sigstore-python
sigstore-python copied to clipboard
Support more signing cert signing algorithms in verification
sigstore-python chooses to use a specific signing algorithm for signing with the signing certificate: this seems like a fine decision.
Even for verifying the signing certificate signature, sigstore clients are not required to support more than one key type... but it would make sense to support the low hanging fruit in https://github.com/sigstore/architecture-docs/blob/main/algorithm-registry.md (IOW the algorithms supported by cryptography but not yet by sigstore.verify: RSA, EdDSA).
This requires some changes in verifier.py:
verify_artifact()verify_dsse()- after #1432 also
_v2_verifier_from_certificate()
I have an attempt here, but I get a rekor v1 error when trying submitting with SECP521R1
- https://github.com/ramonpetgrave64/sigstore-python/compare/key-details...ramonpetgrave64:sigstore-python:verify-more-key-types
$ pytest -k test_verifier_alternate_algorithms -vvv
...
E sigstore._internal.rekor.RekorClientError: 400: error processing entry: entry algorithms are not allowed