c2pa-rs

commit f0aacd5d3391fc0fc1ece62d23623342d26d0e68
parent d430b6117d803023f6905f32a290294f98299540
Author: mauricefisher64 <92736594+mauricefisher64@users.noreply.github.com>
Date:   Wed, 15 Jun 2022 19:34:51 -0400

Remove self-signed end-entity cert support (#48)

Co-authored-by: Eric Scouten <scouten@adobe.com>
Diffstat:
M
sdk/src/cose_validator.rs
 | 
11
+++--------
M
sdk/src/manifest_store.rs
 | 
2
+-
M
sdk/tests/fixtures/C.jpg
 | 
0

M
sdk/tests/fixtures/CA.jpg
 | 
0

M
sdk/tests/fixtures/CIE-sig-CA.jpg
 | 
0

5 files changed, 4 insertions(+), 9 deletions(-)
diff --git a/sdk/src/cose_validator.rs b/sdk/src/cose_validator.rs
@@ -341,11 +341,11 @@ fn check_cert(
 
     let is_self_signed = tbscert.is_ca() && tbscert.issuer_uid == tbscert.subject_uid;
 
-    // only allowable for self sigbed
-    if !is_self_signed && tbscert.issuer_uid.is_some() || tbscert.subject_uid.is_some() {
+    // self signed certs are disallowed
+    if is_self_signed {
         let log_item = log_item!(
             "Cose_Sign1",
-            "certificate issuer and subject cannot be the same",
+            "certificate issuer and subject cannot be the same {self-signed disallowed}",
             "check_cert_alg"
         )
         .error(Error::CoseInvalidCert)
@@ -355,11 +355,6 @@ fn check_cert(
         return Err(Error::CoseInvalidCert);
     }
 
-    // non self signed CA certs are not allowed, must be an end entity (leaf) cert
-    if tbscert.is_ca() && !is_self_signed {
-        return Err(Error::CoseInvalidCert);
-    }
-
     let mut aki_good = false;
     let mut ski_good = false;
     let mut key_usage_good = false;
diff --git a/sdk/src/manifest_store.rs b/sdk/src/manifest_store.rs
@@ -257,7 +257,7 @@ mod tests {
         assert!(manifest_store.validation_status().is_none());
         let manifest = manifest_store.get_active().unwrap();
         assert!(!manifest.ingredients().is_empty());
-        assert_eq!(manifest.issuer().unwrap(), "Some Company");
+        assert_eq!(manifest.issuer().unwrap(), "C2PA Test Signing Cert");
         assert!(manifest.time().is_some());
     }
 }
diff --git a/sdk/tests/fixtures/C.jpg b/sdk/tests/fixtures/C.jpg
Binary files differ.
diff --git a/sdk/tests/fixtures/CA.jpg b/sdk/tests/fixtures/CA.jpg
Binary files differ.
diff --git a/sdk/tests/fixtures/CIE-sig-CA.jpg b/sdk/tests/fixtures/CIE-sig-CA.jpg
Binary files differ.