Description

Currently, when the user supplies a trust_config.json with a certificate chain that does not contain an ["validFor"]["end"] value, sigstore-python will skip that certificate.

• sigstore-python/sigstore/verify/verifier.py

  Lines 144 to 164 in 93545ab

  	try:
  	verifier.verify(timestamp_response, signature)
  	except Rfc3161VerificationError as e:
  	_logger.debug("Unable to verify Timestamp with CA.")
  	_logger.exception(e)
  	continue
  	if (
  	certificate_authority.validity_period_start
  	and certificate_authority.validity_period_end
  	):
  	if (
  	certificate_authority.validity_period_start
  	<= timestamp_response.tst_info.gen_time
  	< certificate_authority.validity_period_end
  	):
  	return TimestampVerificationResult(
  	source=TimestampSource.TIMESTAMP_AUTHORITY,
  	time=timestamp_response.tst_info.gen_time,
  	)

example

            {
                "subject": {
                    "organization": "sigstore.dev",
                    "commonName": "sigstore-tsa-selfsigned"
                },
                "certChain": {
                    "certificates": [
                        {
                            "rawBytes": "MIICDzCCAZagAwIBAgIUCjWhBmHV4kFzxomWp/J98n4DfKcwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTAzMjgwOTE0MDZaFw0zNTAzMjYwODE0MDZaMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEx1v5F3HpD9egHuknpBFlRz7QBRDJu4aeVzt9zJLRY0lvmx1lF7WBM2c9AN8ZGPQsmDqHlJN2R/7+RxLkvlLzkc19IOx38t7mGGEcB7agUDdCF/Ky3RTLSK0Xo/0AgHQdo2owaDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFKj8ZPYo3i7mO3NPVIxSxOGc3VOlMB8GA1UdIwQYMBaAFDsgRlletTJNRzDObmPuc3RH8gR9MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMDA2cAMGQCMESvVS6GGtF33+J19TfwENWJXjRv4i0/HQFwLUSkX6TfV7g0nG8VnqNHJLvEpAtOjQIwUD3uywTXorQP1DgbV09rF9Yen+CEqs/iEpieJWPst280SSOZ5Na+dyPVk9/8SFk6"
                        },
                        {
                            "rawBytes": "MIIB9zCCAXygAwIBAgIUCPExEFKiQh0dP4sp5ltmSYSSkFUwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTAzMjgwOTE0MDZaFw0zNTAzMjYwODE0MDZaMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATt0tIDWyo4ARfL9BaSo0W5bJQEbKJTU/u7llvdjSI5aTkOAJa8tixn2+LEfPG4dMFdsMPtsIuU1qn2OqFiuMk6vHv/c+az25RQVY1oo50iMb0jIL3N4FgwhPFpZnCbQPOjRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBQ7IEZZXrUyTUcwzm5j7nN0R/IEfTAKBggqhkjOPQQDAwNpADBmAjEA2MI1VXgbf3dUOSc95hSRypBKOab18eh2xzQtxUsHvWeY+1iFgyMluUuNR6taoSmFAjEA31m2czguZhKYX+4JSKu5pRYhBTXAd8KKQ3xdPRX/qCaLvT2qJAEQ1YQM3EJRrtI7"
                        }
                    ]
                },
                "validFor": {
                    "start": "2025-03-28T09:14:06Z",
                }
            }

I think this may not be the originally intended behavior, given these snippets from sisgtore-go.

• https://github.com/sigstore/sigstore-go/blob/7bce0040754fbaa9446f2fdc791240d255eec61a/pkg/root/trusted_root_create.go#L178-L180
• https://github.com/sigstore/sigstore-go/blob/7bce0040754fbaa9446f2fdc791240d255eec61a/pkg/root/signing_config_test.go#L763-L773

Instead, I propose sigstore-python compare against the optional end date only if present, while still always comparing against the mandatory start date.