Skip to content

Commit 4b7b6ea

Browse files
committed
verifier: Don't assume digest is included in bundle
Our tests still use the "separate materials" case (see signing_materials() fixture) so there may not be a digest in the bundle Signed-off-by: Jussi Kukkonen <[email protected]>
1 parent 79bd647 commit 4b7b6ea

File tree

1 file changed

+7
-3
lines changed

1 file changed

+7
-3
lines changed

sigstore/verify/verifier.py

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -471,9 +471,13 @@ def verify_artifact(
471471

472472
hashed_input = sha256_digest(input_)
473473

474-
# signature is verified over input digest, but ensure that digest documented in bundle
475-
# matches input digest anyway:
476-
if hashed_input.digest != bundle._inner.message_signature.message_digest.digest:
474+
# signature is verified over input digest, but if the bundle documents the digest we still
475+
# want to ensure it matches the input digest:
476+
if (
477+
bundle._inner.message_signature.message_digest is not None
478+
and hashed_input.digest
479+
!= bundle._inner.message_signature.message_digest.digest
480+
):
477481
raise VerificationError("Message digest mismatch")
478482

479483
# (7): verify that the signature was signed by the public key in the signing certificate.

0 commit comments

Comments
 (0)