Email address are treated as case sensitive when verifying signatures

[imolloy]

Description

When using an email identity to verify a signature, the email is currently case sensitive. E.g.,

--identity foo@bar.com works but --identity FoO@baR.coM fails.

Verification failed with error: Certificate's SANs do not match FoO@baR.coM; actual SANs: {'foo@bar.com'}

Version

Latest v1.0.1

[spencerschrock]

disclaimer: only did a few RFC searches.

When using an email identity to verify a signature, the email is currently case sensitive

I can see the domain being case insensitive (not sure about non-ASCII domains), but the email RFC seems to imply the local-part may have semantics dependent on the host

the local-part MUST be interpreted and assigned semantics only by the host specified in the domain part of the address

@haydentherapper does Sigstore make any assumptions elsewhere about case sensitivity that we should match?

[imolloy]

Just checked, and --identity foo@Bar.com also fails, so it's not making an distinction between the local and domain.

[mihaimaruseac]

This is probably across all of sigstore, I don't think we do any special handling of email addresses.

However, it's true that Bar.com and bar.COM should standardize to the same. Maybe we should open an issue in sigstore/community?