Package dev.sigstore.fulcio.client

Class FulcioCertificateMatcher

java.lang.Object

dev.sigstore.fulcio.client.FulcioCertificateMatcher

All Implemented Interfaces:

VerificationOptions.CertificateMatcher, java.util.function.Predicate<java.security.cert.X509Certificate>

@Immutable
public abstract class FulcioCertificateMatcher
extends java.lang.Object
implements VerificationOptions.CertificateMatcher

Constructor Summary

Constructors

Constructor	Description
FulcioCertificateMatcher()

Method Summary

Modifier and Type	Method	Description
abstract StringMatcher	getIssuer()	Match against the identity token issuer
abstract java.util.Map<java.lang.String,byte[]>	getOidBytes()	For comparing raw bytes of the full ASN.1 object extension value as defined by EXTENSION in rfc5280
abstract java.util.Map<java.lang.String,StringMatcher>	getOidDerAsn1Strings()	For OIDs with DER encoded ASN.1 string entries.
abstract java.util.Map<java.lang.String,StringMatcher>	getOidRawStrings()	For OIDs with raw string entries.
abstract StringMatcher	getSubjectAlternativeName()	Match against the identity token subject/email
boolean	test(java.security.cert.X509Certificate certificate)
java.lang.String	toString()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface java.util.function.Predicate

and, negate, or

Constructor Detail

FulcioCertificateMatcher

public FulcioCertificateMatcher()

Method Detail

getIssuer

public abstract StringMatcher getIssuer()

Match against the identity token issuer

getSubjectAlternativeName

public abstract StringMatcher getSubjectAlternativeName()

Match against the identity token subject/email

getOidRawStrings

public abstract java.util.Map<java.lang.String,StringMatcher> getOidRawStrings()

For OIDs with raw string entries. This is non-standard, but older fulcio OID extensions values use it.

getOidDerAsn1Strings

public abstract java.util.Map<java.lang.String,StringMatcher> getOidDerAsn1Strings()

For OIDs with DER encoded ASN.1 string entries. This is the standard for strings values as OID extensions.

getOidBytes

public abstract java.util.Map<java.lang.String,byte[]> getOidBytes()

For comparing raw bytes of the full ASN.1 object extension value as defined by EXTENSION in rfc5280

The key is the oid string (ex: 1.2.3.4.5) and the value is a raw byte array. Matching is a direct byte array equality check with no mutations on the extension value.

toString

public java.lang.String toString()

Overrides:

toString in class java.lang.Object

test

public boolean test(java.security.cert.X509Certificate certificate)
             throws VerificationOptions.UncheckedCertificateException

Specified by:

test in interface java.util.function.Predicate<java.security.cert.X509Certificate>

Specified by:

test in interface VerificationOptions.CertificateMatcher

Throws:

VerificationOptions.UncheckedCertificateException