Documentation
¶
Overview ¶
Package verifier validates SPIFFE-signed bundles against a pinned SPIRE trust root and enforces SPIFFE identity matchers on the SVID leaf. It lives in its own subpackage (sibling to the sign-side signer/spiffe credential provider) so that it can import signer/options without promoting the sign-side package into the same cycle — allowing options/spiffe_set.go to import signer/spiffe cleanly.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier validates SPIFFE-signed bundles against a pinned SPIRE trust root and enforces SPIFFE identity matchers on the SVID leaf.
func NewVerifier ¶
func NewVerifier(opts VerifierOptions) (*Verifier, error)
NewVerifier creates a SPIFFE Verifier. Returns an error if the trust roots are missing or the identity matchers are ambiguous.
func NewVerifierFromOptions ¶
func NewVerifierFromOptions(opts *options.SpiffeVerification) (*Verifier, error)
NewVerifierFromOptions builds a Verifier from the verification options struct carried in the top-level options.Verification. Loads trust roots from inline PEM or a file as configured.
func (*Verifier) SetTSAMaterialLoader ¶
func (v *Verifier) SetTSAMaterialLoader(loader func() (root.TrustedMaterial, error))
SetTSAMaterialLoader wires a lazy loader that returns the TrustedMaterial used to validate any RFC 3161 timestamps in incoming bundles. Typically called by the outer signer.NewVerifier after constructing the SPIFFE verifier, since the trust material lives in the sigstore-roots configuration which the SPIFFE options don't carry. The loader is invoked at most once per Verifier and only when a bundle that needs TSA validation is presented; nil clears the wiring and reverts the verifier to time.Now()-based chain validation.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(opts *options.Verification, bndl *sbundle.Bundle) (*verify.VerificationResult, error)
Verify validates the SVID chain in the bundle against the pinned trust roots, enforces the SPIFFE identity matchers, and verifies the DSSE envelope signature against the leaf public key. Returns a best-effort *verify.VerificationResult on success (sigstore-specific fields like transparency-log entries are left zero; SPIFFE signatures don't produce them).
If the bundle carries RFC 3161 timestamps and TSATrustedMaterial is configured on the verifier, the earliest verified timestamp's time is used as x509.VerifyOptions.CurrentTime so SVID-signed bundles remain verifiable past the SVID's TTL. With timestamps but no TSATrustedMaterial, chain validation falls back to time.Now().
type VerifierOptions ¶
type VerifierOptions struct {
// TrustRoots is the certificate pool used to validate the SVID chain.
// Required.
TrustRoots *x509.CertPool
// ExpectedTrustDomain, when non-zero, asserts the SVID's trust domain.
ExpectedTrustDomain spiffeid.TrustDomain
// ExpectedPath, when non-empty, requires an exact match on the SVID's
// SPIFFE path component.
ExpectedPath string
// ExpectedPathRegex, when non-nil, must match the SVID's SPIFFE path.
// Mutually exclusive with ExpectedPath.
ExpectedPathRegex *regexp.Regexp
// SkipSVIDValidity disables enforcement of the leaf SVID's
// NotBefore/NotAfter dates. Default (false) is the safe
// behavior: chain validation runs at either the TSA-verified
// timestamp or time.Now(). Set true to run chain validation at
// leaf.NotBefore — guaranteed valid for the leaf, and (assuming a
// well-formed chain where issuers were valid at issuance time)
// for the rest of the chain — so verification reduces to the
// cryptographic chain check alone. Setting this true also
// short-circuits TSA validation since there's no time check left
// to anchor the timestamp to.
SkipSVIDValidity bool
// TSAMaterialLoader, when non-nil, returns a TrustedMaterial used
// to validate any RFC 3161 timestamps embedded in the bundle.
// Called lazily on the first bundle that actually carries
// timestamps; the returned material is cached on the Verifier so
// subsequent verifications skip the (potentially network-bound)
// fetch. Typically wraps tuf.GetRoot + NewTrustedRootFromJSON
// against the embedded sigstore-roots; the SPIFFE verifier itself
// stays free of TUF / sigstore-package coupling.
//
// When this is nil and the bundle carries timestamps, chain
// validation falls back to time.Now(). When it's set but the
// loader returns an error, verification fails closed — silently
// degrading would be a bypass.
TSAMaterialLoader func() (root.TrustedMaterial, error)
}
VerifierOptions configures a SPIFFE Verifier.
Source Files