vnd.etsi.timestamp-token", std::move(data));
+    metadata.emplace_back("META-INF/timestamp.tst", TST_MIMETYPE, std::move(data));
 }
 
 SignatureTST::SignatureTST(ASiC_S *asicSDoc, Signer *signer)
@@ -105,7 +107,7 @@ SignatureTST::SignatureTST(ASiC_S *asicSDoc, Signer *signer)
     dataFile->digest(digest);
     timestampToken = make_unique<TS>(digest, signer->userAgent());
     vector<unsigned char> der = *timestampToken;
-    metadata.emplace_back("META-INF/timestamp.tst", "application/vnd.etsi.timestamp-token", string{der.cbegin(), der.cend()});
+    metadata.emplace_back("META-INF/timestamp.tst", TST_MIMETYPE, string{der.cbegin(), der.cend()});
 }
 
 SignatureTST::~SignatureTST() = default;
@@ -127,9 +129,9 @@ string SignatureTST::ArchiveTimeStampTime() const
 vector<TSAInfo> SignatureTST::ArchiveTimeStamps() const
 {
     vector<TSAInfo> result;
-    for(auto i = metadata.crbegin(), end = next(metadata.crend(), 1); i != end; ++i)
+    for(auto i = next(metadata.crbegin()), end = metadata.crend(); i != end; ++i)
     {
-        if(i->mime != "application/vnd.etsi.timestamp-token")
+        if(i->mime != TST_MIMETYPE)
             continue;
         TS ts((const unsigned char*)i->data.data(), i->data.size());
         result.push_back({ts.cert(), util::date::to_string(ts.time())});
@@ -149,7 +151,7 @@ void SignatureTST::extendSignatureProfile(Signer *signer)
     string tstName = nextName("META-INF/timestamp%03zu.tst");
     auto doc = XMLDocument::create("ASiCManifest", ASiContainer::ASIC_NS, "asic");
     auto ref = doc + "SigReference";
-    ref.setProperty("MimeType", "application/vnd.etsi.timestamp-token");
+    ref.setProperty("MimeType", TST_MIMETYPE);
     ref.setProperty("URI", tstName);
 
     auto addRef = [&doc](const string &name, string_view mime, bool root, const Digest &digest) {
@@ -185,7 +187,7 @@ void SignatureTST::extendSignatureProfile(Signer *signer)
     }, true);
     auto i = metadata.insert(metadata.cbegin(), {"META-INF/ASiCArchiveManifest.xml", "text/xml", std::move(data)});
     vector<unsigned char> der = TS(i->digest(), signer->userAgent());
-    metadata.insert(next(i), {tstName, "application/vnd.etsi.timestamp-token", string{der.cbegin(), der.cend()}});
+    metadata.insert(next(i), {tstName, TST_MIMETYPE, string{der.cbegin(), der.cend()}});
 }
 
 X509Cert SignatureTST::TimeStampCertificate() const
@@ -278,6 +280,17 @@ void SignatureTST::validate() const
                 if(vector<unsigned char> digestValue = ref/DigestValue; digest != digestValue)
                     THROW("Reference '%s' digest does not match", uri.c_str());
             }
+            if(auto sigRef = doc/"SigReference"; sigRef["MimeType"] == TST_MIMETYPE)
+            {
+                const auto &uri = add.emplace_back(util::File::fromUriPath(sigRef["URI"]));
+                auto j = find_if(metadata.cbegin(), metadata.cend(), [uri](const auto &d) { return d.name == uri; });
+                if(j == metadata.cend())
+                    THROW("SigReference %s is missing", uri.c_str());
+                TS ts((const unsigned char*)j->data.data(), j->data.size());
+                ts.verify(i->digestCache(ts.digestMethod()));
+            }
+            else
+                THROW("SigReference is missing");
             // Check if all files in previous scope are present
             for(const string &uri: list)
             {