Skip to content

Add nicer error message when failing to verify rekor2 entries #1497

@jku

Description

@jku

Description

sigstore-js does not yet understand rekor2 entries, but those are now starting to show up (multiple clients already sign with rekor2 on staging). Would be good if current sigstore-js had a decent error message when sigstore-js is used to verify a signature bundle that contains a rekor2 entry.

Current error:

/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/timestamp/checkpoint.js:50
        throw new error_1.VerificationError({
              ^

VerificationError: invalid checkpoint signature
    at verifyCheckpoint (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/timestamp/checkpoint.js:50:15)
    at verifyTLogTimestamp (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/timestamp/index.js:26:43)
    at /usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/verifier.js:55:64
    at Array.map (<anonymous>)
    at Verifier.verifyTimestamps (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/verifier.js:48:46)
    at Verifier.verify (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/verifier.js:35:33)
    at Object.verify (/usr/local/lib/node_modules/@sigstore/cli/node_modules/sigstore/dist/sigstore.js:108:22)
    at /usr/local/lib/node_modules/@sigstore/cli/node_modules/sigstore/dist/sigstore.js:81:64
    at async Verify._run (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@oclif/core/lib/command.js:181:22)
    at async Config.runCommand (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@oclif/core/lib/config/config.js:456:25) {
  code: 'TLOG_INCLUSION_PROOF_ERROR',
  cause: undefined
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions