Add fuzzing tests

.github/workflows/ci.yml

@@ -68,9 +68,43 @@ jobs:
 
       - uses: dtolnay/[email protected]
 
-      - name: Build conformance binary
-        run: cargo build --release --package sigstore-conformance
+      - name: Build binaries
+        run: |
+          cargo build --release --package sigstore-conformance
+          cargo build --release --example verify_bundle
 
       - uses: sigstore/sigstore-conformance@main
         with:
           entrypoint: ./target/release/conformance
+
+      - name: Upload verify_bundle binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: verify_bundle
+          path: target/release/examples/verify_bundle
+
+  mutation-tests:
+    name: Mutation Fuzzing
+    runs-on: ubuntu-latest
+    needs: conformance
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Download verify_bundle binary
+        uses: actions/download-artifact@v4
+        with:
+          name: verify_bundle
+          path: target/release/examples
+
+      - name: Make binary executable
+        run: chmod +x target/release/examples/verify_bundle
+
+      - name: Clone sigstore-conformance test data
+        run: git clone --depth 1 https://github.com/sigstore/sigstore-conformance.git
+
+      - name: Run mutation fuzzer
+        run: python3 tests/mutation_fuzzer.py --verifier-type rust

crates/sigstore-bundle/src/validation.rs

@@ -53,6 +53,9 @@ fn validate_v0_1(bundle: &Bundle, options: &ValidationOptions) -> Result<()> {
         ));
     }
 
+    // Validate inclusion proofs if present (v0.1 may have both promise and proof)
+    validate_inclusion_proofs(bundle)?;
+
     // Common validation
     validate_common(bundle, options)
 }

crates/sigstore-verify/src/verify.rs

@@ -364,6 +364,20 @@ impl Verifier {
                 }
             }
         }
+
+        // For MessageSignature bundles, verify the messageDigest matches the artifact
+        if let SignatureContent::MessageSignature(msg_sig) = &bundle.content {
+            if let Some(ref digest) = msg_sig.message_digest {
+                let artifact_hash = compute_artifact_digest(&artifact);
+
+                // Compare the digest in the bundle with the computed artifact hash
+                if digest.digest.as_bytes() != artifact_hash.as_bytes() {
+                    return Err(Error::Verification(
+                        "message digest in bundle does not match artifact hash".to_string(),
+                    ));
+                }
+            }
+        }
         // Note: For hashedrekord (MessageSignature), the signature verification
         // is performed in step (8) by verify_hashedrekord_entries, which properly
         // handles prehashed signatures.