db92404342
chore: fix function names in comment
...
Signed-off-by: verytrap <wangqiuyue@outlook.com>
3 weeks ago
10f6a901ec
Let the CA determine the RA lifetime
...
When the RA mode with StepCAS is used, let the CA decide which lifetime
the RA should get instead of requiring always 24h.
This commit also fixes linter warnings.
Related to #1094
2 months ago
041b486c55
Remove usages of `Sign` without context
2 months ago
2a8b80a3e1
Merge branch 'master' into herman/webhook-request-id
2 months ago
e52836f0ab
Add `RS1` support for ACME `device-attest-01`
4 months ago
c59d293d26
Add support for `HTTP_PROXY` and `HTTPS_PROXY` to ACME solver client
4 months ago
b20af51f32
Upgrade go.step.sm/crypto to use go-jose/v3
5 months ago
f453323ba9
Merge pull request #1631 from smallstep/herman/fix-apple-acmeclient-invalid-signatures
5 months ago
405aae798c
Simplify the `copy` logic used when patching JWS signature
5 months ago
d34f0f6a97
Fix linter warnings ( #1634 )
5 months ago
26a3bb3c11
Make the Apple JWS fix more robust and catch more cases.
5 months ago
113491e7af
Remove TODO for patching other algorithms for Apple ACME client
5 months ago
06f4cbbcda
Add (temporary) fix for missing null bytes in Apple JWS signatures
...
Apparently the Apple macOS (and iOS?) ACME client seems to omit
leading null bytes from JWS signatures. The base64-url encoded
bytes decode to a shorter byte slice than what the JOSE library
expects (e.g. 63 bytes instead of 64 bytes for ES256), and then
results in a `jose.ErrCryptoFailure`.
This commit retries verification of the JWS in case the first
verification fails with `jose.ErrCryptoFailure`. The signatures are
checked to be of the correct length, and if not, null bytes are
prepended to the signature. Then verification is retried, which
might fail again, but for other reasons. On success, the payload
is returned.
Apple should fix this in their ACME client, but in the meantime
this commit prevents some "bad request" error cases from happening.
5 months ago
231b5d8406
chore(deps): upgrade github.com/go-chi/chi to v5
...
Upgrade chi to the v5 module path to avoid deprecation warning about v4
and earlier on the old module path.
See https://github.com/go-chi/chi/blob/v4.1.3/go.mod#L1-L4
Signed-off-by: Dominic Evans <dominic.evans@uk.ibm.com>
7 months ago
4ef093dc4b
Fix broken tests relying on `Sign` in mocks
7 months ago
9e3807eaa3
Use `SignWithContext` in the critical paths
7 months ago
4e06bdbc51
Add `SignWithContext` method to authority and mocks
7 months ago
f2993c4c3b
Use the legacy `tpm2` package import
7 months ago
116ff8ed65
bump go.mod to go1.20 and associated linter fixes ( #1518 )
8 months ago
d8eeebfd51
Fix error string in tests
...
This commit fixes a test checking an error string from an external
dependency.
8 months ago
c952e9fc9d
Use `NewDetailedError` instead
9 months ago
f3c24fe875
Change how multiple identifiers are printed in errors
9 months ago
a0cdad335d
Add test for `WithAdditionalErrorDetail`
9 months ago
9a52675865
Return descriptive error when using unsupported format
9 months ago
0d3338ff3a
Return consistent ACME error types for specific cases
9 months ago
df22b8a303
Cleanup some leftover TODOs
9 months ago
dd9bf1e915
Add error details for the `step` format
9 months ago
9cbbd1d575
Add error details to ACME `tpm` format validation errors
9 months ago
d5dd8feccd
Prevent internal errors from being returned to ACME clients
9 months ago
979e0f8f51
Add error details to select error cases for `apple` format
9 months ago
a5801b3c74
Fix TPM simulator initialization for tests
10 months ago
7731edd816
Store and verify Acme account location ( #1386 )
...
* Store and verify account location on acme requests
Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com>
Co-authored-by: Mariano Cano <mariano@smallstep.com>
11 months ago
e71b62e95c
Merge branch 'master' into herman/update-crypto-v0.29.4
12 months ago
8b256f0351
address linter warning for go 1.19
12 months ago
0c2b00f6a1
Depend on our fork of `go-attestation`
12 months ago
d9aa2c110f
Increase test coverage for AK certificate properties
1 year ago
ed1a62206e
Add additional verification of AK certificate
1 year ago
1c38e252a6
Cast `alg` to a valid `COSEAlgorithmIdentifier`
1 year ago
e25acff13c
Simplify `alg` validity check
1 year ago
9cd4b362f7
Extract the `ParseSubjectAlternativeNames` function
1 year ago
b6957358fc
Fix PR remarks
...
- Root CA error message improved
- Looping through intermediate certs
- Change checking unhandled extensions to using `if`
1 year ago
09bd7705cd
Fix linting issues
1 year ago
f88ef6621f
Add `PermanentIdentifier` SAN parsing and tests
1 year ago
52023d6083
Add tests for `doTPMAttestationFormat`
1 year ago
ae30f6e96b
Add failing TPM simulator test
1 year ago
bf53b394a1
Add `tpm` format test with simulated TPM
1 year ago
094f0521e2
Remove check for `PermanentIdentifier` from `tpm` format validation
1 year ago
589a62df74
Make validation of `tpm` format stricter
1 year ago
213b31bc2c
Simplify processing logic for unhandled critical extension
1 year ago
e1c7e8f00b
Return the CSR public key fingerprint for `tpm` format
1 year ago
verytrap
Mariano Cano
Herman Slatman
Herman Slatman
Max
Dominic Evans