The Veraison client plugin should be able to determine the signature algorithm used by the downstream verifier dynamically.
Currently, the value is hardcoded.
There are a few ways to address this issue:
- Extract the alg header from the EAR.
- Supply the algorithm as part of the plugin configuration blob.
- Expand the discovery object to return the signature algorithm identifier alongside the public key.
If we opt for the first option, it will be dealt with entirely in veraison/ear. The other two options are veraison/services only.
EDIT(@thomas-fossati): added more details.
The Veraison client plugin should be able to determine the signature algorithm used by the downstream verifier dynamically.
Currently, the value is hardcoded.
There are a few ways to address this issue:
If we opt for the first option, it will be dealt with entirely in
veraison/ear. The other two options areveraison/servicesonly.EDIT(@thomas-fossati): added more details.