Ashley Davisandjetstack-bot c686a2f69a fix check for self-signed certs in EncodeX509Chain ...

see also https://github.com/jetstack/cert-manager/issues/4142

EncodeX509Chain checked for self-signed certs by comparing the subject
and issuer of the cert in question, which is invalid since it's
perfectly fine for those to match.

the correct behavior is to use cert.CheckSignatureFrom(cert). this bug
was exposed in 1.4 when ParseSingleCertificateChain started using
EncodeX509Chain in the critical path of several issuers; when end-users
had leaf certificates with subjects matching their issuer's subject, the
bug was triggered.

includes newly written tests for EncodeX509Chain and a test for
ParseSingleCertificateChain

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>

2021-07-21 16:50:07 +00:00

..

acme

Adds a bunch of comments for exported types

2021-05-19 10:19:43 +01:00

api

Adds base CertificateSigningRequest cert-manager controller

2021-05-27 00:23:50 +01:00

apis

Remove the defaulting for renewBefore from fuzzer

2021-06-11 15:35:46 +01:00

client

Run a codegen update

2021-01-08 15:05:32 +01:00

controller

Remove the default renewBefore value

2021-06-11 10:03:12 +01:00

ctl

static analysis fixes

2021-05-21 12:04:11 +01:00

feature

Moves CertificateSigningRequest controller to feature gate flag

2021-05-27 12:00:56 +01:00

internal

Remove the defaulting for renewBefore from fuzzer

2021-06-11 15:35:46 +01:00

issuer

Merge pull request #4036 from wallrj/3875-pod-security

2021-05-21 18:53:26 +01:00

logs

further static check fixes

2021-05-21 12:04:05 +01:00

metrics

spelling: prometheus

2021-03-04 13:04:38 -05:00

scheduler

Add a fake scheduler

2021-05-19 13:05:59 +01:00

util

fix check for self-signed certs in EncodeX509Chain

2021-07-21 16:50:07 +00:00

webhook

further static check fixes

2021-05-21 12:04:05 +01:00