_verify: Check for URI SANs when verifying certificate emails

sigstore/_verify.py

@@ -36,6 +36,7 @@
     ObjectIdentifier,
     RFC822Name,
     SubjectAlternativeName,
+    UniformResourceIdentifier,
     load_pem_x509_certificate,
 )
 from cryptography.x509.oid import ExtendedKeyUsageOID
@@ -209,7 +210,11 @@ def verify(
         if expected_cert_email is not None:
             # Check that SubjectAlternativeName contains signer identity
             san_ext = cert.extensions.get_extension_for_class(SubjectAlternativeName)
-            if expected_cert_email not in san_ext.value.get_values_for_type(RFC822Name):
+            if expected_cert_email not in san_ext.value.get_values_for_type(
+                RFC822Name
+            ) and expected_cert_email not in san_ext.value.get_values_for_type(
+                UniformResourceIdentifier
+            ):
                 return VerificationFailure(
                     reason=f"Subject name does not contain identity: {expected_cert_email}"
                 )

test/assets/c.txt

@@ -0,0 +1,5 @@
+DO NOT MODIFY ME!
+
+this is "c.txt", a sample input for sigstore-python's unit tests.
+
+DO NOT MODIFY ME!

test/assets/c.txt.crt

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDwTCCA0igAwIBAgIUdXPCI40ren/SEkqxmHcCc6lIV7MwCgYIKoZIzj0EAwMw
+NzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl
+cm1lZGlhdGUwHhcNMjIxMTAzMDc0NTM1WhcNMjIxMTAzMDc1NTM1WjAAMHYwEAYH
+KoZIzj0CAQYFK4EEACIDYgAELVUlqi4FjTw4mHzuyE8sOsK6mVvzOTv0EX7ot+aZ
+ftaf+ato9xuemqA69qARscFPwG15It1F9PVdKUOeJkTPjZC+lRHNAIeamJpilskz
+xqR6fisI7q72zHY8OhgMnSSHo4ICSjCCAkYwDgYDVR0PAQH/BAQDAgeAMBMGA1Ud
+JQQMMAoGCCsGAQUFBwMDMB0GA1UdDgQWBBREb7Dfm1g8gILV3K9rT9WSF7GnzzAf
+BgNVHSMEGDAWgBRxhjCmFHxib/n31vQFGn9f/+tvrDBmBgNVHREBAf8EXDBahlho
+dHRwczovL2dpdGh1Yi5jb20vc2lnc3RvcmUvc2lnc3RvcmUtcHl0aG9uLy5naXRo
+dWIvd29ya2Zsb3dzL2NpLnltbEByZWZzL3B1bGwvMjg4L21lcmdlMDkGCisGAQQB
+g78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5j
+b20wGgYKKwYBBAGDvzABAgQMcHVsbF9yZXF1ZXN0MDYGCisGAQQBg78wAQMEKDNi
+ZTcyMzU2ZWY0NTE3YmI4ZTUwZjI5Njg4N2Y5YzU3ODZmOTAzMTYwEAYKKwYBBAGD
+vzABBAQCQ0kwJgYKKwYBBAGDvzABBQQYc2lnc3RvcmUvc2lnc3RvcmUtcHl0aG9u
+MCEGCisGAQQBg78wAQYEE3JlZnMvcHVsbC8yODgvbWVyZ2UwgYoGCisGAQQB1nkC
+BAIEfAR6AHgAdgArMLzcaIjJ4uHYJiledB9IOTGWAvKcM8teQ0D+sqyGegAAAYQ8
+c9igAAAEAwBHMEUCIQCn/JSbLxs0ds3Nycn0yINUQABeltbAmcYDFEn/sdm50gIg
+fm4lKdhXJoWHJRC8IS7MxYI3yR/oNzX6dntuqpHJ24YwCgYIKoZIzj0EAwMDZwAw
+ZAIwE0F3B/HgHn+ov6axOY0TMR/hv2DUVlC3qkGBQEEMtglf5qtT+a9g7aQ5g4pG
+of+JAjB+qUeUdSAyGPDK+5Ti6aROy0oAbwl+B3bH7QmmZ/i5M++PXIW4l4lcuAmA
+UkjTgLw=
+-----END CERTIFICATE-----

test/assets/c.txt.sig

@@ -0,0 +1 @@
+MGUCMAQYRaYOdZEOT3C3WP22sC9+2euiFGYbC4VNefWVL31+MAL7oKMWsHsBwh1ngjTZHAIxALuUf+mzlACBqYUSTTwl3LFIGUGl8g3Z6wkTMsqdI1NrtHj0rVpcWA1DIO4GhGOM5w==

test/test_verify.py

@@ -64,3 +64,43 @@ def test_verify_result_boolish():
     assert not VerificationFailure(reason="foo")
     assert not CertificateVerificationFailure(reason="foo", exception=ValueError("bar"))
     assert VerificationSuccess()
+
+
+@pytest.mark.online
+def test_verifier_issuer(signed_asset):
+    a_assets = signed_asset("a.txt")
+
+    verifier = Verifier.staging()
+    assert verifier.verify(
+        a_assets[0],
+        a_assets[1],
+        a_assets[2],
+        expected_cert_oidc_issuer="https://github.com/login/oauth",
+    )
+
+
+@pytest.mark.online
+def test_verifier_san_email(signed_asset):
+    a_assets = signed_asset("a.txt")
+
+    verifier = Verifier.staging()
+    assert verifier.verify(
+        a_assets[0],
+        a_assets[1],
+        a_assets[2],
+        expected_cert_email="william@yossarian.net",
+    )
+
+
+@pytest.mark.online
+def test_verifier_san_uri(signed_asset):
+    a_assets = signed_asset("c.txt")
+
+    verifier = Verifier.staging()
+    assert verifier.verify(
+        a_assets[0],
+        a_assets[1],
+        a_assets[2],
+        expected_cert_email="https://github.com/sigstore/"
+        "sigstore-python/.github/workflows/ci.yml@refs/pull/288/merge",
+    )