Commits on Apr 26, 2022

1. Load in intermediate cert pool from TUF …

   With the v3 TUF root, the intermediate CA certificate will be included,
   so that if the intermediate signing key was compromised, the
   intermediate certificate could be revoked by removing it from the TUF
   targets and replacing it with a trusted certificate.
   
   This change loads the intermediate certificate from TUF. However, we
   don't want to force all users to follow this structure - They may choose
   to use CRLs to detect revoked intermediates. Also, I don't want to
   enforce TUF usage in the Verify package. Therefore, for TUF, we lazily create
   a certificate pool only if an intermediate certificate is found, and if
   it's not found, then VerifyImageSignature will create a pool using the
   chain provided in the annotation.
   
   Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>

   

   haydentherapper committed Apr 26, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for 9de6cf4
   • Browse repository at this point

   Copy the full SHA

   9de6cf4 View commit details

   Browse the repository at this point in the history