From a8811e595ce9058f115acc679ace18d3990f6428 Mon Sep 17 00:00:00 2001 From: Patrick Zheng Date: Wed, 19 Jun 2024 17:41:36 +0800 Subject: [PATCH] added more tests Signed-off-by: Patrick Zheng --- .../countersignature/TimeStampToken.p7s | Bin 0 -> 6595 bytes .../TimeStampTokenWithInvalidTSTInfo.p7s | Bin 0 -> 6578 bytes .../TimeStampTokenWithInvalideContentType.p7s | Bin 0 -> 6593 bytes .../TimeStampTokenWithoutCertificate.p7s | Bin 0 -> 1117 bytes .../TimestampTokenWithSHA1RootCert.p7s | Bin 0 -> 5955 bytes .../coseExpiredWithTimestamp.sig} | Bin .../coseWithTimestamp.sig} | Bin .../jwsExpiredWithTimestamp.sig} | 0 .../jwsWithTimestamp.sig} | 0 .../sigEnv/timestampAfterNotAfter.sig | Bin 0 -> 7365 bytes .../sigEnv/timestampBeforeNotBefore.sig | 1 + .../withoutTimestamp.sig} | 0 .../TestTimestampNotYetValid.crt | 20 ++ .../tsa/test-mismatch/wabbit-networks.io.crt | 20 ++ verifier/timestamp_test.go | 265 +++++++++++++++++- verifier/verifier.go | 7 +- 16 files changed, 296 insertions(+), 17 deletions(-) create mode 100644 verifier/testdata/timestamp/countersignature/TimeStampToken.p7s create mode 100644 verifier/testdata/timestamp/countersignature/TimeStampTokenWithInvalidTSTInfo.p7s create mode 100644 verifier/testdata/timestamp/countersignature/TimeStampTokenWithInvalideContentType.p7s create mode 100644 verifier/testdata/timestamp/countersignature/TimeStampTokenWithoutCertificate.p7s create mode 100644 verifier/testdata/timestamp/countersignature/TimestampTokenWithSHA1RootCert.p7s rename verifier/testdata/timestamp/{coseSigEnvExpiredWithTimestamp.sig => sigEnv/coseExpiredWithTimestamp.sig} (100%) rename verifier/testdata/timestamp/{coseSigEnvWithTimestamp.sig => sigEnv/coseWithTimestamp.sig} (100%) rename verifier/testdata/timestamp/{jwsSigEnvExpiredWithTimestamp.sig => sigEnv/jwsExpiredWithTimestamp.sig} (100%) rename verifier/testdata/timestamp/{jwsSigEnvWithTimestamp.sig => sigEnv/jwsWithTimestamp.sig} (100%) create mode 100644 verifier/testdata/timestamp/sigEnv/timestampAfterNotAfter.sig create mode 100644 verifier/testdata/timestamp/sigEnv/timestampBeforeNotBefore.sig rename verifier/testdata/timestamp/{sigEnvWithoutTimestamp.sig => sigEnv/withoutTimestamp.sig} (100%) create mode 100644 verifier/testdata/truststore/x509/ca/valid-trust-store/TestTimestampNotYetValid.crt create mode 100644 verifier/testdata/truststore/x509/tsa/test-mismatch/wabbit-networks.io.crt diff --git a/verifier/testdata/timestamp/countersignature/TimeStampToken.p7s b/verifier/testdata/timestamp/countersignature/TimeStampToken.p7s new file mode 100644 index 0000000000000000000000000000000000000000..c036aac23cb9bcb4b30960ba940c41a1bdda1805 GIT binary patch literal 6595 zcmc(jcUV)~vcQuN0-*$fNRtwfs+66CUX&uzu>jIUi1dyjbQBVlF1?5fL`6{qgoq#q z5LAjHf(U|$R8gdNkp6-m&*hZ&-SY1FUj9h3%B)#y_L}+49)QGM3xgks)QwzW2Gc>v zB<>P`#9ash)1X-ZW*FQqQWxw<1BHNTK>+b1jPci*@I7ECnb-m)z66Mk5HJ`9KL`Uu z!DI}C20;Ho4vLBpUG<=Uc1IkAST6_LJwrb@SBKpRv^>h<|WzJkbO}TEY<1QL3WO z2hu?EM&vX?Q1lf97Yhc!paCVc0$P^(4Ojs*R83^_JTt%q%?Q9@G-gm3J490(%?)tw zG#Hrn=y-Ua#d(;xI(wnK{H1(xXbC`UXNZOg^<&6)XUNn<1Lfq6M`<|tMl%lHL!}Z-?szsb23v;FNaY8l;q?vSSwCu zEC!IrD1L8Zto{}o03`6u-G`(;bs7>l5k&2eg^<8R&;a0iB_xyC>y~MmlC6WKA5>_| z*wy+syI#IczA>4%Vm4kdrP8u~_S!|wlwgeE>f$`_w=3Gmv2cDSjoq=URIR8COWNlm0p0cEb#f{_}op?HoH{CmK6uBr8asf zhtG?$UPLEDEd9r-)Tex2^YPaw1m$wJ6RS%uJiDlP;Y+qduqb&BRa!mt{(wj}*U1sj zPD6kputn- zq(YDT#8Ra55Mk<*9!A#cv})|*%uRa*igG~=6{k*1;-UL6oJj`V2g5~Z1wLaJzt*`N z2;wBqKxn`q@GTPf8uf`}0to7z;$s1Wx1mrP2wgb9vC|gWX)^%~FnX#>($dn=&;xus z{Rk)r6j^-1hZu-LN)*ipezOGiwA>MfBmjmx!zidWpap3B=Ez`vKo-FKTm%B<5OpCC ze0-H!Jx^SWpBiO zPbsV>9(n9Y8nI>~9ujR>7}jL-x}skAYE>54g~4iE8`n`H*?peOIc*a@$1^;-Q98hf zfr_)pU+jh-l`6kbr@mK+CkW@9SRN^Vbp zC~9~~a>4gw;^60I2mKHoR>KcBJ1gc!P6U5ZDiNgP9-NJ@Jm+&hc}g}n4xPhX-*`y= zpi@_!#yiS>J)w>#wlVVYR$UFp3l1ZUP2uHR%*j3H-sj4z$|l4_RE#V*>9;B*#n}Xp zAG-C4j!rF&8=13K>TEDkPN|^xPRY==F`PzNTE#i};P?@S{peghpS+ zGn(zMWrRG0#quGL6DgO$Wj2?ZzCG9Q>vM>oU$`S!* zN?!9SpLW|5iC+OxFqxKtImX`}I&D5UxDiwCcQcJaA%&ePzjRo+IR9>$W=GHU6KwPI z!CeO@a|}g#Jg+A&3V@I4Hcck3S{F>Noo2<`6;CRhOM7x!FUC;9bHQAN2V`FTBuQEm zM|wA~4I*ZQg3VGNpLO^Oi@a~9?~QF(_+UYMxevUgY9@GTD?~1+A&j#AzNjX9)r>*d zfq;uWm?>|2s%E}>a58jrbt0vc3KmN$STufsg&91_o1)&oDXnf3szca)Uzn&=F+`&P ze(EiRGO}~-qQyyXZ^92soRmki1FSnU7}y#9G2>?^&F;<}jG(Dk83X+I>|jI|O$E!Z z&A*pnB#6-N(|yMYgoTO|2m@rtEoLFZ!2Y$teM46X4R3JdMMje_?&4X+{v?DT>q(LRi)27zBqm*%gV;Txc121 zPz~XP#9tbYZOd!i&zIT^G}emVO6BJ4nMSu&$EtX_)kn`xXD)wS;36Aj@gkz~MTeqa zl0Rn+=PX_~JZxh#=E8>|Jz<%6#zo4TQx2(QT;2gWr*K zpi{6ZZA&vlWsb2lEbQnNM3h>v<3#(Zd(t)Q7HW?!t(jyQSrex41~-{W3fxR@?vGnN zond*GRe5;vnB3fTmJS8>lRYA`QyDYgoX6>(Bz(|#Lvico6782^r#A>%!NO8j*naMjbz0dYDDmdNTkud(Yk5JNlFHb^3P6F;3Ym(SL($!0WpPxNyDq!3}w1aHUXh(>R` zpcwT!%xdTU^7OFjt@r+rbPu=7%|fS_nV_E})(lE`I}`{Pd-$C0%lanrpAS8g(WS;+ zk~toKJlXSsdE|vX3ViN7$bp|Ylc3^EG!`a``iyHNI*(R+7z zFZQ6lmC8PRb9A_yx2tJ3?1i%l894M4B2*&n_=NP&HkC(0yLg28W30zh-48Dh$p65D z3?Ky@BukLRB1QgpJnV=_;pM5^@c?voLIo!F`^+f3TN3N}O)o%RJ0;~sdN{>wG3`bP7H>~htTxROd<^i0hR@;y@B1I71D z>MLX8WzYEXb5kb;w+=1m<|^?N7rvDVMwKoW7Vr&AA+y&q-1r(*n-_X`YfX&ubSy*D z>$NmiMTRB!Tp+G8r{$lYe*|B8Z--Yuo{s9&I`U+VoIZ-OEDvnVb1M*{=7O|3RJh3e zgv-3Trh4n9Q16(>xsBc7_g{kx_9sXFMYt#dm|bweC;?cs;t#x7{g+Yp&uEfP_tm%A zX>}6W9HP3yOg~qq%_vDK(`}rvRxOTrtdW96=6Q#W9cXDRiFR)&k7;kDY$IDwAO$D& z`}SEic12AaDer|%IXE$UrUX1QVpMp%ND z#%~H7c)LwSLJ(cT;yF5i{q)=GCVs@sSm)$(I zyr1%I_)>-M&Bt;D+Vg|i@;AIqW9RUvyriQWPG}z4n>Kx`K{4Z+v9T4S&H_wcF94`M zr||jCq#(WD#upsN;edBN$(a`!JUSspggWHZrqX)E{2Am8XbI!k)^y^K7bAuKA;qFyGz8vL9T2M}Jc$diPN7@`QOGAGp>+#jwH{M6E zv~LdptgDyWu)0glo(@RKV2fiN2K0Ij=?*;hh#o(2zUu!YO0fR{O0a(~O2A-{ zUg4RBhy|-xxC2I+`ge3X!}#$iu}9IoQtVcU)LcF8M9 zm4v6W@|Hmhmx*nJWv;xDA(yt9Fh@(xv1T)+>W&7{>2r!}-GVeM6~;Z*c5Yf_=izVc zaD4?+pfko8{y~aIjwDUe>c}6o{x89K3E)k`z#Kl-)g$9IHp3!=*Pg?%NQym zHdiRx#%l8AW8*MR4zt+W7x9T(dE%MNEj;Lju&VK66V+1A`(NZFS35K%zS!E)6l&t` zl$yI?H3#I-k5rxE~5Nmvv|%Xtv_o+Q8a$zC`7A?5}OUR6@DdcFl0wMI&|_r z6H&*uGgtSD;dN68J? zPDaiYqx3e4)c5MPL(n+xGmkT8iUKMet_IiIK4qV|c6OcFW6;!<;~vciud#^KbN-F4 zmq?sH0*NM|{_g~lzl;&Pto*$cKsBy`dT-tFf~^-!GbaXM_X z`xipxFCeMnJcf>?xjB~DT3=`Vh^8YUfrAgcJiKWn60l0z&l5%}%{>Y>*fJ(f8l^^r zJu1`e*FT!LIG;Kc@wiP+@cB!Zt=13EObS|(V#j7}j>f0=1zU*o$nf>Q1}SJHP95>= zHWAOfu;2{k-`gFVQP$CKD3)iq&)3&~ku&R=KrrHy6nzl`ujIDseKQ10@&);c=jM7( zhNPuJ?c$zmoM7Ld-MWHtPXpi08kNKfD65FPjZ|+{k&Fy{iIYM8GTm$DJ#cZF7H(7{ z{vO}jarU?)|3pe=1iI(pqh=k8!?tJ=jS3-52v*!Ctq)_5Nw;4^-@}SqkMXQj+7IXGF7cMWTG9+Z)>#8ytefgr$vecxc%``7;M?Vv zGl^#@Ba%{8T_s3UZ6}WO^3-eZaPleXuLi5%E@ZdWr?OH=lW#nQM-`xCKf@9vP@kS| z(KX^a7LBOb=hl#e8W{Joje@uAJ3VGVTHWqG9RD>uV&I;XQ{>fgDHQ7V*4AdW0j!?j z7;DOUT_{|2#a3i>=9sGG(8H3h8so+2-q!Z2I#5YMh)EhR+g1Di`mWP?$q9o)9$lE* F{{ssj24?^O literal 0 HcmV?d00001 diff --git a/verifier/testdata/timestamp/countersignature/TimeStampTokenWithInvalidTSTInfo.p7s b/verifier/testdata/timestamp/countersignature/TimeStampTokenWithInvalidTSTInfo.p7s new file mode 100644 index 0000000000000000000000000000000000000000..153ea92f420c97b73ca803085d437cbf20b75c94 GIT binary patch literal 6578 zcmc(jc|6qJ+s9|d7{)TfWXm#SEz5Ui>`PgaeJNy1O!i%4WG!ZtJ^PY`NlFPZiQI_F zQj#Si$(k0jgpmCib$9>V%k%mz&+mRc-+yMVbIx_P@3}tj^SuBPcNq+RAWAoCg&9l- zA(OcC0TOo(1Wbcw0hnQMhbUdJGYu31rUe1S=P<@!Tf+B%p=4q$l=uK3-iLs}F!(_j z7z!q1AT$8_4}MTor07?_Ty?&+hN4KwI`1%fK0>!pUHvgzeWLgq&z57Y5TrE>F&nKa z>Utm@v|vO|Cj`e_MgTO_j>(pV7JwO=5rD&JETAxUh^9808{phA7?}3xc=?{jd6~Jp z`k;KyO8Mi^5`frF6%7;WN0t9hmARP)%EcFt(r`M9^Ko=`LP?=?WXYtxP5=pJ0g#|- zWa>x|$R050sJrP+=`%aX`?>qLqO>%qvoO=uz$(gqpANv!$&5h*au@|bNlp%fwc%vOVgPxJ;&&5c^SA5) zKmr%+UL^G;(~!VPAZmFWgajsnMgaHAp;^p6*Uc-H?47Iwph8>5?!KQm34|Nxj&UK5 zq6FNee|hiR_v~fLwdukYi>cxnmG<@1ITtijLokM`Ul(}4UGAZFHq_&u#0MD#Mm(Z8)t zd&K9nkZ|?0pj_T|QeFA^#}^dOf5>$T5hc%~D(c2w9}vmqIzHjuYX~p|wM!jMoUvp) z9GqcVL{pB9#8j*2eXUH*VrMd~&MU6eFlM|Q+rHi;cqAELn-h$I~8K{GAMEQz?5IX8Nw9SnhWNi9G5R@*lergBIBvWf)_URp@c=SW0#7A zqI4nXn>A>l{iZM^5is1TMnSa!EkNV9xCQeAvH<31ClD})s2hRc=dUay6BrmM?fN~= zc7jRT(broB@9gL6?@sW=2g`hqOFnie1fc3e@=t#-7)p!;h!KF&&k_I}CAHHdwL@P= zf4@KW=!lbX^(Xk_9C7|`IBHC|$^u%yxk928es%SCb_~Ef|Jm8m8Bh3Q2hxss0wA!n z*8NZ}fFlAq#nIya@!fMvZ6$2s7xjl-PwJgBsXIVzAOKYc6ajg%EEy98{5q5)-s{if z{KXhvy90=-5;P_125oVAOX=NbRFQ8B`Yfr_)pU+9M)m8v@5 zsJ>T-Cm83NRmGOnW#S?!ZGONCR+4SJ8Bl62%HX!0D)vpahT9t;iW**&T=ajNH2S{H zNk3GF)$mP0Z}t4dv5*f+<$`qFqhAtg&iI{6nUT$pN9Qp&wH%T^=+f7y@rtrvPpIdi zeXM+fO<%KV@nM9qIlO9%Ic4C?>wI}t*~Hk$>WM`c{SJlXc)O6PL)YKY(W#|#BlFfO zTn#=~QL5>EQ!};g3}+G6Ht{b0IBj|Ts18RhZXcL3{HRhgp~au^lxFt}86huWu_6fM zSn4HkrQOBWZ%;G=hMW=>7BA0ER!75&>KWJph0_AoA0_aC?g2r`+=#6TC`e~eNM)z`FCA7cE4o#w*)wqU7~8@^NZ-NfJVTKI@2e?a z1;8e{tlvcM3(;@6WFHBUb7@|=CKlKzs8QD2^(c-wT zFX0Czj?1Ij0oI)s4D1a5Xz{a6*J=Y73uc-YQ% zx@zvFbEh_=xmty}8C`s~&ja)9xLfE{m4%RV8wjfrqQ_Xd7r!&k zxxegvVk?dhen=SMD%!e1VJ4@SQ_|Z*Ke%q)w4(IB)?j;NvFVf2Tw7sCZ;;ok3G>~@ z^-6xqsjOpjiT1;|OBaGxu%v<&wx4@qomTe96n$B)o-1oS>3yk9RFTUjmIgeWEwXyX zXY#5Y#Lz*t6Oshp#LuSA7qJa%vKdX^7JVNGDM45=!MkyJqA?p!DMo`%U$paod34zP z`s=fh3@?vMZ9*rPnV|0^)(pyddlU#42KZd=$oePop9?#c*{8-`o;8(Vn&N%eGV1&u z1wKz6gi55Hn2`QyQ+Xt`i$|D0YCWDBet3C6{s$gp04d-gS%NGUCGx-H zVaG)ZFHhx;7ofA_hk~jDhX7R=l=>I+AL4b_6_hF#Kj1PRGhpd@P}81R1ZVuEsaBlp zM4w^9;66IPmUTvWDM;A?E1=ZE;mNJ8CqmCZk+afQ$ehHVxe!&rIjqrOGFErz#cbpL zgqDk227859xsFT=JT5HhqI6C_KH2>$!ha_i`4*HH0HWfADlm*F8wP ztgg1j(DbB!{wd@Pe$Sb+elJ-v7pD{~(^I(azP*&K$Zhrb_OnzooH zY=AL^-ar4;wZ80*$#VvolIhZRG=+kDYM%6qcbT^zIddu$fp^#F}obm}Ky{>iZo2cf}V-v43?}g1c zxiF?iv>h4tPd8pHiVZgja-@ICX6mi!B4bn&EN*n1Cypngnwy9?-xOEpWGKk1<<_sJ z8rMv5d6j&n8VzfHIPQ&s-Q-`b`CNScLBm6mqiNR{uGorA1JvLl{pTn|0vDM}M1!t&K$=BjwvEz_!oDc{B~R{Iw`kSo?+ z7|oTx=4&1|k3Zof9n*YF^T^)x+3U@UnK{PBHjFxpFnPT|pze&q`yZnmkk_E)jFVflNn<{Y6#9EO7q~|SOxZcpy77zL=Ce2A zmv~sC{fG>=t_1MqDM!(Q@&+UNL{{I@=80Jwo>j7)TD@`YbtFso_6Webda)C$yVU0G zgp>@iGU+j(*K5vj;&DU-t1aD2XtOH4s;M39gNWunX5D=5Eop7xG9%M9$1Cx}<3s!E{*NfZ{s$<*{=FyxgF$*Fr?AC6 z6;6z~bgujQC#a6q+zKx9z3xR>(0y%qb$%H-wac#M9B`MTny3LRqr1M47Tn26YXiD)OQ*@w3+<2X6Y z*N&mccihUKAG=-0gPsbj8b2^ot>C=#K~8eDM^oa1y#q~&Chlg1r3Y4XL=GL*c1Ypi zo2ECyOU7&qRW;Q*Q?;m497i=7`%WshsP3LBID9`(1YC9!Ako-UZ>Ksxq?8c~qCQ|j zD>M4vrA2mfKmYue{%;B?uv@Yr>a_>tw=xt4>e*K+D9Xcsw~91IH* z;#g{oth&%9p0`PRmbJMw2ETC>qSZ=?%Z1ttKbJNbb08fZJAQ|WsN?4~P@&mV1kaJ}yy^T`!y}I2H zG>-e!gRHsIz-p%}Ar1DA*ynOiuQPj%n!9t{rg`Ht8JTwGY>WFv66X&g(FD~09TE9U zjo7uz-%|n9%{5RTY&0$2ddf7nl4-83SDOifYn0q$kBSnf!?t;TAk_Qe*bG$#(!*D2C2#N|DdCtOC2MMgfN|>n>qwm*EMf7-ys!H5V(+djZ zvxx?X<-5j%$e@X2fS3yquK>g>D2lyrvI({AZ7gPvPjLGfL~?d=9lXNLLUhhr4zFr& zSq1z7`$D__haKFN0*8{o5wC*P^|H(DTtjC)9de|<4P^1K+&N@(t)es3;ChpDv)%U9 zW@sE!Bg^*Ord}W`SIXk4oDv_*zU<=M0Dq&>fF#dZzFcbO6UWR;BoL`p>PYW1@cwI$tMkoNA_^SUkv0e4zPGrQXu!;d$Q#|GDDIIf{@ zW5sPJc~)v1$MbZTcq^VSX-1gz)`Pz`&J3#*9%5s>TvliB?Na-xq|=lMNvYbta-_Mo z3r9v(TFxt+d}_w?(Ylw5xt&dEtQ698m$&do1t>Ydup9|AWn@_OO}J0SAgcFyH0Pm4 zrhM$9;qCiQP8yI_xBCw#e2R!1xh>@qb!AElg}Sk|wV7)GYa%$unX_IMicnp#7g?P% sQMDesSKe1|{558%HALhpY0LlUassI20 literal 0 HcmV?d00001 diff --git a/verifier/testdata/timestamp/countersignature/TimeStampTokenWithInvalideContentType.p7s b/verifier/testdata/timestamp/countersignature/TimeStampTokenWithInvalideContentType.p7s new file mode 100644 index 0000000000000000000000000000000000000000..07522e1964033896420b890ec53b8fa203e3ddad GIT binary patch literal 6593 zcmc(jc|6qX_rPby82bp5Ez6KS%V%cnOIebADP&7b_FZG_3Zv}VmsFUfln_JYB9f&f z5|Lz0$sR)X->BQY?)~21>%08E_w}1UX69MWbDrmXo^#&ka{vNIJ&Z;yN;_(e0ZauU z5;#f$0!I-9Oo3tq7+^GZQQBZf3Md3j2?8SC{XP>+jOc(yJO?6LAz(0!<_HW71ryN_ z3IO#dDJU{h=&MhTD)&Z1VI*XeYnZqgu3ez2+QeL+DDuv|^<*0aVF`oJM=J|Ci=~5> z42bFYpqQ(0c1ARSMga;aIg~W{8?XW>$eM`e1!jN=iVmQGQJ6ttED&`~6bHbz*Px|8 zpylCx4(nm!>gFA5cdiuC}IU_aH$h$DnR>R0kf8P$k!^S{9y$o6oP>_*9W31R1Flay) zE&siVw)$Ia01&|W`wvNe<`e{Q5{TR%2O)qXKqG+b)sQR(uUn>-3bqcGeo+1$Ls#$5 zYqX`n%Q*GoKnZ;x$BqIQ-jg^>tC0+zFqCEK}86b zl$>@(-`R;qFQ0iTac6@fUVVTz zutVZR;+#3%v7ij&LW(j>B)VEP_iJTp77M*`b#76mnjziQ*pAI+zT?U0MC~PUJ$kl@ zOXk*hiZ`<&*RMF3HqE+e@O07or;-jd%=O(uGCu4E5;;}NWhY-H1}?KSO3}q6D^X)V zFqUXlz)gKJ!iXBZR;@#9dFd}e(Jt_@(zJPT9P|*HEm^PsNVp&+??=qn&y6l(L2SeY z2n84fzC{3ECqI!a08YMB+>BuGE)+@up$Z3B_u7JcZF+zfMoo4}N=hmUYJhvM9}Z=O zB1$j%LXaH)zIWm|BkOt5{7lD9TgA74c& zseph0N$2l=w&zTe_THXSI7c6EUst?0E=cOTUvjfRApkjCB>$8LgP{?TKtwp8@UsU1 zM@j6hNM6v}-q+{PE81hFoPF`WSbMCm3zqB?&eDL!Z=#SWxnD(n9qs*aj{hiZ?})?y zc>zg#93J4^JL_R6JHQ%_m}YHto&4~^TvGv4@J03UtEcsjnPdx)C-6cQ0eL`{C{091 z0l%uU$9eptp1;uHvEPBnQG$X10fWNMecl)dkW%+{XY3!+v{e4;7Yv%MU-gC`_LRV= z;}Ay2(2dCxBW^?g=k%NQ-!}N*Kl|O5kmTx z#g~2GCyjn=chC*dV$y$?-&?&naWeRmLKzXi8JH!;ms?{%xMDvUFl>Wc9?dlWwP6a=cCO^wC=% zsHjxZIS{!U<<5FDRitWa@6=398~u5>rB%F>FIH1lH>%TKgTo7^NOM9V8QdiA3hQZE0J(F#mXo5m09U`ja)#u+A@UFodc`SizUbYk^IJ(tauI6>xhkCP?Uv4l4x zyP$~7P_S9rqjL_QVNv(ZbiFYx%kL~GuMB}#l+E}q?}W$%wSC!w8CemC?YD&mKmkQDm_E+WdPN zMu70|KizknKp4q5fzU$s+~Nyl95}o&dT8t#zT$yjr0qSeQ*Bs9`%s0$L7w<6)C8WH zBXgru_?&eqRh;m=`K@M|xeDpF;-~a8;ZC02BDzn+YioR#aHR=r*;Y3Gr47gLhN=l9 zCjHW4v@5H2zffX3&`=|0Cyj$`U>?;~7pLUq)*SO?K5O;;GCNT(n+qOYC^Q!HocJ+& zJooDj{bM%PvsDYP9lJE?OjXKFO{n6ty&jon$K6GxDlG+H*n(S(M7WKWdGI(A#CrMK z(s$G|l@{sB!@^Eng-5FdJI-{Uz9(6~X`%A)@`g#afi->(r z?3!a=jbs*YF!so?oEi|6p37YL<~&XPI7ugXH@UobP4r;@I)hDLv<45p*+--@JfvRi zdhMk#c(FG_&BImC(>rn8G)D#C&O&WlBnD!787aLZM-v^>~CbJ9ZEa5S13P?JH3Ka@)ege!47jwY*I=epQbL&(Q#&qCwwfiiYj#4 z#!!HVvjx}BdrjT2f#};QcR`ZC+qn7E#X{y`b!LOvdqN)rAjNQVdYW!*u29U@Gm^oe z!xzoGU!EK@z4g`~lHuWYrJeuGDn0ar=!RYySC1V2(g3&9eQDn$o(rL8Gy7CH%Ce>t zj8i-xm`7baAjj>_i5U5bGf^_m1pkOLa1_A27m8W-a7GQl$Uo!@vkzr|8NK(1_fika zTWKug`IF=QTzzd{!k#&s5P_pVAwnk7o=-^rY?FD!zmG@gKgW6;+5K>`fb0)ENC6VS z5uzwjI7;w;$HSh81WuOB9S=ZjPYwxH1&#vBFev#i=s(2kz7&)kEPlXcJZ8Y$`G~r0 zL?I2`FU_?g?5F$m8wL+i`Lu4*(UgD`?J&Fwt*q`Gsyc$yJQLT~`U)75crurw^4W&f z8jQy3?!TOGJe<&ac}MS{z&iW!S>C3C;#Z`u*{0Ku-1T9r!-QwmdDxzZC$z6-L7anG zGjs>fwZ5u=bVzG!nhniP>E@k9%;654_xE|tn7KSHXP%zI{^0$UY6|B~t-0=Z(LyRa>k-yfJK|AGyt3UZrDZ0a5 zo)1Nr2(d>SbyxUy&K;QJ2DVl^rnQAbSt1`~qP`>(+T^OGb0B3u*z^gg(t6#xuM{s&&H{>v!)XEe#6`s~~8v_6Yy z4^duYpkA!hq!TApYPZf3uD8K0_~}vF&lfTJ4qST1c?}&;*8@AujYt=Uu=%6 zbI|AG(s1clQI2aNIlW1~R*izSJRbK%!|w2`*US{%derckU~l~D3w!Ly1Y^+3bUv@x zYahvw$-1;!Pm^)&(1Zh2^1Du?0PMxl=>+AX%7WG93|(d_&+PovRo{3CbM|?-N{qPnj!hsqe2~J-vSW=G#cd?%ff9 zY5j5+Mth~*(*YqKY+=-+N3GM6;lODR4^mmFNNBexxuLEZ5y+iqoai(f@3B|iBg zYZ`>7h z=&T`{XO!fTt4wODz1oxP@8(*<`TlO~I}4-NP4Q^mPSZ{KDJ3d8KU$_ix==yk#bTi@ zCX-L^TgS07=&zkaksmk|XPR7Y;Xuy>lno!5D3`O{|0E;6-lH!1$<~gdSRH$(+}sVL zJ|csPYCkG>3sl50QvoBw5Pd+xC>kN8pL*-Oj8W^H5>)7qlxFo;A)*ch)he-s2P9CB>AZG3C&hbqBhzIhRyadG57vM5`3oUS z2H)YbXH!D($b+p5*72{QcI`TML{?puR$n|5N%@!)hc%Zg#v|V2M-}IBQj#||U)46O zsDQ>`n9qbGr6zY2S$z|R)Zj?P#>&E*QzWBgNwnRR`HLE8s*B4V}MEx5t<3CqIubDInvqo%H`_bA?ZO+}`i_iuH*Okn#F zNYnweOa}Xw-@;SfZjts4(sBpYS!m zfFw!_XnR%`7a8Lke4TY8+m43>jy~}6@TL$=#3*P!O`NDP_bA$8&YU%Am6#Cls7bfq zd~f37eEMkQqb?b~r_Wt>I^Q*!6m=xWO?|OBk&rPIY$3ua#XbBIB&U`%cigkzL?r9t zvNM$DV1Ha@WzVp_aDo0IUtj;PY}rk`!SD|f)FrfB;=9WC&ESkF7iDLjn(I6slavUx zi+`$ilI3tt=Nj5Q9eg)?QXIpps3iD0O0`o-JSy-xRtoXU{Ggfl$fbEo8iRU~x46!p zbH5ufs-txs@C9rOZ2liCxUU2bC4j@<1gYv|m)SUn%)8rNm;5%6#mRX8 zsMXE#t`NOj&5kWLyEj^(arBLhy9?Vo0Zi;E%V)0_d!Y|y7v=c*8kG1YQI_X>U{h*f zO02p4!Ieb?R@P^TX~)F6sjUwmW35VIN-D;5^WVO2*Rk!M!qZ^i+otHX30h4YGc6W{ zr&g&VJkQhg-)ySRQ(1nSzhFC3{@OS8RqrX`Tb+dDhkIeM^W zykndx(+&P`ByV3=J#|%?(X} zq(PJcGtj05;Y&gdf(^M1IN6v(S=fY`oLmhh4a7klE*=5*ocyH3oZ!s#JcYb6-Qq+; zO#^k16f=(kM5-7h6%y>Ikd|Mh;FwaDn3tTIqM)nbZnA*Eu!-5%po!TNXp2F+oZb4>Vx`MMK(28IWM`H^Uuw6_7j0|p>0n1oc-Yj?_ zd&$>vK3bS9Xkyeikb*}HC$k|hO4u9dBIHaA6%6Fi^e+TP9W<&Kxq(rq59e~S7%H(S z)Z9PKFSLiLe5bKyu=Og#t$SWIT+UIm(Of^-v!Yx!s@xPeG|n<; zoX(;keC_2Ch5xyJ>LEov8P6-4Qd81z&ywVCOr8F%e%qO2KMjfv;+Mn@KnNmvnWc%b z;cBIW=gbYU>DBMD6K3oExH(;lf3;oI!j0#vy%!%zJsSIe&QX>wo&)^<-~aV27nGRz zId1lvJR|9utLBy#`>rkRXWh6cCvoCVHfynY*Q>UyS`rlz(zD)YJ3WL?h9!$G6n+^O+Wu%x9@q;(0qTTZd%){SGo!cOaJ}*JJ*}-NJ(l}h~ONh2Al8k xsz2ZR+eALxyy4njzb_rP&t2SofMG*lb?_7!p;^iIj$DgbGO_Q$!<=hIO95z?m3sgH literal 0 HcmV?d00001 diff --git a/verifier/testdata/timestamp/countersignature/TimestampTokenWithSHA1RootCert.p7s b/verifier/testdata/timestamp/countersignature/TimestampTokenWithSHA1RootCert.p7s new file mode 100644 index 0000000000000000000000000000000000000000..9785befeaa780d07ee25db374aac490fb3cd2cce GIT binary patch literal 5955 zcmciGc|276{|9ih*!O*B>_nVl?2%z?r7YP}mh2Oyb3SLB*Llw84d6KsQ&1m>Hi+J&2T_8F zcuoMobIO205I7@1PeJVvZ2)qCK*1n#G9WUZg7!yGY9NxftaEc?6&YR|Vh*WjNdh%;wa0PWA>?VW%s>zQ{Q>e*s3mx=6&cQUiF3Rsatz zB0|6*FqnxPRl1g(L8Y4CJaO25?hME7YJMykL`%8_CpaxYO#!ihQm}$8PQW<<_T2^z zD+3DchSqWM^Ou1co^z6gs{^XLCm^iydnaJ#eprmZi!)3g0W&*+L;$KvuoDJIc||3d zIoiwRg#Q^YAM`mlm<|#U;G~yV0F>bf;QOBqC%pm!4!{-U6%np~M@61m#jO_>k4cSUKBe>qPrnw*R089)1ARK3e~ ziks`=w(dLnGoBgWeC^sO(hjY(%LXy>x|+>A8P>EP*BQ9*>3PS7!9hD+Yzp?<3#M$| zsFvD!vl~_VBY{$?9xnq=rp}V5x>Avh+ z@()EDqM!I1Zt+#r*iWx~z=gqYy69VE91)c(kxp&On*ADr(UkvShS(mgUmPULAa2b} zopa`QAk6dAcjU2=DU=DNar#-G-IbzZ6ZX#gT@52`>h7qVJaz4_n6M8oXm)}SOyT*bX{?RNG%upD9Z}B1 z*q#IyoMoQq)<~O&(1SOE2!fp2I}cFV=JtW;r4TcfLIQQRZ-u9Csb;Nr%Frt&)^BI@ zX|8-*sqPr+nDP`|Y1YPf5q&k%uO~q((LNIN#x+$+eVz7Hxjs2dG#{B|onLkfOLu*g zWEC)rR++sd2N!trZx~4)vXl*hJeUGIe5@z01t`*7)VbOKO+dV z1BF7slo0^kZku(t4F<>nj@_2nZi^0}p`enc0FjeZLZ|@P?r|8D8{h<}C@9<_=|H6J zwEHtJxZ6Vn$^~#lusz@y^E!4>4kLw2lfzy)3rom+;tlZcc3^;VK-u!DmsuB7!yh-7>R1?`(yy zFI^D^7uNPh+!@sR zQW&}5g*<%)-B%~w_Bf&HbR4V>L<{ajpz0{$k1|)mY)`;MIUItZsImwfI?x?$nq`mC2P-%SNO2S9qxQy7uV(1{(`uE6qf30Bs2 z1iw7(P%pWoGG}HpT*4_Va(sPhfOFf#V}~+8&^Hx@?5x!r@RSd=mUGj0nd8M&-~8+$ zL!q~f6j)iYe>pLB_gVz1G=d2kM^fw_NwJh4icu;l*NB>jj_Q|um2^E|cj`}%4B+@H zAnX7uDM2K~==S2Vix`}g*xkdltV{s`0lz%6a3Nqfvn1ZQeva7V&CJ`|pJd#3#N+{z zS$`m=Olr#SA@;9G`gguPj#i{Fyx*eXXJ~5CAqHt%O;j#SHO(IGkLt@by6r_Qdm8oG zW`j8!#jb6iduh#mD{L)2miByxU?!u2pb0CjI3~sGH>*3~u&+9m7si=CV#@D-kdC+z zC(JdyIIhvgdA^uiT2p({E&iRU#>%ke;DY4A#ewoF?1CVL%hhD5fw3j@^w_l+J+hDq z6f$-)^sH6zigHkvZAtf=3(l2ht2q75Gf~_x>?_S_h1}063)O3t*jG#)348WQmBnqD zA)L$8I6+Ll8et>}!V{Yif`r8N&th56|A(KCuH>8uc=( z25@!#3?4V>`V}gB%J+P;CHZy|VA*x#yJu7Y1qm|Ji*+A8e<{;`x|T*}@cq8F&PLO+ zZig2h5bp6Y8vkl0DEfQS_{IK2WWb&kBx5`P^gk2^xi<;`M=Smp!t5qgA3@U1AJEyo zV?pR4Kn+kKDiIOU@_Y0Aot!@>@%#tC|N0~PyI5f-;~yqfdlL##!k}>1;ZY&&S7ltX zOvhMzffLV~xwbn@Y+oOh+V+W~FOoukLAUhsQ@+)7crr>mcly+bSIpK0m>2@?)>F-r z;@xIqG<3!g? znar1QC39b|G&qaLcwTSJ2z~BD6S{n-0c-rgX0wo~!uIWsqY7xj+oO;2^o#U9t9s= zA0c~;tF>+k328mAVHNF})}w{OjA ztO2@(pOT-3#;%a{*tULtE^?lXb`}Q~A6s$3Y3EDDQ0q(2pXbTF$oPejvSDE^Ef}%& zaFs!NZg{&;4#j?Cft7)OLRp0;TYBUDaOf8RPkxmo7WRi&47a%AKR-XXusmV%no5hy zX1`c;qcJ}s^ zAhhhugIzxaJTbWAYGsvWZXHi2U1MATj9Gr@3bCEJ+i7e!r?>#`9#68Hj8BLduTCUr zT?={?*il{HR&|z31;TW7bWk~0mOSjzC%h(8qEE2}9w|RE0mU3Rmk0_KG8$~S#|y#Q z2D*-^!BJ@nTFq1=Hio&a^MypW7r7D**~Y3>%+{QnqNnu|oHtw0mv97}#z|XkTuf{# zI@n<4*#WaZ86kOs?!dERt3y|OWRMO;ynOWY#{g{?eoUVCgR2E?vLgjfWpJyn-YyV42t?*XY}Pq#v7lm4%<<>dsOA{iY__6oOe@Kbky*NESIAQ@ z{96nU+Fba3?xg^)Mjp0x)+51k2WwQ8*LNc7e#_om^_voHFoQff{`|ny)6R@j_4t!up zH>|A0n#iE#)J_m?sW|z`!lPHB*c126Tjbz+xbImJ58)k_TJwVv;iGC}E7dV6Ur+U& zF5!A~EDKWuD$KGfvXgvWmkh^4Z~z|SN2#wVA`wE7{$UcDQXZ?*D0;m6_ zehBdWagH3$NGh7`FZlt|`#OW^;CuiNK&mi6*<4qodw=1leS=z7?notXeB8K2+C2r1(qlYngLHwC`yV}0xeba3lZoEzJ;go5KHIY8 zhrP8^fvp_3t?-L&F?gLIdPQ7J4LQ>6NXAz`pZ4z1@+_@;Z$9cx)io!TmaK`sBc%+& zW}^?)+Und@2ox;Lk~>YN)csYrMq=bLFC{OuxF&*1VQiPPPnSIn91EeRaCJ^gV+B45 zJmPZD)4M(SE@qSUj2Xk191KEb#Bgq^i&N`uN=gV2)Ee9J7Ty!7#vu~-Sz|6Z9Mnaw zALz5{z}awY5!b|ZHzczt2kRK$)TpauYt_UaD05CZV_x}@vcUklEuwF`Xnkmuf$#46 zsa3L`Q#%dp`nNI1Q qoqi4H!$}x*xX$_W+)hBmUOyqPGuYBb(Q00`Rsj+4p4mj$KW%mR&`5WsI>i%uKdyGh~;@l1R3)gzTX#C2NbU zr9>36Z_$HrMm;@0&vMT1y3Tce#~-e__s_k2-mm-qeEY&JvhISEg~3EWZWpXH+7s<4 z?TICzaQ@PG7bi~_PbU+!GsXi0@jHg{@^W`UqX;foPZ=LihdKlf$o;(>X><%qi%@IQ~{_PYsw3V=!;hXBzMq79HB>HrCRG#dg2fx%#k5`Y0l zBN3q!@r?llqNAh$j1hDI4GeMt3S$LdF!`0BW(Aw8BbWik{SqoxDiaKfKyb$(n8?k^ zIkc=WqaU;VRRzLIMZn+*rY7nD?_mZ208|jl2!w*XoV*n|i8zq_zaNkU5d2pS?1@?-We(LN*;XaAolji4WX%zpHEl^1XfU1@5BwrYMNCk+*sgP zPr#hWq&1y^+*$CVshz5{tlP@VrSj*mXdN6E3cdNh)7&vZY}KF}QF% zh@up=$2tL>Vd;557xS&n8!8m^2Hu#$K4^FI1bvL#4r|X|aCl_VU841JZJsb5ZBx!2 zm{eKVBW??gWCBA#6remYK;*}6@-Trwdr&9@Oce^SlJ}BF1WFIk!l;kIK$MhJ5Xix$ zB%crRQi3R)chIrUwab(ztFg>1VMmjq6Do)f$}(57k2zn^l%V%z5KL(F0Ut{CS)}R2 zMp7fe{mUsTqYj*I%deX)`uJ7@TfRiJOT{jdycQ=u$DMK&3M#XYbvRLVz)kM+N5g1-HpfPWR;Blb}ct!QpaMPp4mVl zrf>AkYk}GN!q4g|Uo(!}s(dq?bI4Ans6)J7-}PC0P)ns|1^m)m%-2G<&OSy}>&Qxo z{tS$p6MDl(WcrqIJw%ajY3?4yr2p~=jUAj#;EkYzHAl+?cp0)pz1XB`VGlWMf8J-M z)@4?L)9=VX`=z=Q#*^T=?+HJ=8zBuy1AYR3sY@U`FP?z%@G>C_1B!4Nhp~h|2T1Ua zKm3pioK1q)k+Z77AP9m1po7uaMd*Mq5GWV~5Vv7;zxyiu{eHp2OpFt8soq(#eYVg{Euvf90HL|Vle?oFgJh%HTkJv%plIo z1n;h-H(FzNQ|Icv*#B}~0qcLZhxPCFAOM*k_OOZ{Fm+#Qf9w`n!ud7T$(EStsLLtu zn{-BgU)%Q00%Q?@9016YwM|Z*JTLj*lmFSpAPZXV!P)*4x`ch9iy;dgk)l%JG@&>w zelWEFsWaHtT{vdiM14PJ%w|USwcW*S8G9I;QeHgEsTeB>U-tbPa zqTQlRq6}w912t1V`fdTLitieryjpPmm}g1G!I*s20(I`3I_o7!wQ5A(s7&-eAzDWu#@e3i$u z?sNX;d?G5ACZ{w#{Yy!*c$#t?O&K!tx8QTRO0J#W4LrsSq9C(i^VZ86Z%sa;(I0}d zcna;myxL8-G}&0Ah}pT3($o7>Xi1<#@{Z*HO>E&m#CBhN59%#7z_Xvv2!%u0o;58- zBBKe6qg9KXN3PPpQa1{@4Vdj0^FxgRLx36vb0X4%pkP4#57!6r0`h?DFZl+8;G)h1 zf*1a{jEt|Zue8$-AKZ5|X*AYD28Z#&;#~+>oWBe}zuzzGzByok0w7-h)ddIyC58dS zP(bBZ4giXf+V7OyCl-zO`fI0Xl#COefJdQGcxM#ZQ=H@h%|DugBb0t`ipQYI()ahq zXbg_<*AAr7I0C@8Z=evA1AvFJ&BEJVrawJ5*H)3sUsh{+-P(vrB`*TG0w44^pbRKx z%V*0*0KX4~#<~A}oPQX@{h&AfU>z7lQ6<|u>$LZNte{#+%XWdc$w#Q`6=cD1z;#+K z4ta^+{{7;NyRyn;y7#tdBA-|V-UhNy9B_u=9ha# z)4*upWI>E5T8N4$y7{Sg@^qT;8F!stX4h`-N>$s|lTrdCw=gs|ttD}HJ1DijxP|-W z-O}rRp+i9)(GqIcN<_Biq7;RKBUZO-U<=}5l2z|+1z>d!!IKqhwAF4C6&Tto;xbN5 zA!h6r{6!grlx0V2@iGS|ZDFUwLMzAOuc3Gx(+=GOSC(;Jd{zj+4=v}ta z(=dtnZIe%G`6F#yc-&o;yc6YXio=?N88?NQUO)XLs#-d}z0G@n6t=PLtUiwzE9&Bn z2GBfrlG^Bww3=<;8N$KyLQlRs8zA@r zUh*k~(y<;sz>xD;Ea4|R&MP8VfkXQ>Xjy6hRpVDC%H?jM$=i-ZO=TD*29*R{FV6M~_}{y(f~7>b+KRWpUrqt!#bDnzaf8)rGGm zG_)D-DXQNuklOJx(u~@@!FhOi5z+HF=7gu~v#908w2hH9j%@vOZpO$0(ebFR?8)?r ztgo2{r);g~YnS>kJ=%1pCo4=%sAAJS>rB&Q3K2;sRs({*Gg^!hUB}Dac`+o30fCO> zU5(TeD|8hhA*XLLMxG47%=MZTNjGj=oUFOJWs+`aO<2I`=Q5C#IO$*CpS60j#59;* zf9k8T!b&DnzY^>DVG;R-)TQ5?W~rMJbOZLTR}6eR%Km1P!FDK8lb7(!OT0StN~1)^ zqwsOY5-dY~&4!2BZVV5NsxYIIXvg%H$VUrkr-~SyT?ZRcCo}VaGGE?NNmR zwSLxs1`KzVL$s`+4{RI&+k@kH;`d6CFBf$ealKrdJ+>JT1xz&h=y$ zovq#sk(i#=ad468yOo36_$I7RunNLOC{%&X`C>D_KPoX8-5ND92-{()sMWn-eED_> zRfORq_SgjpOBKOQi@J$qDVD%9oy`%Xi(PEPR6UfO7 z-cQBhq-fO^y>)?Id*%fm;QPjlSsk&!*vlFrZqL{5x~1?zE#zsV7f5G6_g*RNnrhN1 zK6YU^{-FpztsPG7YzqH?rdHEdcFHurWvyR(zH6~y20)?=BS&Q1e!_)O zd+HG+Os@4RMrUeI``mw?F66h$A2|8>bonFsf6TIfhm#blFZgc9&3U%&E68sQ)GO86 zbdscMo%T6vWLa39dXgMlJ~m`V;zfITlv`VEbZ>j*9^0#PYy$IoAC6eH4@E8-9%qLw zI5^TJg?4L=;**Wm3Zg@d{m|5%EN4A59Ayma{lyK>bH#9lKI9}a20x2=>|h|kt?B&c zBr>M0(sA(mt%nF$ThoMxEbJcdX8l}oUR`q&34QkUGDq~-XD0vk*<3z}J}>Dj(~oaF z@-Ugu35;W=Qr>f{^hE`KoQ*>kSLbi6rRcFxdF;ehM)$nVM)`JH5XuLHj(@W~-ktmY zHqEH5melnX;!E?St>DLJp=kLrw;LQyZis2#2RZQ|-fd~TgW zvG(f6+lo0@)0h>UnWuDA+c^y__Tj_x6(In-=|RU zQ@(@4iD}`q?gL;$LJQl%j>>k}>P5C3XgS@??qb5YCtW3V70QvuwE}h=lWN(rtgzGd zPCTCLP^1@;w(!fIXy4sBlTk<(f4 z_Hba646rcn*QeHPOL5>rGy0!guZruoD9zN+_V;9rz=i8U+n%2K^$LnFlv9{j`!8bJN|nFN9XOn;z+5`d6Va)2ZM zh>3s8k$;fkFp-5Xy*nxAUuLyHvlCsWY+i?tj+Evae>vkfgt=K{U5Jbf1jqDxK7`|^ zF148693(V7c{yd`Hx9C3$lh3aS;< z0y)#qG?n~in`)*rB@G^H9!??vB8C%TkJ*H z@q622UcgN2qQ>ckr#C30w}Q}DPQCUf22y;vS;pum-zu{Gfc6f*+lLdZ2`q6F>RdVj z_-tR7j#`@#QYY`O#S!sih3=&nJz6OHt~{Iz-4#*V1!p*yXxO$cuD=*rK6|-O(Is>0 z3Utg9=2AOKOQT~MId_H4F2JGKMRO^!!(g7{gZq++R9yP_#Z{bYk7;M4(|kUYf%aa1 zJs?D7kigs=kvg1iRh@3mo&Vwyd$dV|Bqh`5XIY#T9P)z(w;L9|@jVbuf%+9f9xW0l z-(3of)yug~5Gklq)$f!vYwYM;Ql79$TK4~z8QwsULV@^$gL_wvsVpzWN@<>-J58TF zzV3L&-*?c|ny*w?>AAL*QMQ&&=iBo1Hui9ujUip#7EIj~m$zqj;R@-CwyOIO_zkU7 z7^PKLJ~M&@(Iv~UHaW5dVE?1{YVhCVRR^Pc*(8t@!1YHUkcJ%n`%|d8mvXDFc?!Ktiy5m$*yd_W+t5J3RSp*`Y>k~CV zEI%+BSO!7N28g!-;w^xf2IZ&o&s8bYV2)oht1_i*PI!6EvOqt4abmP}*!#)sVflFg z4_wN({r_IQKTjD-0)-M3S7JA*YGQepJ_ho}hNM17{QMEZkw$@c85i}@Ha$`3T10DE zBU(GvmvD==Xg$^#P?udP4SgilekkRO$5T!^ntq!Q-V2|`c+8u|w?7mbzhIbkEpoqp zyam#Fo3<6MJ9JNHRac@tgp%;i_M(Y>fkHzti-pJ%uK&!YPat9JPU9K_YBSW`z;--N4Yv5L7|g2X=XM=NF>KL50_ZRm+%96XFl9quXCWe`Ga z&METF;=Ys!-sR8q-bn0iyz3`oNjNe$L+Z8kesjk@3>AhNbXjbNv0;1*xq=qzfk2$Da1IbjIuID(5K z3QZ6^enrp&Z^eeW4#ZwIFy`XvJ4||m?ISfv$0?DWgbyFCYC9VFpFZu) z_WaUz(qhYfEy_9eW+~T}3r44EGR{b32fa;#yqDarsQIkKcE5dCn439Q=z(f8e2aBW zynnR@J>0?Irc+}-Z+b+c$NQ?K%ox$vUGNb7n*@sVYpL)Y`vx}P)R!}>S@BQhsLCDI za0QJUH)JR62`w@F1&TtsN)dIM7Qxzh#O}mdPHkxBknjOdn@|7%*x_(!pF==S-yuD=^lINtbQZES$A literal 0 HcmV?d00001 diff --git a/verifier/testdata/timestamp/sigEnv/timestampBeforeNotBefore.sig b/verifier/testdata/timestamp/sigEnv/timestampBeforeNotBefore.sig new file mode 100644 index 00000000..266a3c2f --- /dev/null +++ b/verifier/testdata/timestamp/sigEnv/timestampBeforeNotBefore.sig @@ -0,0 +1 @@ +{"payload":"eyJ0YXJnZXRBcnRpZmFjdCI6eyJkaWdlc3QiOiJzaGEyNTY6YzA2NjllZjM0Y2RjMTQzMzJjMGYxYWIwYzJjMDFhY2I5MWQ5NjAxNGIxNzJmMWE3NmYzYTM5ZTYzZDFmMGJkYSIsIm1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuZGlzdHJpYnV0aW9uLm1hbmlmZXN0LnYyK2pzb24iLCJzaXplIjo1Mjh9fQ","protected":"eyJhbGciOiJQUzI1NiIsImNyaXQiOlsiaW8uY25jZi5ub3Rhcnkuc2lnbmluZ1NjaGVtZSJdLCJjdHkiOiJhcHBsaWNhdGlvbi92bmQuY25jZi5ub3RhcnkucGF5bG9hZC52MStqc29uIiwiaW8uY25jZi5ub3Rhcnkuc2lnbmluZ1NjaGVtZSI6Im5vdGFyeS54NTA5IiwiaW8uY25jZi5ub3Rhcnkuc2lnbmluZ1RpbWUiOiIyMDI0LTA2LTE5VDE3OjMwOjExKzA4OjAwIn0","header":{"io.cncf.notary.timestampSignature":"MIIWxwYJKoZIhvcNAQcCoIIWuDCCFrQCAQMxDTALBglghkgBZQMEAgEwgfsGCyqGSIb3DQEJEAEEoIHrBIHoMIHlAgEBBgkrBgEEAaAyAgMwMTANBglghkgBZQMEAgEFAAQgobZw/34jR09Y539sHffP97pzdDD9eB8hb9GvG8rFoKwCFEUCRS0+BQyd7vbAoGoD3L+AMGaUGA8yMDI0MDYxOTA5MzAxNFowAwIBAQIUfVQs1Q0Ij8odYfCaVHTDPQ8UyPugYKReMFwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKDBBHbG9iYWxTaWduIG52LXNhMTIwMAYDVQQDDClHbG9iYWxzaWduIFRTQSBmb3IgQWR2YW5jZWQgLSBHNCAtIDIwMjMxMaCCElMwggZrMIIEU6ADAgECAhABGXV0ccmS10TfpZbruXAVMA0GCSqGSIb3DQEBCwUAMFsxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTEwLwYDVQQDEyhHbG9iYWxTaWduIFRpbWVzdGFtcGluZyBDQSAtIFNIQTM4NCAtIEc0MB4XDTIzMTEwMjEwMzAwMloXDTM0MTIwNDEwMzAwMlowXDELMAkGA1UEBhMCQkUxGTAXBgNVBAoMEEdsb2JhbFNpZ24gbnYtc2ExMjAwBgNVBAMMKUdsb2JhbHNpZ24gVFNBIGZvciBBZHZhbmNlZCAtIEc0IC0gMjAyMzExMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAsjVGdKqDjdWWpzxI1cXKqN9Uvgirod9c6UnQYF61pRr3Q1hDlzz0Z2MIMjwZfyvZVUbV1IzAXM+kxaUauqcrziZCITzlu6Gjld1g6hJVru/O3DKE7aO14D9z0TW4m7vFRN3huOvzWa2J9nGPWgr6CpIFhA2XAb8Fu/xYAbONydQFhaeQK26s09lO2qckNZZvqrOgQTvg+ecRjtVmAoAtPczPHqSWixeA3Ew5GiR1LMV3FtmRgyZ/5xOLokVU5rZKd+fSLS7nsDxI2caN+3r0K7ymIkii196teEeIDF+b9JFKBhz6A55qVh4rMOPzjlmwtB8eYTiGefmDg5SPCTBCM7QOt4iCGC0/14GLJ6Bp8dMFrsZFo8Ifm63pwMhP1+fGp0EyaP9ZylRc+7/ZHxbwUtLPuDWVpZHOox31dlKY7JFhiwmhrZmZ6KyUKJc4jAmuPJz4flGiN2rIcbodTw0mAVZ+V8N1QthT4GNj3X6eHahi6M7+mVlT9vMAiv2Tlc/RAgMBAAGjggGoMIIBpDAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwHQYDVR0OBBYEFMS+7oc8iXQO3rPuGRuFDM5BTn+dMFYGA1UdIARPME0wCAYGZ4EMAQQCMEEGCSsGAQQBoDIBHjA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAMBgNVHRMBAf8EAjAAMIGQBggrBgEFBQcBAQSBgzCBgDA5BggrBgEFBQcwAYYtaHR0cDovL29jc3AuZ2xvYmFsc2lnbi5jb20vY2EvZ3N0c2FjYXNoYTM4NGc0MEMGCCsGAQUFBzAChjdodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc3RzYWNhc2hhMzg0ZzQuY3J0MB8GA1UdIwQYMBaAFOoWxmnn48tXRTkzpPBAvtDDvWWWMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vY2EvZ3N0c2FjYXNoYTM4NGc0LmNybDANBgkqhkiG9w0BAQsFAAOCAgEAszLR6mf/29+ntDdEXe0evnYjyc4D7U3UauczjDxfIGLb7ulsODnlmXH7JpEfJ7FzXAMZz2gy0NXmdnhKqjyXMtIV7nocMjxgp0HKuT7xQerD0/HH5b7eGsbBjiLf1oDlj/KssiGNeLbEiYyUvTJzuNiXRDzXZmwNHBBcXqiIQL2grk5aLWRPBiWlhMY4cMdUcxSNVxapMByoCUnfpQEGA78Ts3SUmweBrw1BkFUpsGCpVPo4IDPOCboOTGdYgYap7YiGqZjjtuVGlyRHbEjREGrKcbI+XcM9LSGCa4Njb5fAkf77fZa5qsAczaWtkHiA1n1tiSpAjqwl+uuINiN+hvL7tQbtKIMss9qaem9IERaUNrVFQJ2BNQ3FsYybO+Y86XoYUPk5ipJ3u5EibqC5WyoBQCjk0UipMI6ihhI3TclZmcemA3/hkQp9CvgLQg5xrvbPuuUx+PkfLfDgCoyEjKU5ozuw8zbZQ9WbmCQP0MLjJj6t4fv7HqveBvb7aEHsMd+pyR6MGfY+9h6YLtFggVsmdPRUTkAE37Ve1Pfu8A2Hb0BAp2nqKMihqU93Eokxaumag3eLqcVEM+63aU4stKe0lXib1qpALDYap0RDs1LYYMZzV7981jXTI6NgQiLWFhXOExrpzvXlz1q+rD9z6fpzvxnNopdmyhxgDaK9VMwwggZZMIIEQaADAgECAg0B7BySQN79LkBdfEd0MA0GCSqGSIb3DQEBDAUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFI2MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTE4MDYyMDAwMDAwMFoXDTM0MTIxMDAwMDAwMFowWzELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExMTAvBgNVBAMTKEdsb2JhbFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMzg0IC0gRzQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDwAuIwI/rgG+GadLOvdYNfqUdSx2E6Y3w5I3ltdPwx5HQSGZb6zidiW64HiifuV6PENe2zNMeswwzrgGZt0ShKwSy7uXDycq6M95laXXauv0SofEEkjo+6xU//NkGrpy39eE5DiP6TGRfZ7jHPvIo7bmrEiPDul/bc8xigS5kcDoenJuGIyaDlmeKe9JxMP11b7Lbv0mXPRQtUPbFUUweLmW64VJmKqDGSO/J6ffwOWN+BauGwbB5lgirUIceU/kKWO/ELsX9/RpgOhz16ZevRVqkuvftYPbWF+lOZTVt07XJLog2CNxkM0KvqWsHvD9WZuT/0TzXxnA/TNxNS2SU07Zbv+GfqCL6PSXr/kLHU9ykV1/kNXdaHQx50xHAotIB7vSqbu4ThDqxvDbm19m1W/oodCT4kDmcmx/yyDaCUsLKUzHvmZ/6mWLLU2EESwVX9bpHFu7FMCEue1EIGbxsY1TbqZK7O/fUF5uJm0A4FIayxEQYjGeT7BTRE6giunUlnEYuC5a1ahqdm/TMDAd6ZJflxbumcXQJMYDzPAo8B/XLukvGnEt5CEk3sqSbldwKsDlcMCdFhniaI/MiyTdtk8EWfusE/VKPYdgKVbGqNyiJc9gwE4yn6S7Ac0zd0hNkdZqs0c48efXxeltY9GbCX6oxQkW2vV4Z+EDcdaxoU3wIDAQABo4IBKTCCASUwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFOoWxmnn48tXRTkzpPBAvtDDvWWWMB8GA1UdIwQYMBaAFK5sBaOTE+Ki5+LXHNbH8H/IZ1OgMD4GCCsGAQUFBwEBBDIwMDAuBggrBgEFBQcwAYYiaHR0cDovL29jc3AyLmdsb2JhbHNpZ24uY29tL3Jvb3RyNjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL3Jvb3QtcjYuY3JsMEcGA1UdIARAMD4wPAYEVR0gADA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG9w0BAQwFAAOCAgEAf+KI2VdnK0JfgacJC7rEuygYVtZMv9sbB3DG+wsJrQA6YDMfOcYWaxlASSUIHuSb99akDY8elvKGohfeQb9P4byrze7AI4zGhf5LFST5GETsH8KkrNCyz+zCVmUdvX/23oLIt59h07VGSJiXAmd6FpVK22LG0LMCzDRIRVXd7OlKn14U7XIQcXZw0g+W8+o3V5SRGK/cjZk4GVjCqaF+om4VJuq0+X8q5+dIZGkv0pqhcvb3JEt0Wn1yhjWzAlcfi5z8u6xM3vreU0yD/RKxtklVT3WdrG9KyC5qucqIwxIwTrIIc59eodaZzul9S5YszBZrGM3kWTeGCSziRdayzW6CdaXajR63Wy+ILj198fKRMAWcznt8oMWsr1EG8BHHHTDFUVZg6HyVPSLj1QokUyeXgPpIiScseeI85Zse46qEgok+wEr1If5iEO0dMPz2zOpIJ3yLdUJ/a8vzpWuVHwRYNAqJ7YJQ5NF7qMnmvkiqK1XZjbclIA4bUaDUY6qD6mxyYUrJ+kPExlfFnbY8sIuwuRwx773vFNgUQGwgHcIt6AvGjW2MtnHtUiH+PvafnzkarqzSL3ogsfSsqh3iLRSd+pZqHcY8yvPZHL9TTaRHWXyVxENB+SXiLBB+gfkNlKd98rUJ9dhgckBQlSDUQ0S++qCV5yBZtnjGpGqqIpswggWDMIIDa6ADAgECAg5F5rsDgzPDhWVI5v9FUTANBgkqhkiG9w0BAQwFADBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSNjETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjAeFw0xNDEyMTAwMDAwMDBaFw0zNDEyMTAwMDAwMDBaMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFI2MRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAlQfoc8pm+ewUyns89w0I8bRFCyyCtEjG61s8roO4QZIzFKRvf+kqzMawiGvFtonRxrL/FM5RFCHsSt0bWsbWh+5NOhUG7WRmC5KAykTec5RO86eJf094YwjIElBtQmYvTbl5KE1SGooagLcZgQ5+xIq8ZEwhHENo1z08isWyZtWQmrcxBsW+4m0yBqYe+bnrqqO4v76CY1DQ8BiJ3+QPefXqoh8q0nAue+e8k7ttU+JIfIwQBzj/ZrJ3YX7g6ow8qrSk9vOVShIHbf2MsonP0KBhd8hYdLDUIzr3XTrKotudCd5dRC2Q8YHNV5L6frxQBGM032uTGL5rNrI55KwkNrfw77YcE1eTtt6y+OKFt3OiuDWqRfLgnTahb1SK8XJWbi6IxVFCRBWU7qPFOJabTk5aC0fzBjZJdzC8cTflpuwhCHX85mEWP3fV2ZGXhAps1AJNdMAU7f05+4PyXhShBLAL6f7uj+FuC7IIs2FmCWqxBjplllnA8DX9ydoojRoRh3CBCqiadR2eOoYFAJ7bgNYl+dwFnidZTHY5W+r5paHYgw/R/98wEfmFzzNI9cptZBQselhP00sIScWVZBpjDnk99bOMylitnEJFeW4OhxlcVLFltr+Mm9wT6Q1vuC7cZ27JixG1hBSKABlwg3mRl5HUGie/Nx4yB9gUYzwoTK8CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFK5sBaOTE+Ki5+LXHNbH8H/IZ1OgMB8GA1UdIwQYMBaAFK5sBaOTE+Ki5+LXHNbH8H/IZ1OgMA0GCSqGSIb3DQEBDAUAA4ICAQCDJe3o0f2VUs2ewASgkWnmXNCE3tytok/oR3jWZZipW6g8h3wCitFutxZz5l/AVJjVdL7BzeIRka0jGD3d4XJElrSVXsB7jpl4FkMTVlezorM7tXfcQHKso+ubNT6xCCGh58RDN3kyvrXnnCxMvEMpmY4w06wh4OMd+tgHM3ZUACIquU0gLnBo2uVT/INc053y/0QMRGby0uO9RgAabQK6JV2NoTFR3VRGHE3bmZbvGhwEXKYV73jgef5d2z6qTFX9mhWpb+Gm+99wMOnD7kJG7cKTBYn6fWN7P9BxgXwA6JiuDng0wyX7rwqfIGvdOxOPEoziQRpIenOgd2nHtlx/gsge/lgbKCuobK1ebcAF0nu364D+JTf+AptorEJdw+71zNzwUHXSNmmc5nsE324GabbeCglIWYfrexRgemSqaUPvkcdM7BjdbO9TLYyZ4V7ycj7PVMi9Z+ykD0xF/9O5MCMHTI8Qv4aW2ZlatJlXHKTMuxWJU7osBQ/kxJ4ZsRg01Uyduu33H68klQR4qAO77oHl2l98i0qhkHQlp7M+S8gsVr3HyO844lyS8Hn3nIS6dC1hASB+ftHyTwdZX4stQ1LrRgyU4fVmR3l31VRbH60kN8tFWk6gREjI2LCZxRWECfbWSUnAZbjmGnFuoKjxguhFPmzWAtcKZ4MFWsmkEDGCA0kwggNFAgEBMG8wWzELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExMTAvBgNVBAMTKEdsb2JhbFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMzg0IC0gRzQCEAEZdXRxyZLXRN+lluu5cBUwCwYJYIZIAWUDBAIBoIIBLTAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwKwYJKoZIhvcNAQk0MR4wHDALBglghkgBZQMEAgGhDQYJKoZIhvcNAQELBQAwLwYJKoZIhvcNAQkEMSIEICktYskcc3KyxPm5x9gyYYT9PRVOUPSmcJ9kDjiLPczJMIGwBgsqhkiG9w0BCRACLzGBoDCBnTCBmjCBlwQgC3miOa5CEI3vVrNUBb+PzY5Zp0uE7uLew9lxweoXNOwwczBfpF0wWzELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExMTAvBgNVBAMTKEdsb2JhbFNpZ24gVGltZXN0YW1waW5nIENBIC0gU0hBMzg0IC0gRzQCEAEZdXRxyZLXRN+lluu5cBUwDQYJKoZIhvcNAQELBQAEggGADVoZuMULq3djCO+GBYUNk72EqqsL6e4X5YkaQr9fHFZNMtRABuLGBHwLXf5X62LEDvsY8XuncdR8yRm37+qOb++YWzqy14GZkymRLE6CVmc9Bk0ubMr0NFEEqoi5UAkJ+uw4cdshxZz8OBh7jRQ6A5g1pmCuLUlWyLOpYwghZkrhf7LjbaPGXoW506UXpSMVpzCOhS/xZLQCb3qk6/+giVF13cws/vFRImkeBjcHjZb+Mg9BfzHAcCeF9AM6VZqGfACWVKHKAQohGIaKOe13ckHCXsET91DTkkvnJjyyoNjGTOpxBlg5UH4vdB8iUlaed/B80zOZiXzhwR7Tl1Si3D5n/LBak+ef8+fB7AZZBWF6u1iQaIcaf5u0TdTseFMiJyEg4AjaJCXesa5v2G23yBxZNC1UIfqiD506uFg1E6zX59krRhR3dZRK0qd4P3NcRwuXH4rRzRg+44B9+ICUnh5QmnRDqhnhKXPtDUnSVgcfIQ6W8/IU1N9vLylRJe4q","x5c":["MIIDRTCCAi2gAwIBAgICAKYwDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZOb3RhcnkxEDAOBgNVBAMTB3Rlc3RUU0EwIhgPMjA5OTA5MTgxMTU0MzRaGA8yMTAwMDkxODExNTQzNFowTzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZOb3RhcnkxEDAOBgNVBAMTB3Rlc3RUU0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDI7xKl3GyBZregnHgxUw7rb3yO5jSo31Pa+EhxghQ0/rRKc/1DtfMQURjDYDdjqRmEXq8rVyEAuaBXSKqBMq9bazP7Ot8N/B0OgRCgXwizn//Ha5XfpHqV9lUud4oztdxapejfT6UQSIVqtgWEbZkr4N74G5NV13LlITtWmHpTLo2LfE7jAXTaoCjo/U/eVFFc6X7jyXwaAVyNC2Pi45d/GOaFx/MGHnK6zbN8PeIh5KqInp0UNcHZLBbduxWQhdISULR/x6pVocqExv6zLmRbn5I65wrYL/8gpQPTeZv4S2COpB+25Xy8oyaM6tPa96Pi1NIXtChWO8+muXj1Z4VfAgMBAAGjJzAlMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzANBgkqhkiG9w0BAQsFAAOCAQEAXFaaITvi3skq+czzmbyebtrAa8I9iEbjmWSPjoaUir2NYOLWsyQ7+gkBlMcw5+anP+BC98VBgNVjuQ5oXwdu57xouW7jk/dI5uuKLOFxFdCG7FwW3ycD6GGgj+/2LthxNOxc7CnnMjUuSw2FKJKesiuHQJpdPjgw9cKs+fZF5tr6ZhX4yAUFqouZJ7Hc5JSj3zyEpIbFapVpSAK8O1/mct4KDtt1SmyYn34o55ggyLurrlZ9ctQWHT8xyjc6+b4lEKbilA+xjTt+/BLIs/v/8CVIUzz6OzTCwBraj3kayM7CdGKSysocnJZ/yUcHVw1hLs1+JIMj75i0T6s+GtuT4A=="],"io.cncf.notary.signingAgent":"Notation/1.0.0"},"signature":"pWbiEQRI4e_8nPV2AJPGNHg289WVwqnK7xqH6byLwXjc0hWrkniUSkIPLd3XDhGdpqLbqSLazU3cVTbSphV25aW1GS1G3Qsa3W3wzcwfq5ZhVDmuwO4u_322SAw01s3hVVxXciYK-9bTKkkfHfE_9ZKVSf7zEr28vyuQ92aZd85P-oz3YfvvnAxBGLYp-RPOQNSmtD2IxJWWTNLtwnnntBqr0WdGXS7wWSmUWzcKS9kNEAER1CN8L9SCh2mvBcNfDJlwCoLNaQZK_ZtBIrDQHmQjYkjSBupFTKp_TFic45j79AS7_-4sMdscJbZJzR9Tav7JInMhIKvh0mIfSfkIVQ"} \ No newline at end of file diff --git a/verifier/testdata/timestamp/sigEnvWithoutTimestamp.sig b/verifier/testdata/timestamp/sigEnv/withoutTimestamp.sig similarity index 100% rename from verifier/testdata/timestamp/sigEnvWithoutTimestamp.sig rename to verifier/testdata/timestamp/sigEnv/withoutTimestamp.sig diff --git a/verifier/testdata/truststore/x509/ca/valid-trust-store/TestTimestampNotYetValid.crt b/verifier/testdata/truststore/x509/ca/valid-trust-store/TestTimestampNotYetValid.crt new file mode 100644 index 00000000..b135a840 --- /dev/null +++ b/verifier/testdata/truststore/x509/ca/valid-trust-store/TestTimestampNotYetValid.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDRTCCAi2gAwIBAgICAKYwDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMx +CzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZOb3Rhcnkx +EDAOBgNVBAMTB3Rlc3RUU0EwIhgPMjA5OTA5MTgxMTU0MzRaGA8yMTAwMDkxODEx +NTQzNFowTzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0 +dGxlMQ8wDQYDVQQKEwZOb3RhcnkxEDAOBgNVBAMTB3Rlc3RUU0EwggEiMA0GCSqG +SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDI7xKl3GyBZregnHgxUw7rb3yO5jSo31Pa ++EhxghQ0/rRKc/1DtfMQURjDYDdjqRmEXq8rVyEAuaBXSKqBMq9bazP7Ot8N/B0O +gRCgXwizn//Ha5XfpHqV9lUud4oztdxapejfT6UQSIVqtgWEbZkr4N74G5NV13Ll +ITtWmHpTLo2LfE7jAXTaoCjo/U/eVFFc6X7jyXwaAVyNC2Pi45d/GOaFx/MGHnK6 +zbN8PeIh5KqInp0UNcHZLBbduxWQhdISULR/x6pVocqExv6zLmRbn5I65wrYL/8g +pQPTeZv4S2COpB+25Xy8oyaM6tPa96Pi1NIXtChWO8+muXj1Z4VfAgMBAAGjJzAl +MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzANBgkqhkiG9w0B +AQsFAAOCAQEAXFaaITvi3skq+czzmbyebtrAa8I9iEbjmWSPjoaUir2NYOLWsyQ7 ++gkBlMcw5+anP+BC98VBgNVjuQ5oXwdu57xouW7jk/dI5uuKLOFxFdCG7FwW3ycD +6GGgj+/2LthxNOxc7CnnMjUuSw2FKJKesiuHQJpdPjgw9cKs+fZF5tr6ZhX4yAUF +qouZJ7Hc5JSj3zyEpIbFapVpSAK8O1/mct4KDtt1SmyYn34o55ggyLurrlZ9ctQW +HT8xyjc6+b4lEKbilA+xjTt+/BLIs/v/8CVIUzz6OzTCwBraj3kayM7CdGKSysoc +nJZ/yUcHVw1hLs1+JIMj75i0T6s+GtuT4A== +-----END CERTIFICATE----- diff --git a/verifier/testdata/truststore/x509/tsa/test-mismatch/wabbit-networks.io.crt b/verifier/testdata/truststore/x509/tsa/test-mismatch/wabbit-networks.io.crt new file mode 100644 index 00000000..60028b63 --- /dev/null +++ b/verifier/testdata/truststore/x509/tsa/test-mismatch/wabbit-networks.io.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDVjCCAj6gAwIBAgIBUTANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJVUzEL +MAkGA1UECBMCV0ExEDAOBgNVBAcTB1NlYXR0bGUxDzANBgNVBAoTBk5vdGFyeTEb +MBkGA1UEAxMSd2FiYml0LW5ldHdvcmtzLmlvMB4XDTIzMDExOTA4MTkwN1oXDTMz +MDExOTA4MTkwN1owWjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQH +EwdTZWF0dGxlMQ8wDQYDVQQKEwZOb3RhcnkxGzAZBgNVBAMTEndhYmJpdC1uZXR3 +b3Jrcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANHhlP+SiY7h +sGlf2mADOzJW/J9siqMkiQvSOx0OSM2yxetfVQL/abi4iqCXM6wkSxviBeNwIoYE +s4thMA8NGEbnKoXktyh9vmiLB1FW7HHr4QLwjgLzgWJKIQTy1JmDBecXZh56d0f3 +w3Yj1IDTvkIScXCNI+5v/08GUQKhyBwv7Fq9MYpo2lfXSI7V33BKKddXIxPGVWwK +GvPE0sg2VV7WM84ZZLdDKz2mq0PtPTHrSwg3hlK/mjn+blg3gsYQ4h9/7Z6nNaF9 +X0SdyESl841ZWrtMhAOFpIzLbz9ete8NRd3bYCRBIr5gscHWTf6lyUgy4xzsSwMH +PsGLM4A+Z00CAwEAAaMnMCUwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsG +AQUFBwMDMA0GCSqGSIb3DQEBCwUAA4IBAQAbN0Eru56uTQSC28ZTf8D7VyCkYrrW +LYiJMYdOKBzzKV9mKaM0OGF2uyWwDaPxp9KTdLXmBp9EFq5SXXArFA+nRS7KinDA +e2O7A/9Std2XjKi927rkA2cj239d5lRsjWXqJXf9vAMV9a2FjUM/in2Eevlq7bvj +FE3l26VXCKtOs9ErmfxrL+6ETRKSVYOOG/rSHFv/SB2MlqDg5QsXC9lZjzL5/X/i +oe2qZKhp6X5DPpad1q1Q4ItKdTN+2EXyMyoHn1BJKNba7CUUvXf03EJebT/Im+qo +zfEksJeZJUSlSujANUPoCpsEYGWWQx5G+ViG05Sqs+6ppKrut+P+DVPo +-----END CERTIFICATE----- diff --git a/verifier/timestamp_test.go b/verifier/timestamp_test.go index 8c1d3021..73479023 100644 --- a/verifier/timestamp_test.go +++ b/verifier/timestamp_test.go @@ -15,8 +15,11 @@ package verifier import ( "context" + "crypto/x509" + "net/http" "os" "testing" + "time" "github.com/notaryproject/notation-core-go/signature" "github.com/notaryproject/notation-core-go/signature/cose" @@ -27,6 +30,8 @@ import ( "github.com/notaryproject/notation-go/verifier/truststore" ) +var revocationHttpClient = &http.Client{Timeout: 2 * time.Second} + func TestAuthenticTimestamp(t *testing.T) { dir.UserConfigDir = "testdata" trustStore := truststore.NewX509TrustStore(dir.ConfigFS()) @@ -41,13 +46,13 @@ func TestAuthenticTimestamp(t *testing.T) { TrustedIdentities: []string{"*"}, } // valid JWS signature envelope with timestamp countersignature - jwsEnvContent, err := parseEnvContent("testdata/timestamp/jwsSigEnvWithTimestamp.sig", jws.MediaTypeEnvelope) + jwsEnvContent, err := parseEnvContent("testdata/timestamp/sigEnv/jwsWithTimestamp.sig", jws.MediaTypeEnvelope) if err != nil { t.Fatalf("failed to get signature envelope content: %v", err) } // valid COSE signature envelope with timestamp countersignature - coseEnvContent, err := parseEnvContent("testdata/timestamp/coseSigEnvWithTimestamp.sig", cose.MediaTypeEnvelope) + coseEnvContent, err := parseEnvContent("testdata/timestamp/sigEnv/coseWithTimestamp.sig", cose.MediaTypeEnvelope) if err != nil { t.Fatalf("failed to get signature envelope content: %v", err) } @@ -57,7 +62,7 @@ func TestAuthenticTimestamp(t *testing.T) { EnvelopeContent: jwsEnvContent, VerificationLevel: trustpolicy.LevelStrict, } - authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) if err := authenticTimestampResult.Error; err != nil { t.Fatalf("expected nil error, but got %s", err) } @@ -68,14 +73,14 @@ func TestAuthenticTimestamp(t *testing.T) { EnvelopeContent: coseEnvContent, VerificationLevel: trustpolicy.LevelStrict, } - authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) if err := authenticTimestampResult.Error; err != nil { t.Fatalf("expected nil error, but got %s", err) } }) t.Run("verify Authentic Timestamp jws with expired codeSigning cert", func(t *testing.T) { - jwsEnvContent, err := parseEnvContent("testdata/timestamp/jwsSigEnvExpiredWithTimestamp.sig", jws.MediaTypeEnvelope) + jwsEnvContent, err := parseEnvContent("testdata/timestamp/sigEnv/jwsExpiredWithTimestamp.sig", jws.MediaTypeEnvelope) if err != nil { t.Fatalf("failed to get signature envelope content: %v", err) } @@ -83,14 +88,14 @@ func TestAuthenticTimestamp(t *testing.T) { EnvelopeContent: jwsEnvContent, VerificationLevel: trustpolicy.LevelStrict, } - authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) if err := authenticTimestampResult.Error; err != nil { t.Fatalf("expected nil error, but got %s", err) } }) t.Run("verify Authentic Timestamp cose with expired codeSigning cert", func(t *testing.T) { - coseEnvContent, err := parseEnvContent("testdata/timestamp/coseSigEnvExpiredWithTimestamp.sig", cose.MediaTypeEnvelope) + coseEnvContent, err := parseEnvContent("testdata/timestamp/sigEnv/coseExpiredWithTimestamp.sig", cose.MediaTypeEnvelope) if err != nil { t.Fatalf("failed to get signature envelope content: %v", err) } @@ -98,7 +103,7 @@ func TestAuthenticTimestamp(t *testing.T) { EnvelopeContent: coseEnvContent, VerificationLevel: trustpolicy.LevelStrict, } - authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) if err := authenticTimestampResult.Error; err != nil { t.Fatalf("expected nil error, but got %s", err) } @@ -119,7 +124,7 @@ func TestAuthenticTimestamp(t *testing.T) { EnvelopeContent: coseEnvContent, VerificationLevel: trustpolicy.LevelStrict, } - authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) if err := authenticTimestampResult.Error; err != nil { t.Fatalf("expected nil error, but got %s", err) } @@ -140,7 +145,7 @@ func TestAuthenticTimestamp(t *testing.T) { EnvelopeContent: jwsEnvContent, VerificationLevel: trustpolicy.LevelStrict, } - authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) expectedErrMsg := "failed to check tsa trust store configuration in turst policy with error: invalid trust policy statement: \"test-timestamp\" is missing separator in trust store value \"tsa\". The required format is :" if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { t.Fatalf("expected %s, but got %s", expectedErrMsg, err) @@ -158,7 +163,7 @@ func TestAuthenticTimestamp(t *testing.T) { TrustStores: []string{"ca:valid-trust-store"}, TrustedIdentities: []string{"*"}, } - coseEnvContent, err := parseEnvContent("testdata/timestamp/coseSigEnvExpiredWithTimestamp.sig", cose.MediaTypeEnvelope) + coseEnvContent, err := parseEnvContent("testdata/timestamp/sigEnv/coseExpiredWithTimestamp.sig", cose.MediaTypeEnvelope) if err != nil { t.Fatalf("failed to get signature envelope content: %v", err) } @@ -166,7 +171,7 @@ func TestAuthenticTimestamp(t *testing.T) { EnvelopeContent: coseEnvContent, VerificationLevel: trustpolicy.LevelStrict, } - authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) expectedErrMsg := "verification time is after certificate \"CN=testTSA,O=Notary,L=Seattle,ST=WA,C=US\" validity period, it was expired at \"Tue, 18 Jun 2024 07:30:31 +0000\"" if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { t.Fatalf("expected %s, but got %s", expectedErrMsg, err) @@ -174,7 +179,7 @@ func TestAuthenticTimestamp(t *testing.T) { }) t.Run("verify Authentic Timestamp failed due to missing timestamp countersignature", func(t *testing.T) { - envContent, err := parseEnvContent("testdata/timestamp/sigEnvWithoutTimestamp.sig", jws.MediaTypeEnvelope) + envContent, err := parseEnvContent("testdata/timestamp/sigEnv/withoutTimestamp.sig", jws.MediaTypeEnvelope) if err != nil { t.Fatalf("failed to get signature envelope content: %v", err) } @@ -182,12 +187,238 @@ func TestAuthenticTimestamp(t *testing.T) { EnvelopeContent: envContent, VerificationLevel: trustpolicy.LevelStrict, } - authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) expectedErrMsg := "no timestamp countersignature was found in the signature envelope" if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { t.Fatalf("expected %s, but got %s", expectedErrMsg, err) } }) + + t.Run("verify Authentic Timestamp failed due to invalid timestamp countersignature content type", func(t *testing.T) { + signedToken, err := os.ReadFile("testdata/timestamp/countersignature/TimeStampTokenWithInvalideContentType.p7s") + if err != nil { + t.Fatalf("failed to get signedToken: %v", err) + } + envContent, err := parseEnvContent("testdata/timestamp/sigEnv/withoutTimestamp.sig", jws.MediaTypeEnvelope) + if err != nil { + t.Fatalf("failed to get signature envelope content: %v", err) + } + envContent.SignerInfo.UnsignedAttributes.TimestampSignature = signedToken + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: envContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) + expectedErrMsg := "failed to parse timestamp countersignature with error: unexpected content type: 1.2.840.113549.1.7.1" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) + + t.Run("verify Authentic Timestamp failed due to invalid TSTInfo", func(t *testing.T) { + signedToken, err := os.ReadFile("testdata/timestamp/countersignature/TimeStampTokenWithInvalidTSTInfo.p7s") + if err != nil { + t.Fatalf("failed to get signedToken: %v", err) + } + envContent, err := parseEnvContent("testdata/timestamp/sigEnv/withoutTimestamp.sig", jws.MediaTypeEnvelope) + if err != nil { + t.Fatalf("failed to get signature envelope content: %v", err) + } + envContent.SignerInfo.UnsignedAttributes.TimestampSignature = signedToken + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: envContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) + expectedErrMsg := "failed to get the timestamp TSTInfo with error: cannot unmarshal TSTInfo from timestamp token: asn1: structure error: tags don't match (23 vs {class:0 tag:16 length:3 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue: tag: stringType:0 timeType:24 set:false omitEmpty:false} Time @89" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) + + t.Run("verify Authentic Timestamp failed due to failed to validate TSTInfo", func(t *testing.T) { + signedToken, err := os.ReadFile("testdata/timestamp/countersignature/TimeStampToken.p7s") + if err != nil { + t.Fatalf("failed to get signedToken: %v", err) + } + envContent, err := parseEnvContent("testdata/timestamp/sigEnv/withoutTimestamp.sig", jws.MediaTypeEnvelope) + if err != nil { + t.Fatalf("failed to get signature envelope content: %v", err) + } + envContent.SignerInfo.UnsignedAttributes.TimestampSignature = signedToken + envContent.SignerInfo.Signature = []byte("mismatch") + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: envContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) + expectedErrMsg := "failed to get timestamp from timestamp countersignature with error: invalid TSTInfo: mismatched message" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) + + t.Run("verify Authentic Timestamp failed due to failed to verify timestamp countersignature", func(t *testing.T) { + signedToken, err := os.ReadFile("testdata/timestamp/countersignature/TimeStampTokenWithoutCertificate.p7s") + if err != nil { + t.Fatalf("failed to get signedToken: %v", err) + } + envContent, err := parseEnvContent("testdata/timestamp/sigEnv/withoutTimestamp.sig", jws.MediaTypeEnvelope) + if err != nil { + t.Fatalf("failed to get signature envelope content: %v", err) + } + envContent.SignerInfo.UnsignedAttributes.TimestampSignature = signedToken + envContent.SignerInfo.Signature = []byte("notation") + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: envContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) + expectedErrMsg := "failed to verify the timestamp countersignature with error: failed to verify signed token: signing certificate not found in the timestamp token" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) + + t.Run("verify Authentic Timestamp failed due to failed to validate tsa cert chain", func(t *testing.T) { + signedToken, err := os.ReadFile("testdata/timestamp/countersignature/TimeStampTokenWithSHA1RootCert.p7s") + if err != nil { + t.Fatalf("failed to get signedToken: %v", err) + } + envContent, err := parseEnvContent("testdata/timestamp/sigEnv/withoutTimestamp.sig", jws.MediaTypeEnvelope) + if err != nil { + t.Fatalf("failed to get signature envelope content: %v", err) + } + envContent.SignerInfo.UnsignedAttributes.TimestampSignature = signedToken + envContent.SignerInfo.Signature = []byte("notation") + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: envContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) + expectedErrMsg := "failed to validate the timestamping certificate chain with error: root certificate with subject \"CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US\" is invalid or not self-signed. Certificate chain must end with a valid self-signed root certificate. Error: x509: cannot verify signature: insecure algorithm SHA1-RSA (temporarily override with GODEBUG=x509sha1=1)" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) + + t.Run("verify Authentic Timestamp failed due to trust store does not exist", func(t *testing.T) { + dummyTrustPolicy := &trustpolicy.TrustPolicy{ + Name: "test-timestamp", + RegistryScopes: []string{"*"}, + SignatureVerification: trustpolicy.SignatureVerification{ + VerificationLevel: trustpolicy.LevelStrict.Name, + VerifyTimestamp: trustpolicy.OptionAlways, + }, + TrustStores: []string{"ca:valid-trust-store", "tsa:does-not-exist"}, + TrustedIdentities: []string{"*"}, + } + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: coseEnvContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) + expectedErrMsg := "failed to load tsa trust store with error: the trust store \"does-not-exist\" of type \"tsa\" does not exist" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) + + t.Run("verify Authentic Timestamp failed due to empty trust store", func(t *testing.T) { + dummyTrustPolicy := &trustpolicy.TrustPolicy{ + Name: "test-timestamp", + RegistryScopes: []string{"*"}, + SignatureVerification: trustpolicy.SignatureVerification{ + VerificationLevel: trustpolicy.LevelStrict.Name, + VerifyTimestamp: trustpolicy.OptionAlways, + }, + TrustStores: []string{"ca:valid-trust-store", "tsa:test-empty"}, + TrustedIdentities: []string{"*"}, + } + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: coseEnvContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, dummyTrustStore{}, outcome, revocationHttpClient) + expectedErrMsg := "no trusted TSA certificate found in trust store" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) + + t.Run("verify Authentic Timestamp failed due to tsa not trust", func(t *testing.T) { + dummyTrustPolicy := &trustpolicy.TrustPolicy{ + Name: "test-timestamp", + RegistryScopes: []string{"*"}, + SignatureVerification: trustpolicy.SignatureVerification{ + VerificationLevel: trustpolicy.LevelStrict.Name, + VerifyTimestamp: trustpolicy.OptionAlways, + }, + TrustStores: []string{"ca:valid-trust-store", "tsa:test-mismatch"}, + TrustedIdentities: []string{"*"}, + } + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: coseEnvContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) + expectedErrMsg := "failed to verify the timestamp countersignature with error: tsa certificate chain does not contain trusted certificate in trust store" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) + + t.Run("verify Authentic Timestamp failed due to timestamp before signing cert not before", func(t *testing.T) { + dummyTrustPolicy := &trustpolicy.TrustPolicy{ + Name: "test-timestamp", + RegistryScopes: []string{"*"}, + SignatureVerification: trustpolicy.SignatureVerification{ + VerificationLevel: trustpolicy.LevelStrict.Name, + VerifyTimestamp: trustpolicy.OptionAlways, + }, + TrustStores: []string{"ca:valid-trust-store", "tsa:test-timestamp"}, + TrustedIdentities: []string{"*"}, + } + envContent, err := parseEnvContent("testdata/timestamp/sigEnv/timestampBeforeNotBefore.sig", jws.MediaTypeEnvelope) + if err != nil { + t.Fatalf("failed to get signature envelope content: %v", err) + } + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: envContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) + expectedErrMsg := "timestamp lower limit \"Wed, 19 Jun 2024 09:30:13 +0000\" is before certificate \"CN=testTSA,O=Notary,L=Seattle,ST=WA,C=US\" validity period, it will be valid from \"Fri, 18 Sep 2099 11:54:34 +0000\"" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) + + t.Run("verify Authentic Timestamp failed due to timestamp after signing cert not after", func(t *testing.T) { + dummyTrustPolicy := &trustpolicy.TrustPolicy{ + Name: "test-timestamp", + RegistryScopes: []string{"*"}, + SignatureVerification: trustpolicy.SignatureVerification{ + VerificationLevel: trustpolicy.LevelStrict.Name, + VerifyTimestamp: trustpolicy.OptionAlways, + }, + TrustStores: []string{"ca:valid-trust-store", "tsa:test-timestamp"}, + TrustedIdentities: []string{"*"}, + } + envContent, err := parseEnvContent("testdata/timestamp/sigEnv/timestampAfterNotAfter.sig", cose.MediaTypeEnvelope) + if err != nil { + t.Fatalf("failed to get signature envelope content: %v", err) + } + outcome := ¬ation.VerificationOutcome{ + EnvelopeContent: envContent, + VerificationLevel: trustpolicy.LevelStrict, + } + authenticTimestampResult := verifyAuthenticTimestamp(context.Background(), dummyTrustPolicy, trustStore, outcome, revocationHttpClient) + expectedErrMsg := "timestamp upper limit \"Wed, 19 Jun 2024 09:35:59 +0000\" is after certificate \"CN=testTSA,O=Notary,L=Seattle,ST=WA,C=US\" validity period, it was expired at \"Tue, 18 Sep 2001 11:54:34 +0000\"" + if err := authenticTimestampResult.Error; err == nil || err.Error() != expectedErrMsg { + t.Fatalf("expected %s, but got %s", expectedErrMsg, err) + } + }) } func parseEnvContent(filepath, format string) (*signature.EnvelopeContent, error) { @@ -201,3 +432,9 @@ func parseEnvContent(filepath, format string) (*signature.EnvelopeContent, error } return sigEnv.Content() } + +type dummyTrustStore struct{} + +func (ts dummyTrustStore) GetCertificates(ctx context.Context, storeType truststore.Type, namedStore string) ([]*x509.Certificate, error) { + return nil, nil +} diff --git a/verifier/verifier.go b/verifier/verifier.go index f9315134..8973a85f 100644 --- a/verifier/verifier.go +++ b/verifier/verifier.go @@ -288,7 +288,7 @@ func (v *verifier) processSignature(ctx context.Context, sigBlob []byte, envelop // verify authentic timestamp logger.Debug("Validating authentic timestamp") - authenticTimestampResult := verifyAuthenticTimestamp(ctx, trustPolicy, v.trustStore, outcome) + authenticTimestampResult := verifyAuthenticTimestamp(ctx, trustPolicy, v.trustStore, outcome, &http.Client{Timeout: 2 * time.Second}) outcome.VerificationResults = append(outcome.VerificationResults, authenticTimestampResult) logVerificationResult(logger, authenticTimestampResult) if isCriticalFailure(authenticTimestampResult) { @@ -516,7 +516,7 @@ func verifyExpiry(outcome *notation.VerificationOutcome) *notation.ValidationRes } } -func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.TrustPolicy, x509TrustStore truststore.X509TrustStore, outcome *notation.VerificationOutcome) *notation.ValidationResult { +func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.TrustPolicy, x509TrustStore truststore.X509TrustStore, outcome *notation.VerificationOutcome, revocationHttpClient *http.Client) *notation.ValidationResult { logger := log.GetLogger(ctx) // under signing scheme notary.x509 @@ -554,6 +554,7 @@ func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.Trus // not performing any timestamp verification, signing cert chain MUST // be valid at time of verification if !performTimestampVerification { + logger.Info("Timestamp verification disabled") for _, cert := range signerInfo.CertificateChain { if timeStampLowerLimit.Before(cert.NotBefore) { return ¬ation.ValidationResult{ @@ -672,7 +673,7 @@ func verifyAuthenticTimestamp(ctx context.Context, trustPolicy *trustpolicy.Trus logger.Info("Checking timestamping certificate chain revocation...") timeStampLowerLimit = ts.Add(-accuracy) timeStampUpperLimit = ts.Add(accuracy) - certResults, err := revocation.ValidateTimestampCertChain(tsaCertChain, timeStampUpperLimit, &http.Client{Timeout: 2 * time.Second}) + certResults, err := revocation.ValidateTimestampCertChain(tsaCertChain, timeStampUpperLimit, revocationHttpClient) if err != nil { return ¬ation.ValidationResult{ Error: fmt.Errorf("failed to check timestamping certificate chain revocation with error: %w", err),