diff --git a/notation.go b/notation.go index 56860703..429c4c29 100644 --- a/notation.go +++ b/notation.go @@ -320,11 +320,10 @@ type VerifierVerifyOptions struct { // signature. UserMetadata map[string]string - // SkipTimestampCertificateExpirationCheck skips timestamp certificate - // expiration check during timestamp countersignature verification. The - // time point been stamped still MUST be within timestamp certificate chain's - // validity period, and this check is always enforced. - SkipTimestampCertificateExpirationCheck bool + // VerifyAtTimestampedTime verifies the timestamp countersignature at the + // time point been stamped. This time point MUST be within timestamp + // certificate chain's validity period. + VerifyAtTimestampedTime bool } // Verifier is a generic interface for verifying an artifact. @@ -360,11 +359,10 @@ type VerifyOptions struct { // signature UserMetadata map[string]string - // SkipTimestampCertificateExpirationCheck skips timestamp certificate - // expiration check during timestamp countersignature verification. The - // time point been stamped still MUST be within timestamp certificate chain's - // validity period, and this check is always enforced. - SkipTimestampCertificateExpirationCheck bool + // VerifyAtTimestampedTime verifies the timestamp countersignature at the + // time point been stamped. This time point MUST be within timestamp + // certificate chain's validity period. + VerifyAtTimestampedTime bool } // Verify performs signature verification on each of the notation supported @@ -388,10 +386,10 @@ func Verify(ctx context.Context, verifier Verifier, repo registry.Repository, ve // opts to be passed in verifier.Verify() opts := VerifierVerifyOptions{ - ArtifactReference: verifyOpts.ArtifactReference, - PluginConfig: verifyOpts.PluginConfig, - UserMetadata: verifyOpts.UserMetadata, - SkipTimestampCertificateExpirationCheck: verifyOpts.SkipTimestampCertificateExpirationCheck, + ArtifactReference: verifyOpts.ArtifactReference, + PluginConfig: verifyOpts.PluginConfig, + UserMetadata: verifyOpts.UserMetadata, + VerifyAtTimestampedTime: verifyOpts.VerifyAtTimestampedTime, } if skipChecker, ok := verifier.(verifySkipper); ok { diff --git a/verifier/verifier.go b/verifier/verifier.go index 8080d9b8..453d10e4 100644 --- a/verifier/verifier.go +++ b/verifier/verifier.go @@ -157,7 +157,7 @@ func (v *verifier) Verify(ctx context.Context, desc ocispec.Descriptor, signatur logger.Debug("Skipping signature verification") return outcome, nil } - err = v.processSignature(ctx, signature, envelopeMediaType, trustPolicy, opts.SkipTimestampCertificateExpirationCheck, pluginConfig, outcome) + err = v.processSignature(ctx, signature, envelopeMediaType, trustPolicy, opts.VerifyAtTimestampedTime, pluginConfig, outcome) if err != nil { outcome.Error = err @@ -188,7 +188,7 @@ func (v *verifier) Verify(ctx context.Context, desc ocispec.Descriptor, signatur return outcome, outcome.Error } -func (v *verifier) processSignature(ctx context.Context, sigBlob []byte, envelopeMediaType string, trustPolicy *trustpolicy.TrustPolicy, skipTimestampCertExpirationCheck bool, pluginConfig map[string]string, outcome *notation.VerificationOutcome) error { +func (v *verifier) processSignature(ctx context.Context, sigBlob []byte, envelopeMediaType string, trustPolicy *trustpolicy.TrustPolicy, verifyAtTimestampedTime bool, pluginConfig map[string]string, outcome *notation.VerificationOutcome) error { logger := log.GetLogger(ctx) // verify integrity first. notation will always verify integrity no matter @@ -288,7 +288,7 @@ func (v *verifier) processSignature(ctx context.Context, sigBlob []byte, envelop // verify authentic timestamp logger.Debug("Validating authentic timestamp") - authenticTimestampResult := verifyAuthenticTimestamp(ctx, trustPolicy, v.trustStore, skipTimestampCertExpirationCheck, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(ctx, trustPolicy, v.trustStore, verifyAtTimestampedTime, outcome) outcome.VerificationResults = append(outcome.VerificationResults, authenticTimestampResult) logVerificationResult(logger, authenticTimestampResult) if isCriticalFailure(authenticTimestampResult) { @@ -516,7 +516,7 @@ func verifyExpiry(outcome *notation.VerificationOutcome) *notation.ValidationRes } } -func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.TrustPolicy, x509TrustStore truststore.X509TrustStore, skipTimestampCertExpirationCheck bool, outcome *notation.VerificationOutcome) *notation.ValidationResult { +func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.TrustPolicy, x509TrustStore truststore.X509TrustStore, verifyAtTimestampedTime bool, outcome *notation.VerificationOutcome) *notation.ValidationResult { logger := log.GetLogger(ctx) // under signing scheme notary.x509 @@ -592,7 +592,7 @@ func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.Trus Action: outcome.VerificationLevel.Enforcement[trustpolicy.TypeAuthenticTimestamp], } } - if skipTimestampCertExpirationCheck { + if verifyAtTimestampedTime { timestampVerifyOpts.CurrentTime = ts } // verify the timestamp countersignature