update

Signed-off-by: Patrick Zheng <[email protected]>
Two-Hearts · Apr 11, 2024 · 545e1e7 · 545e1e7
1 parent 998d79f
commit 545e1e7
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 19 deletions.
diff --git a/notation.go b/notation.go
@@ -320,11 +320,10 @@ type VerifierVerifyOptions struct {
 	// signature.
 	UserMetadata map[string]string
 
-	// SkipTimestampCertificateExpirationCheck skips timestamp certificate
-	// expiration check during timestamp countersignature verification. The
-	// time point been stamped still MUST be within timestamp certificate chain's
-	// validity period, and this check is always enforced.
-	SkipTimestampCertificateExpirationCheck bool
+	// VerifyAtTimestampedTime verifies the timestamp countersignature at the
+	// time point been stamped. This time point MUST be within timestamp
+	// certificate chain's validity period.
+	VerifyAtTimestampedTime bool
 }
 
 // Verifier is a generic interface for verifying an artifact.
@@ -360,11 +359,10 @@ type VerifyOptions struct {
 	// signature
 	UserMetadata map[string]string
 
-	// SkipTimestampCertificateExpirationCheck skips timestamp certificate
-	// expiration check during timestamp countersignature verification. The
-	// time point been stamped still MUST be within timestamp certificate chain's
-	// validity period, and this check is always enforced.
-	SkipTimestampCertificateExpirationCheck bool
+	// VerifyAtTimestampedTime verifies the timestamp countersignature at the
+	// time point been stamped. This time point MUST be within timestamp
+	// certificate chain's validity period.
+	VerifyAtTimestampedTime bool
 }
 
 // Verify performs signature verification on each of the notation supported
@@ -388,10 +386,10 @@ func Verify(ctx context.Context, verifier Verifier, repo registry.Repository, ve
 
 	// opts to be passed in verifier.Verify()
 	opts := VerifierVerifyOptions{
-		ArtifactReference:                       verifyOpts.ArtifactReference,
-		PluginConfig:                            verifyOpts.PluginConfig,
-		UserMetadata:                            verifyOpts.UserMetadata,
-		SkipTimestampCertificateExpirationCheck: verifyOpts.SkipTimestampCertificateExpirationCheck,
+		ArtifactReference:       verifyOpts.ArtifactReference,
+		PluginConfig:            verifyOpts.PluginConfig,
+		UserMetadata:            verifyOpts.UserMetadata,
+		VerifyAtTimestampedTime: verifyOpts.VerifyAtTimestampedTime,
 	}
 
 	if skipChecker, ok := verifier.(verifySkipper); ok {

diff --git a/verifier/verifier.go b/verifier/verifier.go
@@ -157,7 +157,7 @@ func (v *verifier) Verify(ctx context.Context, desc ocispec.Descriptor, signatur
 		logger.Debug("Skipping signature verification")
 		return outcome, nil
 	}
-	err = v.processSignature(ctx, signature, envelopeMediaType, trustPolicy, opts.SkipTimestampCertificateExpirationCheck, pluginConfig, outcome)
+	err = v.processSignature(ctx, signature, envelopeMediaType, trustPolicy, opts.VerifyAtTimestampedTime, pluginConfig, outcome)
 
 	if err != nil {
 		outcome.Error = err
@@ -188,7 +188,7 @@ func (v *verifier) Verify(ctx context.Context, desc ocispec.Descriptor, signatur
 	return outcome, outcome.Error
 }
 
-func (v *verifier) processSignature(ctx context.Context, sigBlob []byte, envelopeMediaType string, trustPolicy *trustpolicy.TrustPolicy, skipTimestampCertExpirationCheck bool, pluginConfig map[string]string, outcome *notation.VerificationOutcome) error {
+func (v *verifier) processSignature(ctx context.Context, sigBlob []byte, envelopeMediaType string, trustPolicy *trustpolicy.TrustPolicy, verifyAtTimestampedTime bool, pluginConfig map[string]string, outcome *notation.VerificationOutcome) error {
 	logger := log.GetLogger(ctx)
 
 	// verify integrity first. notation will always verify integrity no matter
@@ -288,7 +288,7 @@ func (v *verifier) processSignature(ctx context.Context, sigBlob []byte, envelop
 
 	// verify authentic timestamp
 	logger.Debug("Validating authentic timestamp")
-	authenticTimestampResult := verifyAuthenticTimestamp(ctx, trustPolicy, v.trustStore, skipTimestampCertExpirationCheck, outcome)
+	authenticTimestampResult := verifyAuthenticTimestamp(ctx, trustPolicy, v.trustStore, verifyAtTimestampedTime, outcome)
 	outcome.VerificationResults = append(outcome.VerificationResults, authenticTimestampResult)
 	logVerificationResult(logger, authenticTimestampResult)
 	if isCriticalFailure(authenticTimestampResult) {
@@ -516,7 +516,7 @@ func verifyExpiry(outcome *notation.VerificationOutcome) *notation.ValidationRes
 	}
 }
 
-func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.TrustPolicy, x509TrustStore truststore.X509TrustStore, skipTimestampCertExpirationCheck bool, outcome *notation.VerificationOutcome) *notation.ValidationResult {
+func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.TrustPolicy, x509TrustStore truststore.X509TrustStore, verifyAtTimestampedTime bool, outcome *notation.VerificationOutcome) *notation.ValidationResult {
 	logger := log.GetLogger(ctx)
 
 	// under signing scheme notary.x509
@@ -592,7 +592,7 @@ func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.Trus
 				Action: outcome.VerificationLevel.Enforcement[trustpolicy.TypeAuthenticTimestamp],
 			}
 		}
-		if skipTimestampCertExpirationCheck {
+		if verifyAtTimestampedTime {
 			timestampVerifyOpts.CurrentTime = ts
 		}
 		// verify the timestamp countersignature