Handle "new-style" COSE envelop and validate transparent receipts#38
Draft
micromaomao wants to merge 12 commits into
Draft
Handle "new-style" COSE envelop and validate transparent receipts#38micromaomao wants to merge 12 commits into
micromaomao wants to merge 12 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR extends the COSE_Sign1 unpack/validation path to understand “new-style” envelopes using CWT claim maps and to parse/validate COSE receipts (CCF profile), and updates sign1util to display headers/receipts and validate receipts by fetching issuer JWKS.
Changes:
- Add COSE/CWT/receipt-related constants and extend
UnpackAndValidateCOSE1CertChainto expose protected/unprotected headers and parse attached receipts. - Implement receipt validation (structure checks + Merkle root recomputation for CCF inclusion proofs + COSE_Sign1 signature verification).
- Update
sign1utilto fetch JWKS, validate receipts, print headers/receipts, and add a global--log-levelflag.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.
| File | Description |
|---|---|
| pkg/cosesign1/constants.go | Introduces numeric constants for COSE header labels, receipt profile identifiers, and CWT claim keys. |
| pkg/cosesign1/check.go | Adds receipt parsing/validation and “new-style” CWT claim extraction, and exposes headers/receipts on the unpacked object. |
| cmd/sign1util/main.go | Adds JWKS fetching + receipt validation and expands verbose printing (headers + receipts) plus global log-level configuration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+298
to
+310
| // Validate validates the COSE Receipt's structure and signature. See | ||
| // https://www.ietf.org/archive/id/draft-ietf-cose-merkle-tree-proofs-18.html | ||
| // for details about COSE Receipts. | ||
| // | ||
| // It checks that: | ||
| // - the protected header carries a vds (label 395), | ||
| // - the payload is detached, | ||
| // - the unprotected `vdp` header (label 396) contains at least one | ||
| // inclusion proof (key -1) encoded as a byte string, | ||
| // - the Merkle root recomputed from each inclusion proof verifies the | ||
| // receipt's COSE_Sign1 signature, using the public key in `keys` indexed by | ||
| // r.Kid. | ||
| func (r ParsedCOSEReceipt) Validate(keys map[string]crypto.PublicKey) error { |
KenGordon
previously approved these changes
May 11, 2026
Contributor
KenGordon
left a comment
KenGordon
left a comment
There was a problem hiding this comment.
Maybe break the key fetch out of main.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+99
to
+106
| body, err := io.ReadAll(resp.Body) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("reading %s: %w", url, err) | ||
| } | ||
| var set jwkSet | ||
| if err := json.Unmarshal(body, &set); err != nil { | ||
| return nil, fmt.Errorf("parsing %s: %w", url, err) | ||
| } |
Member
Author
|
need to check that receipt actually matches the data |
micromaomao
force-pushed
the
transparant-fragments
branch
from
1e2b04c to
e5006b1
Compare
micromaomao
force-pushed
the
transparant-fragments
branch
from
e5006b1 to
4fa4ccf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepare for validating transparant fragments.
Todo:
sign1util print, and only prints the headers and receipts if --print-headers / --print-receipts flags are provided?