apk: replace the constraint regex and its cache with a hand-written parser - #2467
Draft
markusthoemmes wants to merge 1 commit into
Draft
markusthoemmes wants to merge 1 commit into
markusthoemmes wants to merge 1 commit into
Chainguard Guardener / Enforce - Commit Signing
succeeded
Sep 7, 2026 in 1s
Successfully verified commit signature.
| CLAIM | DESCRIPTION | |
|---|---|---|
| ✅ | Found Git signature | |
| ✅ | Validated Git signature | |
| ✅ | Validated Rekor entry | |
| ✅ | Allowed by policy |
Details
Certificate
Details
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 481111184702374512475376577128544341677284438160 (0x5445c58b56702151858ea8bb992881b07f9ab090)
Signature Algorithm: ECDSA-SHA384
Issuer: O=sigstore.dev,CN=sigstore-intermediate
Validity
Not Before: Sep 7 13:07:00 2026 UTC
Not After : Sep 7 13:17:00 2026 UTC
Subject: Subject Public Key Info:
Public Key Algorithm: ECDSA
Public-Key: (256 bit)
X:
69:0a:fe:e4:79:78:e8:f2:20:23:e7:c0:73:5d:8e:
0b:50:ba:4f:d7:47:8f:14:f1:d4:8a:8e:bf:7c:13:
d8:42
Y:
3f:5a:46:61:88:08:ad:98:12:15:86:53:3c:ab:b8:
64:90:9d:89:d9:9a:b8:67:70:41:8e:bb:d4:b1:c3:
bc:b9
Curve: P-256
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage:
Code Signing
X509v3 Subject Key Identifier:
EC:DB:D5:67:C4:7F:80:F0:CF:3F:F4:A0:92:30:EC:86:BA:AD:44:D9
X509v3 Authority Key Identifier:
keyid:DF:D3:E9:CF:56:24:11:96:F9:A8:D8:E9:28:55:A2:C6:2E:18:64:3F
X509v3 Subject Alternative Name: critical
email:markus.thoemmes@chainguard.dev
oidcIssuer:
https://accounts.google.com
Unknown extension 1.3.6.1.4.1.57264.1.8
Unknown extension 1.3.6.1.4.1.57264.1.24
Signed Certificate Timestamp:
BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoHv6rIsAAAQDAEYwRAIgTG8Jsfj3G9Yb85lDSfQqDKQ4P9DEh1eo6DZeFRCg1uYCIAwpyNi6tmoRZSUdhVZhWOLLXtUs4dnNtyako4ehTrWQ
Signature Algorithm: ECDSA-SHA384
30:64:02:30:55:f3:d6:64:25:e2:8a:f7:10:dd:6c:6e:09:5b:
d0:f9:3d:cd:b8:88:88:8a:9e:d0:19:d3:61:5e:48:09:cb:de:
89:90:b1:c5:51:ba:01:d3:16:4a:16:ee:7d:ca:ac:70:02:30:
4f:3b:dd:dc:b5:49:37:6c:d6:2f:15:62:eb:40:39:f8:4e:23:
5a:24:03:b1:6a:75:26:de:b0:8c:aa:8c:72:01:e6:09:10:b4:
25:13:bd:ee:82:3c:64:5e:e9:f1:93:4f
Rekor Entry
Details
{
"body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIxZTg1NjdmYTgzYzdkMTE1MGVhYjhlY2Q4OWRiOTdhNmFjODI2NGQ1MTc1ZWU0M2M4MmVmYjljNDNiYzJlZjUzIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJUUQwM3dIWVpqZjMzWVF2UGphSHA2MnhvZEJoK0ltV0V3anpqcGdHbVd5bEdBSWdYSG5DTnkrc0kvQ1pER3hYeFJrSUhGVHNSaGo1UEFuZjFXRDZSMVVZVmdvPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUk5ha05EUVhKdFowRjNTVUpCWjBsVlZrVllSbWt4V25kSlZrZEdhbkZwTjIxVGFVSnpTQ3RoYzBwQmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlVUVROTlZFMTNUbnBCZDFkb1kwNU5hbGwzVDFSQk0wMVVUWGhPZWtGM1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZoVVhJck5VaHNORFpRU1dkSksyWkJZekV5VDBNeFF6WlVPV1JJYW5oVWVERkpjVThLZGpOM1ZESkZTUzlYYTFwb2FVRnBkRzFDU1Zab2JFMDRjVGRvYTJ0S01rb3lXbkUwV2pOQ1FtcHlkbFZ6WTA4NGRXRlBRMEZrWjNkblowaFZUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlUzVG5aV0NsbzRVaTluVUVSUVVDOVRaMnRxUkhOb2NuRjBVazVyZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDB4QldVUldVakJTUVZGSUwwSkRTWGRKU1VWbFlsZEdlV0V6Vm5wTWJsSnZZakpXZEdKWFZucFJSMDV2V1Zkc2RWb3pWbWhqYlZGMVdrZFdNZ3BOUTJ0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVjeWFEQmtTRUo2VDJrNGRsbFhUbXBpTTFaMVpFaE5kVm95T1haYU1uaHNURzFPZG1KVVFYSkNaMjl5Q2tKblJVVkJXVTh2VFVGRlNVSkNNRTFITW1nd1pFaENlazlwT0haWlYwNXFZak5XZFdSSVRYVmFNamwyV2pKNGJFeHRUblppVkVKaVFtZHZja0puUlVVS1FWbFBMMDFCUlZsQ1JUQk5VekJPYjFaWWFFNVdSMDE0Vkcxd2FrNVZOWEZWVkZKUVVrWlZNVlJyVWxKbFJURkZVbFJHVGxKSFpGUlRSRXB2VFVkU1NRcFJibkJRWVZaV05WVnRiRlpsVmtwMFVtMXdXazFxYTNoWmJUVlRaV3Q0ZEZwSVdtbE5iVko2VjJ4Tk1XRnRTWGxOUkVOQ2FWRlpTMHQzV1VKQ1FVaFhDbVZSU1VWQloxSTNRa2hyUVdSM1FqRkJUakE1VFVkeVIzaDRSWGxaZUd0bFNFcHNiazUzUzJsVGJEWTBNMnA1ZEM4MFpVdGpiMEYyUzJVMlQwRkJRVUlLYjBoMk5uSkpjMEZCUVZGRVFVVlpkMUpCU1dkVVJ6aEtjMlpxTTBjNVdXSTROV3hFVTJaUmNVUkxVVFJRT1VSRmFERmxielpFV21WR1VrTm5NWFZaUXdwSlFYZHdlVTVwTm5SdGIxSmFVMVZrYUZaYWFGZFBURXhZZEZWek5HUnVUblI1WVd0dk5HVm9WSEpYVVUxQmIwZERRM0ZIVTAwME9VSkJUVVJCTW1OQkNrMUhVVU5OUmxoNk1XMVJiRFJ2Y2pORlRqRnpZbWRzWWpCUWF6bDZZbWxKYVVseFpUQkNibFJaVmpWSlEyTjJaV2xhUTNoNFZrYzJRV1JOVjFOb1luVUtabU54YzJOQlNYZFVlblprTTB4V1NrNHllbGRNZUZacE5qQkJOU3RGTkdwWGFWRkVjMWR3TVVwME5uZHFTM0ZOWTJkSWJVTlNRekJLVWs4NU4yOUpPQXBhUmpkd09GcE9VQW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In19fX0=",
"integratedTime": 1788786421,
"logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",
"logIndex": 2750943280,
"verification": {
"inclusionProof": {
"checkpoint": "rekor.sigstore.dev - 1193050959916656506\n2629039672\nIzFrKnk/EBWE8vRgfSK9w/Mtf+boi86JL2ipf7SyX3g=\n\n— rekor.sigstore.dev wNI9ajBFAiBgulHI7kiI8L/d7M2ukUhikZXzmQIxeoMDI9i7yYHq5AIhAOQkhalMHz4OLtxg8hIWwDS92+AVPAxWxR48l/JMO4lw\n",
"hashes": [
"e1c0fc846402398b278aa10b5b2ac2bdac08d6a0b37cdeb8d353ccf9f4e3cd9a",
"34aeb53145242e2e1cd5d1a0a61bf694fa465138bc08cad853692b342b5f43e5",
"2718230e7e0173a5154897f4174dc6fd2de1ccde4e68c131616ac102c6b58acb",
"7840b7e6e268d74fd0bf23bc163fa7e5fa5c5d26b639447dc3ea98c7b63acff6",
"632301299b490f03103de20fad2216c7f3db43f9c3ddce4f247d81f52a61c37c",
"4f6e97064d99f215f0343e87dcafcb1f912eab74b132d629c6fc9cfaedff34f9",
"a0a7c772b1b388e780ebc75de50af00f5c40b1c88daacf6ecb648a96bff7c7d0",
"8f97ce98792ce6ffbeae1cd1b00122e5f6d5a9c728c452936272cc5505dd15ca",
"eb9a21f62d8d9171ed7c1f1754007f58d900c13256909dcdbe40e5bebcbe7a49",
"1b9c87483b961db4458caff71bed6b327b39c611c58c91577b784f9967bbd4e1",
"f8cde691a4373c9ddf15930aecefc80f8886f3511a5e2c8524653a88a7797c7c",
"b61a8ffa7193fd70fc2466bd2d3ce49d5f2c6fbf28de43ca27a96a194aea78ec",
"a04ad8da8c735f5d11912a4a1e923de433c13fe2a472b022075a39dd29c3c65e",
"245ba5640cf5e56d3e7e5be45960c50d6ea15c8b391e2f1c4e26cef327e62b3a",
"e84f3d634971b2563c1940de5046cc53151d83f70e17412bdd460e411a15cdec",
"98dd439d4136362b309931fa26b044bd2f387663d8eac9ade471bc6d56b827d8",
"c2c7d96c2dd8140bff9f83ae773679e30bde2762edb62eb8a846f6143b91a7aa",
"27410cdc030c1fb7eefc0fe4672837f28332aeeafac479dab70f4cac266d8357",
"2bef39f32182c36e43e5130088a75efeeb50730c5b106942a067f367809a4945",
"94a496623dfae08786d1bd740d8fe260b81279688d9326c464bcdde3d814152a",
"eed0f62bc980a864cc10dacfd985d6cfbd417935903c28987770844808102f3f",
"79748bacba8a4b14538b148ffe4e188a6ae207696e7daa3ab6ba93aecc719728",
"4a775b30a56d7137a7024c22d8905f1b30fe9a17b1a75a896d1218f80d494485",
"c47fc30ac78b1ebf5e2a8613f2ab0e4592bbcd5744198587b95b6c56b0fde706"
],
"logIndex": 2629039018,
"rootHash": "23316b2a793f101584f2f4607d22bdc3f32d7fe6e88bce892f68a97fb4b25f78",
"treeSize": 2629039672
},
"signedEntryTimestamp": "MEYCIQCLmm9Mg7Hckc0mai1rx/eSCxB/gfIceeYGUOcqKHh8MAIhAO35MxjWnb7Wrw8TvUd1WbkQbUpat85puf4tFOZtZ9X5"
}
}
Loading