support legacy fulcio ext in mock (#1037)

Signed-off-by: Brian DeHamer <[email protected]>
sigstore · Mar 4, 2024 · c1259bd · c1259bd
1 parent 692bec2
commit c1259bd
Show file tree

Hide file tree

Showing 4 changed files with 51 additions and 8 deletions.
diff --git a/.changeset/ninety-pigs-flash.md b/.changeset/ninety-pigs-flash.md
@@ -0,0 +1,5 @@
+---
+"@sigstore/mock": minor
+---
+
+Support legacy-style certificate extensions in mock Fulcio service
diff --git a/packages/mock/src/fulcio/ca.test.ts b/packages/mock/src/fulcio/ca.test.ts
@@ -32,11 +32,17 @@ describe('CA', () => {
     pkijs.setEngine('test', crypto);
   });
 
-  const extension = {
+  const extension1 = {
     oid: '1.3.6.1.4.1.57264.1.20',
     value: 'workflow_dispatch',
   };
 
+  const extension2 = {
+    oid: '1.3.6.1.4.1.57264.1.18',
+    value: 'workflow_dispatch',
+    legacy: true,
+  };
+
   const subjectAltName = 'testsan';
 
   describe('#rootCertificate', () => {
@@ -149,15 +155,39 @@ describe('CA', () => {
         const signingCert = await ca.issueCertificate({
           publicKey: keyBytes,
           subjectAltName: 'test',
-          extensions: [extension],
+          extensions: [extension1],
+        });
+
+        const cert = pkijs.Certificate.fromBER(signingCert);
+
+        expect.assertions(1);
+        cert.extensions!.forEach((ext) => {
+          if (ext.extnID === extension1.oid) {
+            expect(ext.parsedValue.valueBlock.value).toBe(extension1.value);
+          }
+        });
+      });
+    });
+
+    describe('when a custom legacy extension is provided', () => {
+      it('issues a cert with the extension', async () => {
+        const ca = await initializeCA(rootKeyPair);
+
+        // Issue a certificate with the key above
+        const signingCert = await ca.issueCertificate({
+          publicKey: keyBytes,
+          subjectAltName: 'test',
+          extensions: [extension2],
         });
 
         const cert = pkijs.Certificate.fromBER(signingCert);
 
         expect.assertions(1);
         cert.extensions!.forEach((ext) => {
-          if (ext.extnID === extension.oid) {
-            expect(ext.parsedValue.valueBlock.value).toBe(extension.value);
+          if (ext.extnID === extension2.oid) {
+            expect(
+              Buffer.from(ext.extnValue.valueBlock.valueHexView).toString()
+            ).toBe(extension2.value);
           }
         });
       });

diff --git a/packages/mock/src/fulcio/ca.ts b/packages/mock/src/fulcio/ca.ts
@@ -47,6 +47,7 @@ export interface CertificateRequestOptions {
 interface ExtensionValue {
   oid: string;
   value: string;
+  legacy?: boolean;
 }
 
 // Initialize the mock CA. Starts by generating a root key pair and self-signed
@@ -193,6 +194,9 @@ const extSCTList = (sct: ArrayBuffer): x509.Extension => {
 
 const generateExtensions = (extensions: ExtensionValue[]): x509.Extension[] =>
   extensions.map((extension) => {
-    const value = new asn1js.Utf8String({ value: extension.value });
-    return new x509.Extension(extension.oid, false, value.toBER(false));
+    const value =
+      extension.legacy === true
+        ? Buffer.from(extension.value)
+        : new asn1js.Utf8String({ value: extension.value }).toBER(false);
+    return new x509.Extension(extension.oid, false, value);
   });
diff --git a/packages/mock/src/fulcio/handler.ts b/packages/mock/src/fulcio/handler.ts
@@ -24,7 +24,8 @@ const CREATE_SIGNING_CERT_PATH = '/api/v2/signingCert';
 const DEFAULT_SUBJECT = 'NO-SUBJECT';
 const DEFAULT_ISSUER = 'https://fake.oidcissuer.com';
 
-const ISSUER_EXT_OID = '1.3.6.1.4.1.57264.1.8';
+const ISSUER_EXT_OID_V1 = '1.3.6.1.4.1.57264.1.1';
+const ISSUER_EXT_OID_V2 = '1.3.6.1.4.1.57264.1.8';
 
 interface FulcioHandlerOptions {
   strict?: boolean;
@@ -59,7 +60,10 @@ function createSigningCertHandler(
       const cert = await ca.issueCertificate({
         publicKey: fromPEM(publicKey),
         subjectAltName: subject,
-        extensions: [{ oid: ISSUER_EXT_OID, value: issuer }],
+        extensions: [
+          { oid: ISSUER_EXT_OID_V1, value: issuer, legacy: true },
+          { oid: ISSUER_EXT_OID_V2, value: issuer },
+        ],
       });
 
       // Format the response