rekor: Fix checkpoint signature lookup

jku · jku · commit 6a43f2cb52a3 · 2025-08-20T12:23:29.000+03:00
Checkpoint can have multiple signatures from multiple keys.
We just want one of them to be the log key.

Signed-off-by: Jussi Kukkonen &lt;jkukkonen@google.com&gt;
diff --git a/sigstore/_internal/rekor/checkpoint.py b/sigstore/_internal/rekor/checkpoint.py
@@ -165,24 +165,22 @@ def from_text(cls, text: str) -> SignedNote:
 
     def verify(self, rekor_keyring: RekorKeyring, key_id: KeyID) -> None:
         """
-        Verify the `SignedNote` using the given RekorKeyring by verifying
-        each contained signature.
+        Verify the `SignedNote` using the given RekorKeyring and KeyID.
         """
 
         note = str.encode(self.note)
 
         for sig in self.signatures:
-            if sig.sig_hash != key_id[:4]:
-                raise VerificationError(
-                    "checkpoint: sig_hash hint does not match expected key_id"
-                )
-
-            try:
-                rekor_keyring.verify(
-                    key_id=key_id, signature=base64.b64decode(sig.signature), data=note
-                )
-            except VerificationError as sig_err:
-                raise VerificationError(f"checkpoint: invalid signature: {sig_err}")
+            if sig.sig_hash == key_id[:4]:
+                try:
+                    rekor_keyring.verify(
+                        key_id=key_id, signature=base64.b64decode(sig.signature), data=note
+                    )
+                    return
+                except VerificationError as sig_err:
+                    raise VerificationError(f"checkpoint: invalid signature: {sig_err}")
+
+        raise VerificationError(f"checkpoint: Log signature not found for key {key_id}")
 
 
 @dataclass(frozen=True)
