Email address are treated as case sensitive when verifying signatures

[imolloy]

Description

When using an email identity to verify a signature, the email is currently case sensitive. E.g.,

--identity foo@bar.com works but --identity FoO@baR.coM fails.

Verification failed with error: Certificate's SANs do not match FoO@baR.coM; actual SANs: {'foo@bar.com'}

Version

Latest v1.0.1

[spencerschrock]

disclaimer: only did a few RFC searches.

When using an email identity to verify a signature, the email is currently case sensitive

I can see the domain being case insensitive (not sure about non-ASCII domains), but the email RFC seems to imply the local-part may have semantics dependent on the host

the local-part MUST be interpreted and assigned semantics only by the host specified in the domain part of the address

@haydentherapper does Sigstore make any assumptions elsewhere about case sensitivity that we should match?

[imolloy]

Just checked, and --identity foo@Bar.com also fails, so it's not making an distinction between the local and domain.

[mihaimaruseac]

This is probably across all of sigstore, I don't think we do any special handling of email addresses.

However, it's true that Bar.com and bar.COM should standardize to the same. Maybe we should open an issue in sigstore/community?

[arpitjain099]

The root cause is upstream in sigstore-python, not in model-transparency: model_signing builds its verification policy with sigstore.verify.policy.Identity(identity=..., issuer=...), and that policy compares the expected identity against the certificate SANs with an exact match (self._identity in all_sans in sigstore/verify/policy.py), so an email that differs only in case is rejected.

I opened sigstore/sigstore-python#1795 to match email (RFC822Name) SANs case-insensitively while keeping URI/other SANs exact. Once that is released and model-signing picks up the new version, --identity FoO@baR.coM will verify against a foo@bar.com SAN.