feat(jans-cedarling): implement Sigstore/Cosign verification library

[olehbozhok]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #14465

Implementation Details

New crate for offline, WASM-compatible Sigstore/Cosign bundle verification.
No network calls during verify() — all trust material is compiled in or
supplied by the caller.

Architecture

The 10-step verification pipeline runs in verifier.rs (the orchestrator).
Each step delegates to a dedicated module:

verifier → bundle(parse) → cert(extract) → tlog(SET)
→ chain(validate) → sct(CTFE) → crypto(signature)
→ policy(identity) → merkle(inclusion proof)

Module dependency tree:

  lib.rs (pub re-exports)
     │

┌────────┼────────┐
verifier policy trust_root
│
├── bundle
├── cert ── chain ── crypto
├── crypto
├── sct ── crypto
├── tlog ── crypto
└── merkle

All modules depend on error.rs (11-variant thiserror enum).

Trust roots

Production Fulcio/Rekor/CTFE keys embedded at compile time via
include_bytes!. build.rs validates every PEM: CA certs must have
BasicConstraints CA:true + KeyUsage keyCertSign, and their expiration
is checked. Two paths for callers:

• SigstoreBlobVerifier::with_static_trust_root() — embedded keys.
• SigstoreBlobVerifier::new(trust_root_raw) — caller-provided PEMs.

Supported bundle formats

Sigstore bundles v0.1–v0.3, both messageSignature and dsseEnvelope
media types. DSSE payloads are bound to the artifact via in-toto Statement
subject[].digest.sha256 comparison (not just envelope-level PAE — full
subject binding). Unknown media types, managed-key bundles, and Rekor v2
proof-only bundles are explicitly rejected.

Testing strategy — 66 tests, three layers

1. Unit tests (58): each module tested in isolation. Synthetic certs/keys
   via rcgen (pure Rust, no OpenSSL). Negative tests assert exact error
   variant, not just is_err().

2. Real-bundle parity (7): verifies a genuine public-good Sigstore v0.3
   bundle from the sigstore-conformance corpus against the embedded trust
   root. Committed negative fixtures: corrupted inclusion proof, invalid
   checkpoint signature, wrong checkpoint root hash, messageDigest mismatch
   — all must reject.

3. Conformance scan (1, opt-in): runs the full sigstore-conformance
   bundle-verify corpus when SIGSTORE_CONFORMANCE_DIR is set. Status:
   all hashedrekord positives pass, all negatives rejected, zero
   false-accepts.

Key files for review

File	Lines	Role
src/verifier.rs	989	10-step orchestrator + e2e tests
src/chain.rs	~350	DN-based path building, P-384 Fulcio chain
src/tlog.rs	~250	SET verify, body consistency (CVE-2022-36056)
src/cert.rs	497	X.509 parse via x509-parser, OIDC extensions
src/merkle.rs	~100	Offline RFC 6962 inclusion proof (Trillian fold)
src/sct.rs	558	RFC 6962 SCT verification, precert reconstruction
src/bundle.rs	~300	v0.1–v0.3 format enum, media type dispatch

Deliberately out of scope (do not flag)

• TUF / trusted_root.json — PEM-only trust material.
• Rekor v2 / TSA timestamps — SET is always required.
• RSA / Ed25519 — only ECDSA P-256 (leaf/Rekor/CTFE) and P-384 (Fulcio CAs).
• Managed keys — keyless/certificate-based bundles only.
• Fulcio deprecated issuer OID 1.3.6.1.4.1.57264.1.1 — v2 only.

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

Summary by CodeRabbit

• New Features
  • Added offline, WASM-compatible Sigstore/Cosign blob signature verification with certificate-chain validation, SCT checks, Rekor SET authentication, optional Merkle inclusion-proof + checkpoint verification, and strict identity/issuer policy enforcement.
  • Supports both message-signature and DSSE bundle verification.
• Documentation
  • Added quick start plus detailed architecture and verification-algorithm references.
• Tests
  • Added unit/integration/real-bundle coverage, conformance scanning, and new fixture cases (including inclusion-proof and checkpoint failures).
• Chores/Style
  • Updated code style guidance to discourage panic-based runtime validation for input handling.

[mo-auto]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds sigstore-verifier as an offline, WASM-compatible Sigstore/Cosign blob verification crate with bundle parsing, certificate, ECDSA, SCT, Rekor, policy, trust-root, DSSE, Merkle-proof, documentation, and integration-test support.

Changes

Sigstore verifier implementation

Layer / File(s)	Summary
Crate foundation and verification specification jans-cedarling/Cargo.toml, jans-cedarling/sigstore-verifier/Cargo.toml, README.md, build.rs, docs/*	Registers the crate, defines dependencies, validates embedded trust material at build time, and documents the verification model and supported scope.
Bundle, certificate, policy, and trust contracts src/bundle.rs, src/cert.rs, src/error.rs, src/lib.rs, src/policy.rs, src/trust_root.rs	Adds typed bundle parsing, structured errors, certificate extraction and constraints, identity and issuer policies, public exports, and configurable or embedded trust roots.
Certificate, ECDSA, and SCT validation src/chain.rs, src/crypto.rs, src/sct.rs, src/test_support.rs	Implements certificate-chain validation, P-256/P-384 signature checks, SCT verification, DER handling, and synthetic certificate/SCT helpers with unit coverage.
Rekor and Merkle proof validation src/tlog.rs, src/merkle.rs	Authenticates Rekor SETs and checkpoints, checks hashedrekord/DSSE body consistency, and verifies RFC 6962 inclusion proofs.
Public verifier flow and integration coverage src/verifier.rs, tests/*	Connects verification components through SigstoreBlobVerifier, with conformance, fixture, DSSE, and real-bundle tests.

Estimated code review effort: 5 (Critical) | ~120 minutes

Suggested reviewers: tareknaser, dagregi, haileyesus2433, 0xtinkle

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR adds DSSE/in-toto verification and tests, but #14465 scoped the initial library to v0.3 MessageSignature with P-256 only.	Remove or split DSSE/in-toto support into a follow-up PR, or update the linked issue scope before merging.
Out of Scope Changes check	⚠️ Warning	DSSE/in-toto support, fixtures, and verifier logic extend beyond the issue’s initial MessageSignature-only scope.	Move DSSE/in-toto code and tests to a separate follow-up PR unless the issue scope is expanded.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding a Sigstore/Cosign verification library.
Description check	✅ Passed	The description matches the template with target issue, implementation details, and testing/documentation sections filled in.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jans-cedarling-14465

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[haileyesus2433]

This gate reads mediaType, which is an unsigned string inside the bundle, so the bundle itself
decides whether the inclusion proof and checkpoint are checked. I relabelled the committed v0.3
fixtures as version=0.1 and deleted inclusionProof, and all three negative fixtures
(inclusion-proof-corrupted-hash, invalid-checkpoint-signature, checkpoint-wrong-roothash)
verified successfully. The comment above argues this is safe because the SET is unforgeable, but
that assumes the Rekor key is honest the inclusion proof against a signed checkpoint is exactly
the control that survives a compromised or split-view log, and the SET and checkpoint are signed by
the same key. The decision needs to come from the caller, not the bundle: either always require an
inclusion proof, or add an explicit VerificationPolicy opt-in for SET-only v0.1.

[olehbozhok]

resolved

[haileyesus2433]

Related to the verifier.rs comment each of these fixtures still verifies after a one-field
downgrade, so as written they prove the corrupted-proof path is rejected only when nobody edits the
media type. Once the gate is fixed, please add the downgraded variant of each fixture as its own
must-reject case so the bypass can't come back.

[haileyesus2433]

.first() is the only read of tlog_entries anywhere in the crate, so steps 3, 9 and 10 all run
against entry [0] and everything after it is parsed and ignored. I appended a second entry with a
garbage canonicalizedBody and an integratedTime in year 5138 and the bundle still verified. The
issue spec requires every entry to be verified, and the practical problem is that a bundle this
crate has marked "verified" can carry attacker-controlled log entries onward to whoever stores or
re-publishes it. Either verify all entries or reject tlog_entries.len() != 1 silently ignoring
them is the worst of the three options.

[olehbozhok]

resolved

[haileyesus2433]

A bundle carrying both messageSignature and dsseEnvelope is accepted, and serde just picks one
I added a dsseEnvelope to a valid messageSignature bundle and it took the DSSE path, so an
attacker-added field decided which content got authenticated. It fails closed today because
verify_body_consistency dispatches on the log body's kind and catches the mismatch, but that's
incidental rather than structural, and it goes live the moment the two paths diverge or a third
content type is added. Deserialize into one Option per variant and reject unless exactly one is
present.

[olehbozhok]

resolved

[haileyesus2433]

IdentityMatch::CompiledRegex can't be fixed at the call site Same issue as full_match, but worse the caller hands over an already-compiled unanchored Regex,so there's no way to repair it later. This wants a constructor-validated newtype that can only be built through compile_anchored suggestion

[haileyesus2433]

a hard assert! on wall-clock time makes the build self-destruct

This means the crate stops compiling on a future date with no code change, every downstream consumer of jans-cedarling breaks at once, and previously released tags become un-buildable reproducing an old release would need a build.rs patch or a faked clock.
It's also cached rerun-if-changed=src/trust/ means this time-dependent check only re-runs when the PEM files change, so the failure lands at an unpredictable moment rather than on a knowable date.

[olehbozhok]

It is fine and designed to be like that. We need to add new certificates at that time.

[haileyesus2433]

the WASM target has no CI coverage cargo build --target wasm32-unknown-unknown is in the issue's acceptance criteria, but sigstore-verifier is never built for wasm anywhere in CI.

[olehbozhok]

resolved

[haileyesus2433]

declared but never used There isn't a single reference to der in src/ or build.rs;

[olehbozhok]

resolved

[haileyesus2433]

declared but never used There isn't a single reference to der in src/ or build.rs;

[olehbozhok]

resolved

[haileyesus2433]

Any semver bump of regex-lite becomes a breaking change here. The reason given (letting callers
build CompiledRegex without a version mismatch) is real, but the anchored-regex newtype suggested
on policy.rs removes the need to expose the foreign type at all, which solves both.

[olehbozhok]

The semver point is fair — pub use regex_lite; does put a foreign type on the public surface.

The proposed remedy no longer applies though: following your policy.rs thread I checked what upstream does, and nobody auto-anchors. sigstore-go's SubjectAlternativeNameMatcher uses Regexp.MatchString and documents "regexp matching is not anchored by default; use ^...$ if you intend to match the entire SAN value"; cosign's CheckCertificatePolicy is the same; sigstore-python has no regex at all. Anchoring is now removed from this crate, so there's no invariant left for an anchored-regex newtype to enforce.

Keeping the re-export for now: so there's nothing for a semver bump to break — and the re-export is what lets callers configure their own Regex (RegexBuilder has case_insensitive, multi_line, size_limit), which a newtype taking &str would remove. Worth revisiting when the crate is published and there's a real consumer to design against.

[olehbozhok]

@coderabbitai do you have any suggestions, or can you approve?

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- Repository guidance ---'
cat jans-cedarling/AGENTS.md

printf '%s\n' '--- Changed files ---'
git diff --name-status HEAD^ HEAD

printf '%s\n' '--- Core module outlines ---'
ast-grep outline jans-cedarling/sigstore-verifier/src/verifier.rs --view expanded
ast-grep outline jans-cedarling/sigstore-verifier/src/tlog.rs --view expanded
ast-grep outline jans-cedarling/sigstore-verifier/src/chain.rs --view expanded
ast-grep outline jans-cedarling/sigstore-verifier/src/sct.rs --view expanded

printf '%s\n' '--- Verification and trust-root implementation ---'
cat -n jans-cedarling/sigstore-verifier/src/verifier.rs
cat -n jans-cedarling/sigstore-verifier/src/tlog.rs
cat -n jans-cedarling/sigstore-verifier/src/chain.rs
cat -n jans-cedarling/sigstore-verifier/src/trust_root.rs

Length of output: 204480

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- Pull request diff against merge base ---'
base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main)"
git diff --stat "$base"...HEAD
git diff --name-status "$base"...HEAD

printf '%s\n' '--- Bundle and cryptographic verifier outlines ---'
ast-grep outline jans-cedarling/sigstore-verifier/src/bundle.rs --view expanded
ast-grep outline jans-cedarling/sigstore-verifier/src/crypto.rs --view expanded

printf '%s\n' '--- Bundle parser and signature primitive ---'
cat -n jans-cedarling/sigstore-verifier/src/bundle.rs
cat -n jans-cedarling/sigstore-verifier/src/crypto.rs

printf '%s\n' '--- Pull request checks and review state ---'
gh pr view 14636 --repo JanssenProject/jans \
  --json number,state,isDraft,mergeable,reviewDecision,statusCheckRollup \
  --jq '{number, state, isDraft, mergeable, reviewDecision, checks: [.statusCheckRollup[] | {name, status, conclusion}]}'

Length of output: 39834

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- Existing pull request reviews ---'
gh api repos/JanssenProject/jans/pulls/14636/reviews \
  --paginate \
  --jq '.[] | {user: .user.login, state: .state, submitted_at: .submitted_at, body: .body}'

printf '%s\n' '--- Existing pull request review comments ---'
gh api repos/JanssenProject/jans/pulls/14636/comments \
  --paginate \
  --jq '.[] | {user: .user.login, path: .path, line: .line, body: .body}'

printf '%s\n' '--- Digest algorithm handling and tests ---'
rg -n -C 4 'messageDigest|MessageDigest|SHA2_256|SHA2_384|algorithm' \
  jans-cedarling/sigstore-verifier/src \
  jans-cedarling/sigstore-verifier/tests

Length of output: 221844

---

🤖 web_search executed:

Sigstore bundle MessageSignature messageDigest HashOutput algorithm protobuf specification validation SHA2_256 SHA2_384

Length of output: 13182

---

@olehbozhok I found no additional blocking issue in this review pass.

I cannot approve yet because GitHub still reports CHANGES_REQUESTED, and these checks are still running:

• wasm_tests
• python_tests (3.11)
• postgres_extension_tests
• rust_benchmarks

The completed verifier checks are successful, including rust_tests, conformance_scan, wasm_build, lint validation, cargo_audit, and cargo_deny.

When the remaining checks pass and the existing change requests are resolved, ask @coderabbitai approve.

_{You are interacting with an AI system.}