-
Notifications
You must be signed in to change notification settings - Fork 35
Open
Labels
enhancementNew feature or requestNew feature or request
Description
Description
sigstore-js does not yet understand rekor2 entries, but those are now starting to show up (multiple clients already sign with rekor2 on staging). Would be good if current sigstore-js had a decent error message when sigstore-js is used to verify a signature bundle that contains a rekor2 entry.
Current error:
/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/timestamp/checkpoint.js:50
throw new error_1.VerificationError({
^
VerificationError: invalid checkpoint signature
at verifyCheckpoint (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/timestamp/checkpoint.js:50:15)
at verifyTLogTimestamp (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/timestamp/index.js:26:43)
at /usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/verifier.js:55:64
at Array.map (<anonymous>)
at Verifier.verifyTimestamps (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/verifier.js:48:46)
at Verifier.verify (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@sigstore/verify/dist/verifier.js:35:33)
at Object.verify (/usr/local/lib/node_modules/@sigstore/cli/node_modules/sigstore/dist/sigstore.js:108:22)
at /usr/local/lib/node_modules/@sigstore/cli/node_modules/sigstore/dist/sigstore.js:81:64
at async Verify._run (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@oclif/core/lib/command.js:181:22)
at async Config.runCommand (/usr/local/lib/node_modules/@sigstore/cli/node_modules/@oclif/core/lib/config/config.js:456:25) {
code: 'TLOG_INCLUSION_PROOF_ERROR',
cause: undefined
}
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request