361 Commits (herman/wrapped-listener)

Author	SHA1	Message	Date
Mariano Cano	b20af51f32	Upgrade go.step.sm/crypto to use go-jose/v3	6 months ago
Herman Slatman	f453323ba9	Merge pull request #1631 from smallstep/herman/fix-apple-acmeclient-invalid-signatures	6 months ago
Herman Slatman	405aae798c	Simplify the `copy` logic used when patching JWS signature	6 months ago
Max	d34f0f6a97	Fix linter warnings (#1634)	6 months ago
Herman Slatman	26a3bb3c11	Make the Apple JWS fix more robust and catch more cases.	6 months ago
Herman Slatman	113491e7af	Remove TODO for patching other algorithms for Apple ACME client	6 months ago
Herman Slatman	06f4cbbcda	Add (temporary) fix for missing null bytes in Apple JWS signatures ... Apparently the Apple macOS (and iOS?) ACME client seems to omit leading null bytes from JWS signatures. The base64-url encoded bytes decode to a shorter byte slice than what the JOSE library expects (e.g. 63 bytes instead of 64 bytes for ES256), and then results in a `jose.ErrCryptoFailure`. This commit retries verification of the JWS in case the first verification fails with `jose.ErrCryptoFailure`. The signatures are checked to be of the correct length, and if not, null bytes are prepended to the signature. Then verification is retried, which might fail again, but for other reasons. On success, the payload is returned. Apple should fix this in their ACME client, but in the meantime this commit prevents some "bad request" error cases from happening.	6 months ago
Dominic Evans	231b5d8406	chore(deps): upgrade github.com/go-chi/chi to v5 ... Upgrade chi to the v5 module path to avoid deprecation warning about v4 and earlier on the old module path. See https://github.com/go-chi/chi/blob/v4.1.3/go.mod#L1-L4 Signed-off-by: Dominic Evans <dominic.evans@uk.ibm.com>	9 months ago
Herman Slatman	f2993c4c3b	Use the legacy `tpm2` package import	9 months ago
Max	116ff8ed65	bump go.mod to go1.20 and associated linter fixes (#1518)	9 months ago
Mariano Cano	d8eeebfd51	Fix error string in tests ... This commit fixes a test checking an error string from an external dependency.	10 months ago
Herman Slatman	c952e9fc9d	Use `NewDetailedError` instead	10 months ago
Herman Slatman	f3c24fe875	Change how multiple identifiers are printed in errors	10 months ago
Herman Slatman	a0cdad335d	Add test for `WithAdditionalErrorDetail`	10 months ago
Herman Slatman	9a52675865	Return descriptive error when using unsupported format	10 months ago
Herman Slatman	0d3338ff3a	Return consistent ACME error types for specific cases	10 months ago
Herman Slatman	df22b8a303	Cleanup some leftover TODOs	10 months ago
Herman Slatman	dd9bf1e915	Add error details for the `step` format	10 months ago
Herman Slatman	9cbbd1d575	Add error details to ACME `tpm` format validation errors	10 months ago
Herman Slatman	d5dd8feccd	Prevent internal errors from being returned to ACME clients	10 months ago
Herman Slatman	979e0f8f51	Add error details to select error cases for `apple` format	10 months ago
Herman Slatman	a5801b3c74	Fix TPM simulator initialization for tests	11 months ago
Max	7731edd816	Store and verify Acme account location (#1386) ... * Store and verify account location on acme requests Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com> Co-authored-by: Mariano Cano <mariano@smallstep.com>	1 year ago
Herman Slatman	e71b62e95c	Merge branch 'master' into herman/update-crypto-v0.29.4	1 year ago
max furman	8b256f0351	address linter warning for go 1.19	1 year ago
Herman Slatman	0c2b00f6a1	Depend on our fork of `go-attestation`	1 year ago
Herman Slatman	d9aa2c110f	Increase test coverage for AK certificate properties	1 year ago
Herman Slatman	ed1a62206e	Add additional verification of AK certificate	1 year ago
Herman Slatman	1c38e252a6	Cast `alg` to a valid `COSEAlgorithmIdentifier`	1 year ago
Herman Slatman	e25acff13c	Simplify `alg` validity check	1 year ago
Herman Slatman	9cd4b362f7	Extract the `ParseSubjectAlternativeNames` function	1 year ago
Herman Slatman	b6957358fc	Fix PR remarks ... - Root CA error message improved - Looping through intermediate certs - Change checking unhandled extensions to using `if`	1 year ago
Herman Slatman	09bd7705cd	Fix linting issues	1 year ago
Herman Slatman	f88ef6621f	Add `PermanentIdentifier` SAN parsing and tests	1 year ago
Herman Slatman	52023d6083	Add tests for `doTPMAttestationFormat`	1 year ago
Herman Slatman	ae30f6e96b	Add failing TPM simulator test	1 year ago
Herman Slatman	bf53b394a1	Add `tpm` format test with simulated TPM	1 year ago
Herman Slatman	094f0521e2	Remove check for `PermanentIdentifier` from `tpm` format validation	1 year ago
Herman Slatman	589a62df74	Make validation of `tpm` format stricter	1 year ago
Herman Slatman	213b31bc2c	Simplify processing logic for unhandled critical extension	1 year ago
Herman Slatman	e1c7e8f00b	Return the CSR public key fingerprint for `tpm` format	1 year ago
Herman Slatman	6297bace1a	Merge branch 'master' into herman/acme-da-tpm	1 year ago
Herman Slatman	69489480ab	Add more complete `tpm` format validation	1 year ago
Mariano Cano	5ff0dde819	Remove json tag in acme.Authorization fingerprint	1 year ago
Mariano Cano	6ba20209c2	Verify CSR key fingerprint with attestation certificate key ... This commit makes sure that the attestation certificate key matches the key used on the CSR on an ACME device attestation flow.	1 year ago
Herman Slatman	3a6fc5e0b4	Remove dependency on `smallstep/assert` in ACME challenge tests	1 year ago
Herman Slatman	0f1c509e4b	Remove debug utility	1 year ago
Herman Slatman	0f9128c873	Fix linting issue and order of test SUT	1 year ago
Herman Slatman	2ab9beb7ed	Add tests for `deviceAttest01Validate`	1 year ago
Herman Slatman	ed61c5df5f	Cleanup some leftover debug statements	1 year ago