uranusjr
diff --git a/‎Makefile
Lines changed: 1 addition & 1 deletion b/‎Makefile
Lines changed: 1 addition & 1 deletion
diff --git a/‎pyproject.toml
Lines changed: 3 additions & 0 deletions b/‎pyproject.toml
Lines changed: 3 additions & 0 deletions
diff --git a/‎sigstore/_cli.py
Lines changed: 4 additions & 1 deletion b/‎sigstore/_cli.py
Lines changed: 4 additions & 1 deletion
diff --git a/‎sigstore/_internal/fulcio/client.py
Lines changed: 95 additions & 44 deletions b/‎sigstore/_internal/fulcio/client.py
Lines changed: 95 additions & 44 deletions
diff --git a/‎sigstore/_internal/oidc/oauth.py
Lines changed: 6 additions & 6 deletions b/‎sigstore/_internal/oidc/oauth.py
Lines changed: 6 additions & 6 deletions
@@ -55,7 +55,7 @@ lint:
 .PHONY: test
 test:
 	. env/bin/activate && \
-		pytest --cov=$(PY_MODULE) test/ $(TEST_ARGS) && \
+		pytest --cov=$(PY_MODULE) test/ $(T) $(TEST_ARGS) && \
 		python -m coverage report -m $(COV_ARGS)
 
 .PHONY: doc
 
@@ -33,6 +33,9 @@ dependencies = [
   "pyOpenSSL",
   "requests",
   "securesystemslib",
+  # HACK(#84): Remove these dependencies.
+  "pyasn1",
+  "pyasn1-modules",
 ]
 requires-python = ">=3.7"
 
 
@@ -13,6 +13,7 @@
 # limitations under the License.
 
 import logging
+import os
 import sys
 from importlib import resources
 from typing import BinaryIO, List, Optional, TextIO
@@ -27,6 +28,7 @@
 from sigstore._internal.oidc.ambient import detect_credential
 from sigstore._internal.oidc.issuer import Issuer
 from sigstore._internal.oidc.oauth import (
+    DEFAULT_OAUTH_ISSUER,
     STAGING_OAUTH_ISSUER,
     get_identity_token,
 )
@@ -38,6 +40,7 @@
 from sigstore._verify import verify
 
 logger = logging.getLogger(__name__)
+logging.basicConfig(level=os.environ.get("SIGSTORE_LOGLEVEL", "INFO").upper())
 
 
 @click.group()
@@ -82,7 +85,7 @@ def main() -> None:
     "--oidc-issuer",
     metavar="URL",
     type=click.STRING,
-    default="https://oauth2.sigstore.dev/auth",
+    default=DEFAULT_OAUTH_ISSUER,
     help="The custom OpenID Connect issuer to use (conflicts with --staging)",
 )
 @click.option(
 
@@ -19,25 +19,34 @@
 import base64
 import datetime
 import json
+import logging
 import struct
 from abc import ABC
 from dataclasses import dataclass
 from enum import IntEnum
-from typing import List
+from typing import List, Optional
 from urllib.parse import urljoin
 
 import pem
 import requests
-from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import ec
-from cryptography.x509 import Certificate, load_pem_x509_certificate
+from cryptography.x509 import (
+    Certificate,
+    ExtensionNotFound,
+    PrecertificateSignedCertificateTimestamps,
+    load_pem_x509_certificate,
+)
 from cryptography.x509.certificate_transparency import (
     LogEntryType,
     SignedCertificateTimestamp,
     Version,
 )
+from pyasn1.codec.der.decoder import decode as asn1_decode
 from pydantic import BaseModel, Field, validator
 
+logger = logging.getLogger(__name__)
+
 DEFAULT_FULCIO_URL = "https://fulcio.sigstore.dev"
 STAGING_FULCIO_URL = "https://fulcio.sigstage.dev"
 SIGNING_CERT_ENDPOINT = "/api/v1/signingCert"
@@ -61,20 +70,11 @@ class SCTHashAlgorithm(IntEnum):
     SHA384 = 5
     SHA512 = 6
 
+    def to_cryptography(self) -> hashes.HashAlgorithm:
+        if self != SCTHashAlgorithm.SHA256:
+            raise FulcioSCTError(f"unexpected hash algorithm: {self!r}")
 
-class SCTSignatureAlgorithm(IntEnum):
-    """
-    Signature algorithms that are valid for SCTs.
-
-    These are exactly the same as the SignatureAlgorithm enum in RFC 5246 (TLS 1.2).
-
-    See: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
-    """
-
-    ANONYMOUS = 0
-    RSA = 1
-    DSA = 2
-    ECDSA = 3
+        return hashes.SHA256()
 
 
 class FulcioSCTError(Exception):
@@ -94,7 +94,7 @@ class DetachedFulcioSCT(BaseModel):
     log_id: bytes = Field(..., alias="id")
     timestamp: datetime.datetime
     digitally_signed: bytes = Field(..., alias="signature")
-    extensions: bytes
+    extension_bytes: bytes = Field(..., alias="extensions")
 
     class Config:
         allow_population_by_field_name = True
@@ -113,7 +113,7 @@ def _validate_digitally_signed(cls, v: bytes) -> bytes:
     def _validate_log_id(cls, v: bytes) -> bytes:
         return base64.b64decode(v)
 
-    @validator("extensions", pre=True)
+    @validator("extension_bytes", pre=True)
     def _validate_extensions(cls, v: bytes) -> bytes:
         return base64.b64decode(v)
 
@@ -122,15 +122,14 @@ def entry_type(self) -> LogEntryType:
         return LogEntryType.X509_CERTIFICATE
 
     @property
-    def signature_hash_algorithm(self) -> int:
-        # TODO(ww): This should become a cryptography `Hash` subclass
-        # instance once cryptography adds this API.
-        return self.digitally_signed[0]
+    def signature_hash_algorithm(self) -> hashes.HashAlgorithm:
+        hash_ = SCTHashAlgorithm(self.digitally_signed[0])
+        return hash_.to_cryptography()
 
     @property
     def signature_algorithm(self) -> int:
-        # TODO(ww): This should become a SignatureAlgorithm variant
-        # once cryptography adds this API.
+        # TODO(ww): This method will need to return a SignatureAlgorithm
+        # variant instead, for consistency with cryptography's interface.
         return self.digitally_signed[1]
 
     @property
@@ -177,7 +176,9 @@ class FulcioCertificateSigningResponse:
 
     cert: Certificate
     chain: List[Certificate]
-    sct: DetachedFulcioSCT
+    sct: SignedCertificateTimestamp
+    # HACK(#84): Remove entirely.
+    raw_sct: Optional[bytes]
 
 
 @dataclass(frozen=True)
@@ -229,24 +230,6 @@ def post(
             except (AttributeError, KeyError):
                 raise FulcioClientError from http_error
 
-        # The SCT header is a base64-encoded payload, which in turn
-        # is a JSON representation of the SignedCertificateTimestamp
-        # in RFC 6962 (subsec. 3.2).
-        sct_b64 = resp.headers.get("SCT")
-        if sct_b64 is None:
-            raise FulcioClientError("Fulcio response did not include a SCT header")
-
-        try:
-            sct_json = json.loads(base64.b64decode(sct_b64).decode())
-        except ValueError as exc:
-            raise FulcioClientError from exc
-
-        try:
-            sct = DetachedFulcioSCT.parse_obj(sct_json)
-        except Exception as exc:
-            # Ideally we'd catch something less generic here.
-            raise FulcioClientError from exc
-
         # Cryptography doesn't have chain verification/building built in
         # https://github.com/pyca/cryptography/issues/2381
         try:
@@ -256,7 +239,74 @@ def post(
         except ValueError:
             raise FulcioClientError(f"Did not find a cert in Fulcio response: {resp}")
 
-        return FulcioCertificateSigningResponse(cert, chain, sct)
+        try:
+            # Try to retrieve the embedded SCTs within the cert.
+            precert_scts_extension = cert.extensions.get_extension_for_class(
+                PrecertificateSignedCertificateTimestamps
+            ).value
+
+            if len(precert_scts_extension) != 1:
+                raise FulcioClientError(
+                    f"Unexpected embedded SCT count in response: {len(precert_scts_extension)} != 1"
+                )
+
+            # HACK(#84): Remove entirely.
+            # HACK: Until cryptography is released, we don't have direct access
+            # to each SCT's internals (signature, extensions, etc.)
+            # Instead, we do something really nasty here: we decode the ASN.1,
+            # unwrap the underlying TLS structures, and stash the raw SCT
+            # for later use.
+            parsed_sct_extension = asn1_decode(precert_scts_extension.public_bytes())
+
+            def _opaque16(value: bytes) -> bytes:
+                # invariant: there have to be at least two bytes, for the length.
+                if len(value) < 2:
+                    raise FulcioClientError(
+                        "malformed TLS encoding in response (length)"
+                    )
+
+                (length,) = struct.unpack("!H", value[0:2])
+
+                if length != len(value[2:]):
+                    raise FulcioClientError(
+                        "malformed TLS encoding in response (payload)"
+                    )
+
+                return value[2:]
+
+            # This is a TLS-encoded `opaque<0..2^16-1>` for the list,
+            # which itself contains an `opaque<0..2^16-1>` for the SCT.
+            raw_sct_list_bytes = bytes(parsed_sct_extension[0])
+            raw_sct = _opaque16(_opaque16(raw_sct_list_bytes))
+
+            sct = precert_scts_extension[0]
+        except ExtensionNotFound:
+            # If we don't have any embedded SCTs, then we might be dealing
+            # with a Fulcio instance that provides detached SCTs.
+
+            # The SCT header is a base64-encoded payload, which in turn
+            # is a JSON representation of the SignedCertificateTimestamp
+            # in RFC 6962 (subsec. 3.2).
+            sct_b64 = resp.headers.get("SCT")
+            if sct_b64 is None:
+                raise FulcioClientError("Fulcio response did not include a SCT header")
+
+            try:
+                sct_json = json.loads(base64.b64decode(sct_b64).decode())
+            except ValueError as exc:
+                raise FulcioClientError from exc
+
+            try:
+                sct = DetachedFulcioSCT.parse_obj(sct_json)
+            except Exception as exc:
+                # Ideally we'd catch something less generic here.
+                raise FulcioClientError from exc
+
+            # HACK(#84): Remove entirely.
+            # The terrible hack above doesn't apply to detached SCTs.
+            raw_sct = None
+
+        return FulcioCertificateSigningResponse(cert, chain, sct, raw_sct)
 
 
 class FulcioRootCert(Endpoint):
@@ -276,6 +326,7 @@ class FulcioClient:
 
     def __init__(self, url: str = DEFAULT_FULCIO_URL) -> None:
         """Initialize the client"""
+        logger.debug(f"Fulcio client using URL: {url}")
         self.url = url
         self.session = requests.Session()
 
 
@@ -150,6 +150,12 @@ def get_identity_token(client_id: str, client_secret: str, issuer: Issuer) -> st
 
     code: str
     with RedirectServer(client_id, client_secret, issuer) as server:
+        thread = threading.Thread(
+            target=lambda server: server.serve_forever(),
+            args=(server,),
+        )
+        thread.start()
+
         # Launch web browser
         if webbrowser.open(server.base_uri):
             print(f"Your browser will now be opened to:\n{server.auth_request()}\n")
@@ -159,12 +165,6 @@ def get_identity_token(client_id: str, client_secret: str, issuer: Issuer) -> st
                 f"Go to the following link in a browser:\n\n\t{server.auth_request()}"
             )
 
-        thread = threading.Thread(
-            target=lambda server: server.serve_forever(),
-            args=(server,),
-        )
-        thread.start()
-
         if not server.is_oob:
             # Wait until the redirect server populates the response
             while server.auth_response is None:
Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,9 @@ dependencies = [`
`33`	`33`	`"pyOpenSSL",`
`34`	`34`	`"requests",`
`35`	`35`	`"securesystemslib",`
	`36`	`+ # HACK(#84): Remove these dependencies.`
	`37`	`+ "pyasn1",`
	`38`	`+ "pyasn1-modules",`
`36`	`39`	`]`
`37`	`40`	`requires-python = ">=3.7"`
`38`	`41`