CVE-2023-33199: Reachable Assertion (CWE-617)
value: Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 5.3
Published: 2023-05-26T23:15Z
Repository: https://github.com/sigstore/rekor
Language: Go
Files changed: pkg/generated/models/intoto_v002_schema.go, pkg/generated/restapi/embedded_spec.go, pkg/types/dsse/v0.0.1/entry.go, pkg/types/dsse/v0.0.1/entry_test.go, pkg/types/intoto/v0.0.2/entry.go, pkg/types/intoto/v0.0.2/entry_test.go, pkg/types/intoto/v0.0.2/intoto_v0_0_2_schema.json
Commit date: 2023-05-26 06:44:56 -0400
Commit message: Merge pull request from GHSA-frqx-jfcm-6jjr

* fix for ghsa-frqx-jfcm-6jjr

Signed-off-by: Bob Callaway <bcallaway@google.com>

* add defensive check

Signed-off-by: Bob Callaway <bcallaway@google.com>

* add defensive check to dsse type

Signed-off-by: Bob Callaway <bcallaway@google.com>

* be stricter for DSSE, add another defensive check

Signed-off-by: Bob Callaway <bcallaway@google.com>

---------

Signed-off-by: Bob Callaway <bcallaway@google.com>
Diff: diff --git a/pkg/generated/models/intoto_v002_schema.go b/pkg/generated/models/intoto_v002_schema.go
index b630f156..816435cb 100644
--- a/pkg/generated/models/intoto_v002_schema.go
+++ b/pkg/generated/models/intoto_v002_schema.go
@@ -448,20 +448,53 @@ type IntotoV002SchemaContentEnvelopeSignaturesItems0 struct {
 
 	// optional id of the key used to create the signature
 	Keyid string `json:"keyid,omitempty"`
 
 	// public key that corresponds to this signature
+	// Required: true
 	// Format: byte
-	PublicKey strfmt.Base64 `json:"publicKey,omitempty"`
+	PublicKey *strfmt.Base64 `json:"publicKey"`
 
 	// signature of the payload
+	// Required: true
 	// Format: byte
-	Sig strfmt.Base64 `json:"sig,omitempty"`
+	Sig *strfmt.Base64 `json:"sig"`
 }
 
 // Validate validates this intoto v002 schema content envelope signatures items0
 func (m *IntotoV002SchemaContentEnvelopeSignaturesItems0) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validatePublicKey(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateSig(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *IntotoV002SchemaContentEnvelopeSignaturesItems0) validatePublicKey(formats strfmt.Registry) error {
+
+	if err := validate.Required("publicKey", "body", m.PublicKey); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *IntotoV002SchemaContentEnvelopeSignaturesItems0) validateSig(formats strfmt.Registry) error {
+
+	if err := validate.Required("sig", "body", m.Sig); err != nil {
+		return err
+	}
+
 	return nil
 }
 
 // ContextValidate validates this intoto v002 schema content envelope signatures items0 based on context it is used
 func (m *IntotoV002SchemaContentEnvelopeSignaturesItems0) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
diff --git a/pkg/generated/restapi/embedded_spec.go b/pkg/generated/restapi/embedded_spec.go
index c49f2538..a43263d2 100644
--- a/pkg/generated/restapi/embedded_spec.go
+++ b/pkg/generated/restapi/embedded_spec.go
@@ -2165,10 +2165,14 @@ func init() {
       }
     },
     "IntotoV002SchemaContentEnvelopeSignaturesItems0": {
       "description": "a signature of the envelope's payload along with the public key for the signature",
       "type": "object",
+      "required": [
+        "sig",
+        "publicKey"
+      ],
       "properties": {
         "keyid": {
           "description": "optional id of the key used to create the signature",
           "type": "string"
         },
diff --git a/pkg/types/dsse/v0.0.1/entry.go b/pkg/types/dsse/v0.0.1/entry.go
index 2b73772e..3cb2ef0d 100644
--- a/pkg/types/dsse/v0.0.1/entry.go
+++ b/pkg/types/dsse/v0.0.1/entry.go
@@ -73,10 +73,13 @@ func NewEntry() types.EntryImpl {
 // be present at the time of insertion
 func (v V001Entry) IndexKeys() ([]string, error) {
 	var result []string
 
 	for _, sig := range v.DSSEObj.Signatures {
+		if sig == nil || sig.Verifier == nil {
+			return result, errors.New("missing or malformed public key")
+		}
 		keyObj, err := x509.NewPublicKey(bytes.NewReader(*sig.Verifier))
 		if err != nil {
 			return result, err
 		}
 
@@ -200,10 +203,14 @@ func (v *V001Entry) Unmarshal(pe models.ProposedEntry) error {
 		return errors.New("DSSE envelope must contain 1 or more signatures")
 	}
 
 	allPubKeyBytes := make([][]byte, 0)
 	for _, publicKey := range dsseObj.ProposedContent.Verifiers {
+		if publicKey == nil {
+			return errors.New("an invalid null verifier was provided in ProposedContent")
+		}
+
 		allPubKeyBytes = append(allPubKeyBytes, publicKey)
 	}
 
 	sigToKeyMap, err := verifyEnvelope(allPubKeyBytes, env)
 	if err != nil {
diff --git a/pkg/types/dsse/v0.0.1/entry_test.go b/pkg/types/dsse/v0.0.1/entry_test.go
index 789f7952..e59e46fd 100644
--- a/pkg/types/dsse/v0.0.1/entry_test.go
+++ b/pkg/types/dsse/v0.0.1/entry_test.go
@@ -156,10 +156,13 @@ func TestV001Entry_Unmarshal(t *testing.T) {
 				Sig: string(strfmt.Base64("foobar")),
 			},
 		},
 	}
 
+	validEnv := envelope(t, key, []byte("payload"))
+	validEnvBytes, _ := json.Marshal(validEnv)
+
 	validPayload := "hellothispayloadisvalid"
 
 	tests := []struct {
 		env     *dsse.Envelope
 		name    string
@@ -216,10 +219,21 @@ func TestV001Entry_Unmarshal(t *testing.T) {
 			it: &models.DSSEV001Schema{
 				ProposedContent: createRekorEnvelope(multiSignEnvelope(t, []*ecdsa.PrivateKey{key, priv}, []byte(validPayload)), [][]byte{pub, pemBytes}),
 			},
 			wantErr: false,
 		},
+		{
+			env:  validEnv,
+			name: "null verifier in array",
+			it: &models.DSSEV001Schema{
+				ProposedContent: &models.DSSEV001SchemaProposedContent{
+					Envelope:  swag.String(string(validEnvBytes)),
+					Verifiers: []strfmt.Base64{pub, nil},
+				},
+			},
+			wantErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			v := &V001Entry{}
 
diff --git a/pkg/types/intoto/v0.0.2/entry.go b/pkg/types/intoto/v0.0.2/entry.go
index 513812df..5231eee2 100644
--- a/pkg/types/intoto/v0.0.2/entry.go
+++ b/pkg/types/intoto/v0.0.2/entry.go
@@ -30,10 +30,11 @@ import (
 	"strings"
 
 	"github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
 	"github.com/spf13/viper"
+	"golang.org/x/exp/slices"
 
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/swag"
 
 	"github.com/sigstore/rekor/pkg/generated/models"
@@ -76,11 +77,14 @@ func (v V002Entry) IndexKeys() ([]string, error) {
 		log.Logger.Info("IntotoObj content or dsse envelope is nil")
 		return result, nil
 	}
 
 	for _, sig := range v.IntotoObj.Content.Envelope.Signatures {
-		keyObj, err := x509.NewPublicKey(bytes.NewReader(sig.PublicKey))
+		if sig == nil || sig.PublicKey == nil {
+			return result, errors.New("malformed or missing signature")
+		}
+		keyObj, err := x509.NewPublicKey(bytes.NewReader(*sig.PublicKey))
 		if err != nil {
 			return result, err
 		}
 
 		canonKey, err := keyObj.CanonicalValue()
@@ -180,17 +184,21 @@ func (v *V002Entry) Unmarshal(pe models.ProposedEntry) error {
 		Payload:     string(v.IntotoObj.Content.Envelope.Payload),
 		PayloadType: *v.IntotoObj.Content.Envelope.PayloadType,
 	}
 
 	allPubKeyBytes := make([][]byte, 0)
-	for _, sig := range v.IntotoObj.Content.Envelope.Signatures {
+	for i, sig := range v.IntotoObj.Content.Envelope.Signatures {
+		if sig == nil {
+			v.IntotoObj.Content.Envelope.Signatures = slices.Delete(v.IntotoObj.Content.Envelope.Signatures, i, i)
+			continue
+		}
 		env.Signatures = append(env.Signatures, dsse.Signature{
 			KeyID: sig.Keyid,
-			Sig:   string(sig.Sig),
+			Sig:   string(*sig.Sig),
 		})
 
-		allPubKeyBytes = append(allPubKeyBytes, sig.PublicKey)
+		allPubKeyBytes = append(allPubKeyBytes, *sig.PublicKey)
 	}
 
 	if _, err := verifyEnvelope(allPubKeyBytes, env); err != nil {
 		return err
 	}
@@ -379,14 +387,15 @@ func (v V002Entry) CreateFromArtifactProperties(_ context.Context, props types.A
 		if err != nil {
 			return nil, fmt.Errorf("could not canonicize key: %w", err)
 		}
 
 		keyBytes := strfmt.Base64(canonKey)
+		sigBytes := strfmt.Base64([]byte(sig.Sig))
 		re.IntotoObj.Content.Envelope.Signatures = append(re.IntotoObj.Content.Envelope.Signatures, &models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
 			Keyid:     sig.KeyID,
-			Sig:       strfmt.Base64([]byte(sig.Sig)),
-			PublicKey: keyBytes,
+			Sig:       &sigBytes,
+			PublicKey: &keyBytes,
 		})
 	}
 
 	h := sha256.Sum256([]byte(artifactBytes))
 	re.IntotoObj.Content.Hash = &models.IntotoV002SchemaContentHash{
@@ -456,11 +465,11 @@ func (v V002Entry) Verifier() (pki.PublicKey, error) {
 	sigs := v.IntotoObj.Content.Envelope.Signatures
 	if len(sigs) == 0 {
 		return nil, errors.New("no signatures found on intoto entry")
 	}
 
-	return x509.NewPublicKey(bytes.NewReader(v.IntotoObj.Content.Envelope.Signatures[0].PublicKey))
+	return x509.NewPublicKey(bytes.NewReader(*v.IntotoObj.Content.Envelope.Signatures[0].PublicKey))
 }
 
 func (v V002Entry) Insertable() (bool, error) {
 	if v.IntotoObj.Content == nil {
 		return false, errors.New("missing content property")
@@ -478,14 +487,17 @@ func (v V002Entry) Insertable() (bool, error) {
 
 	if len(v.IntotoObj.Content.Envelope.Signatures) == 0 {
 		return false, errors.New("missing signatures content")
 	}
 	for _, sig := range v.IntotoObj.Content.Envelope.Signatures {
-		if len(sig.Sig) == 0 {
+		if sig == nil {
+			return false, errors.New("missing signature entry")
+		}
+		if sig.Sig == nil || len(*sig.Sig) == 0 {
 			return false, errors.New("missing signature content")
 		}
-		if len(sig.PublicKey) == 0 {
+		if sig.PublicKey == nil || len(*sig.PublicKey) == 0 {
 			return false, errors.New("missing publicKey content")
 		}
 	}
 
 	if v.env.Payload == "" || v.env.PayloadType == "" || len(v.env.Signatures) == 0 {
diff --git a/pkg/types/intoto/v0.0.2/entry_test.go b/pkg/types/intoto/v0.0.2/entry_test.go
index 9098d3a5..0301468f 100644
--- a/pkg/types/intoto/v0.0.2/entry_test.go
+++ b/pkg/types/intoto/v0.0.2/entry_test.go
@@ -109,14 +109,16 @@ func createRekorEnvelope(dsseEnv *dsse.Envelope, pub [][]byte) *models.IntotoV00
 	b64 := strfmt.Base64([]byte(dsseEnv.Payload))
 	env.Payload = b64
 	env.PayloadType = &dsseEnv.PayloadType
 
 	for i, sig := range dsseEnv.Signatures {
+		keyBytes := strfmt.Base64(pub[i])
+		sigBytes := strfmt.Base64([]byte(sig.Sig))
 		env.Signatures = append(env.Signatures, &models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
 			Keyid:     sig.KeyID,
-			Sig:       strfmt.Base64([]byte(sig.Sig)),
-			PublicKey: strfmt.Base64(pub[i]),
+			Sig:       &sigBytes,
+			PublicKey: &keyBytes,
 		})
 	}
 
 	return env
 }
@@ -170,10 +172,12 @@ func TestV002Entry_Unmarshal(t *testing.T) {
 			},
 		},
 	}
 
 	validPayload := "hellothispayloadisvalid"
+	keyBytes := strfmt.Base64("key")
+	sigBytes := strfmt.Base64("sig")
 
 	tests := []struct {
 		env             *dsse.Envelope
 		name            string
 		it              *models.IntotoV002Schema
@@ -271,10 +275,35 @@ func TestV002Entry_Unmarshal(t *testing.T) {
 				},
 			},
 			wantErr:         false,
 			wantVerifierErr: false,
 		},
+		{
+			env:  envelope(t, key, []byte(validPayload)),
+			name: "null array entry",
+			it: &models.IntotoV002Schema{
+				Content: &models.IntotoV002SchemaContent{
+					Envelope: &models.IntotoV002SchemaContentEnvelope{
+						Payload:     strfmt.Base64("cGF5bG9hZAo="),
+						PayloadType: swag.String("payloadType"),
+						Signatures: []*models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
+							{
+								PublicKey: &keyBytes,
+								Sig:       &sigBytes,
+							},
+							nil,
+						},
+					},
+					Hash: &models.IntotoV002SchemaContentHash{
+						Algorithm: swag.String(models.IntotoV002SchemaContentHashAlgorithmSha256),
+						Value:     swag.String(envelopeHash(t, envelope(t, key, []byte(validPayload)))),
+					},
+				},
+			},
+			wantErr:         true,
+			wantVerifierErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			v := &V002Entry{}
 
@@ -293,11 +322,11 @@ func TestV002Entry_Unmarshal(t *testing.T) {
 					}
 				}
 
 				want := []string{}
 				for _, sig := range v.IntotoObj.Content.Envelope.Signatures {
-					keyHash := sha256.Sum256(sig.PublicKey)
+					keyHash := sha256.Sum256(*sig.PublicKey)
 					want = append(want, "sha256:"+hex.EncodeToString(keyHash[:]))
 				}
 				decodedPayload, err := base64.StdEncoding.DecodeString(tt.env.Payload)
 				if err != nil {
 					return fmt.Errorf("could not decode envelope payload: %w", err)
@@ -481,11 +510,11 @@ func TestV002Entry_IndexKeys(t *testing.T) {
 				},
 				env: *envelope(t, key, b),
 			}
 			want := []string{}
 			for _, sig := range v.IntotoObj.Content.Envelope.Signatures {
-				keyHash := sha256.Sum256(sig.PublicKey)
+				keyHash := sha256.Sum256(*sig.PublicKey)
 				want = append(want, "sha256:"+hex.EncodeToString(keyHash[:]))
 			}
 
 			want = append(want, "sha256:"+hex.EncodeToString(payloadHash[:]))
 
@@ -511,10 +540,12 @@ func TestInsertable(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	env := envelope(t, key, []byte("payload"))
+	keyBytes := strfmt.Base64([]byte("key"))
+	sigBytes := strfmt.Base64([]byte("sig"))
 
 	testCases := []TestCase{
 		{
 			caseDesc: "valid entry",
 			entry: V002Entry{
@@ -523,12 +554,12 @@ func TestInsertable(t *testing.T) {
 						Envelope: &models.IntotoV002SchemaContentEnvelope{
 							Payload:     strfmt.Base64("payload"),
 							PayloadType: swag.String("payloadType"),
 							Signatures: []*models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
 								{
-									PublicKey: strfmt.Base64([]byte("key")),
-									Sig:       strfmt.Base64([]byte("sig")),
+									PublicKey: &keyBytes,
+									Sig:       &sigBytes,
 								},
 							},
 						},
 					},
 				},
@@ -544,12 +575,12 @@ func TestInsertable(t *testing.T) {
 						Envelope: &models.IntotoV002SchemaContentEnvelope{
 							Payload:     strfmt.Base64("payload"),
 							PayloadType: swag.String("payloadType"),
 							Signatures: []*models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
 								{
-									PublicKey: strfmt.Base64([]byte("key")),
-									Sig:       strfmt.Base64([]byte("sig")),
+									PublicKey: &keyBytes,
+									Sig:       &sigBytes,
 								},
 							},
 						},
 					},
 				},
@@ -565,11 +596,11 @@ func TestInsertable(t *testing.T) {
 						Envelope: &models.IntotoV002SchemaContentEnvelope{
 							Payload:     strfmt.Base64("payload"),
 							PayloadType: swag.String("payloadType"),
 							Signatures: []*models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
 								{
-									PublicKey: strfmt.Base64([]byte("key")),
+									PublicKey: &keyBytes,
 									//Sig:       strfmt.Base64([]byte("sig")),
 								},
 							},
 						},
 					},
@@ -587,11 +618,11 @@ func TestInsertable(t *testing.T) {
 							Payload:     strfmt.Base64("payload"),
 							PayloadType: swag.String("payloadType"),
 							Signatures: []*models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
 								{
 									//PublicKey: strfmt.Base64([]byte("key")),
-									Sig: strfmt.Base64([]byte("sig")),
+									Sig: &sigBytes,
 								},
 							},
 						},
 					},
 				},
@@ -631,12 +662,12 @@ func TestInsertable(t *testing.T) {
 						Envelope: &models.IntotoV002SchemaContentEnvelope{
 							Payload: strfmt.Base64("payload"),
 							//PayloadType: swag.String("payloadType"),
 							Signatures: []*models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
 								{
-									PublicKey: strfmt.Base64([]byte("key")),
-									Sig:       strfmt.Base64([]byte("sig")),
+									PublicKey: &keyBytes,
+									Sig:       &sigBytes,
 								},
 							},
 						},
 					},
 				},
@@ -652,12 +683,12 @@ func TestInsertable(t *testing.T) {
 						Envelope: &models.IntotoV002SchemaContentEnvelope{
 							//Payload:     strfmt.Base64("payload"),
 							PayloadType: swag.String("payloadType"),
 							Signatures: []*models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
 								{
-									PublicKey: strfmt.Base64([]byte("key")),
-									Sig:       strfmt.Base64([]byte("sig")),
+									PublicKey: &keyBytes,
+									Sig:       &sigBytes,
 								},
 							},
 						},
 					},
 				},
diff --git a/pkg/types/intoto/v0.0.2/intoto_v0_0_2_schema.json b/pkg/types/intoto/v0.0.2/intoto_v0_0_2_schema.json
index 9153b0a2..3c404a30 100644
--- a/pkg/types/intoto/v0.0.2/intoto_v0_0_2_schema.json
+++ b/pkg/types/intoto/v0.0.2/intoto_v0_0_2_schema.json
@@ -42,11 +42,12 @@
                                     "publicKey": {
                                         "description": "public key that corresponds to this signature",
                                         "type": "string",
                                         "format": "byte"
                                     }
-                                }
+                                },
+                                "required": ["sig", "publicKey"]
                             }
                         }
                     },
                     "required": ["payloadType", "signatures"]
                 },

Vulnerable code: 	PublicKey strfmt.Base64 `json:"publicKey,omitempty"`
	Sig strfmt.Base64 `json:"sig,omitempty"`
		keyObj, err := x509.NewPublicKey(bytes.NewReader(sig.PublicKey))
	for _, sig := range v.IntotoObj.Content.Envelope.Signatures {
			Sig:   string(sig.Sig),
		allPubKeyBytes = append(allPubKeyBytes, sig.PublicKey)
			Sig:       strfmt.Base64([]byte(sig.Sig)),
			PublicKey: keyBytes,
	return x509.NewPublicKey(bytes.NewReader(v.IntotoObj.Content.Envelope.Signatures[0].PublicKey))
		if len(sig.Sig) == 0 {
		if len(sig.PublicKey) == 0 {
			Sig:       strfmt.Base64([]byte(sig.Sig)),
			PublicKey: strfmt.Base64(pub[i]),
					keyHash := sha256.Sum256(sig.PublicKey)
				keyHash := sha256.Sum256(sig.PublicKey)
									PublicKey: strfmt.Base64([]byte("key")),
									Sig:       strfmt.Base64([]byte("sig")),
									PublicKey: strfmt.Base64([]byte("key")),
									Sig:       strfmt.Base64([]byte("sig")),
									PublicKey: strfmt.Base64([]byte("key")),
									Sig: strfmt.Base64([]byte("sig")),
									PublicKey: strfmt.Base64([]byte("key")),
									Sig:       strfmt.Base64([]byte("sig")),
									PublicKey: strfmt.Base64([]byte("key")),
									Sig:       strfmt.Base64([]byte("sig")),
                                }
Fixed code: 	// Required: true
	PublicKey *strfmt.Base64 `json:"publicKey"`
	// Required: true
	Sig *strfmt.Base64 `json:"sig"`
	var res []error

	if err := m.validatePublicKey(formats); err != nil {
		res = append(res, err)
	}

	if err := m.validateSig(formats); err != nil {
		res = append(res, err)
	}

	if len(res) > 0 {
		return errors.CompositeValidationError(res...)
	}
	return nil
}

func (m *IntotoV002SchemaContentEnvelopeSignaturesItems0) validatePublicKey(formats strfmt.Registry) error {

	if err := validate.Required("publicKey", "body", m.PublicKey); err != nil {
		return err
	}

	return nil
}

func (m *IntotoV002SchemaContentEnvelopeSignaturesItems0) validateSig(formats strfmt.Registry) error {

	if err := validate.Required("sig", "body", m.Sig); err != nil {
		return err
	}

      "required": [
        "sig",
        "publicKey"
      ],
		if sig == nil || sig.Verifier == nil {
			return result, errors.New("missing or malformed public key")
		}
		if publicKey == nil {
			return errors.New("an invalid null verifier was provided in ProposedContent")
		}

	validEnv := envelope(t, key, []byte("payload"))
	validEnvBytes, _ := json.Marshal(validEnv)

		{
			env:  validEnv,
			name: "null verifier in array",
			it: &models.DSSEV001Schema{
				ProposedContent: &models.DSSEV001SchemaProposedContent{
					Envelope:  swag.String(string(validEnvBytes)),
					Verifiers: []strfmt.Base64{pub, nil},
				},
			},
			wantErr: true,
		},
	"golang.org/x/exp/slices"
		if sig == nil || sig.PublicKey == nil {
			return result, errors.New("malformed or missing signature")
		}
		keyObj, err := x509.NewPublicKey(bytes.NewReader(*sig.PublicKey))
	for i, sig := range v.IntotoObj.Content.Envelope.Signatures {
		if sig == nil {
			v.IntotoObj.Content.Envelope.Signatures = slices.Delete(v.IntotoObj.Content.Envelope.Signatures, i, i)
			continue
		}
			Sig:   string(*sig.Sig),
		allPubKeyBytes = append(allPubKeyBytes, *sig.PublicKey)
		sigBytes := strfmt.Base64([]byte(sig.Sig))
			Sig:       &sigBytes,
			PublicKey: &keyBytes,
	return x509.NewPublicKey(bytes.NewReader(*v.IntotoObj.Content.Envelope.Signatures[0].PublicKey))
		if sig == nil {
			return false, errors.New("missing signature entry")
		}
		if sig.Sig == nil || len(*sig.Sig) == 0 {
		if sig.PublicKey == nil || len(*sig.PublicKey) == 0 {
		keyBytes := strfmt.Base64(pub[i])
		sigBytes := strfmt.Base64([]byte(sig.Sig))
			Sig:       &sigBytes,
			PublicKey: &keyBytes,
	keyBytes := strfmt.Base64("key")
	sigBytes := strfmt.Base64("sig")
		{
			env:  envelope(t, key, []byte(validPayload)),
			name: "null array entry",
			it: &models.IntotoV002Schema{
				Content: &models.IntotoV002SchemaContent{
					Envelope: &models.IntotoV002SchemaContentEnvelope{
						Payload:     strfmt.Base64("cGF5bG9hZAo="),
						PayloadType: swag.String("payloadType"),
						Signatures: []*models.IntotoV002SchemaContentEnvelopeSignaturesItems0{
							{
								PublicKey: &keyBytes,
								Sig:       &sigBytes,
							},
							nil,
						},
					},
					Hash: &models.IntotoV002SchemaContentHash{
						Algorithm: swag.String(models.IntotoV002SchemaContentHashAlgorithmSha256),
						Value:     swag.String(envelopeHash(t, envelope(t, key, []byte(validPayload)))),
					},
				},
			},
			wantErr:         true,
			wantVerifierErr: true,
		},
					keyHash := sha256.Sum256(*sig.PublicKey)
				keyHash := sha256.Sum256(*sig.PublicKey)
	keyBytes := strfmt.Base64([]byte("key"))
	sigBytes := strfmt.Base64([]byte("sig"))
									PublicKey: &keyBytes,
									Sig:       &sigBytes,
									PublicKey: &keyBytes,
									Sig:       &sigBytes,
									PublicKey: &keyBytes,
									Sig: &sigBytes,
									PublicKey: &keyBytes,
									Sig:       &sigBytes,
									PublicKey: &keyBytes,
									Sig:       &sigBytes,
                                },
                                "required": ["sig", "publicKey"]