Skip to content

verify: Refactor log entry consistency verification#103

Merged
wolfv merged 1 commit into
sigstore:mainfrom
jku:verify-refactor
May 28, 2026
Merged

verify: Refactor log entry consistency verification#103
wolfv merged 1 commit into
sigstore:mainfrom
jku:verify-refactor

Conversation

@jku

@jku jku commented May 27, 2026

Copy link
Copy Markdown
Member

Verify that

  1. We understand each entry (kind and version)
  2. Each entry matches the bundle material

The old code seemingly only verified the second part if we happened to recognise the entry type (unknown types and versions were just skipped)

Additionally, only runs this code if policy includes "verify_tlog".

Verify that
1. We understand each entry (kind and version)
2. The entry matches the bundle material

The old code seemingly only verified the second part if
we happened to recognise the entry type.

Additionally, only runs this code if policy includes
"verify_tlog".

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku

jku commented May 27, 2026

Copy link
Copy Markdown
Member Author

I'm not really 100% sure about this design but it seems like an improvement:

  • maybe it would be useful to expose consistency verification for specific types individually in the API...
  • but it seems just as possible that we could just extend the policy mechanism (so users could define what types they expect to find) -- and and in reality in the future (some day when we're rekor v2 only) we only expect hashedrekord
  • in any case, I think the default case should be what this PR does: we have a list of known entry types we can verify, all entries should be in that list, and we should verify all entries

@jku jku mentioned this pull request May 27, 2026
@wolfv wolfv merged commit 74699d9 into sigstore:main May 28, 2026
16 checks passed
@wolfv wolfv mentioned this pull request May 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants