Add dynamic ctlog verifier selection based on URL and correct STH log_id generation #830
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This update removes the previously hardcoded CTlog key ID and instead dynamically selects the correct CTlog verifier based on the CTlog's BaseURL. It also fixes the issue where STHs generated by the monitor contained an empty log_id field by correctly computing the log ID as the SHA-256 hash of the DER-encoded public key. These changes allow ct_monitor to work properly with both custom CT logs and the public Sigstore CT log instances.
This PR also includes a variable rename,
fulcioClient->ctlogClientIssue: #829
Release Note
Documentation