From a3ca21b53978d4ee6901c35463a4bbb2aec5ae71 Mon Sep 17 00:00:00 2001 From: Ricardo Arenas Date: Thu, 19 Nov 2020 08:19:13 -0800 Subject: [PATCH] Remove the certificate allowlist for nupkg verification. --- .../Microsoft.SignCheck/Verification/NupkgVerifier.cs | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/src/SignCheck/Microsoft.SignCheck/Verification/NupkgVerifier.cs b/src/SignCheck/Microsoft.SignCheck/Verification/NupkgVerifier.cs index a966f7657d6..d87e20fc96d 100644 --- a/src/SignCheck/Microsoft.SignCheck/Verification/NupkgVerifier.cs +++ b/src/SignCheck/Microsoft.SignCheck/Verification/NupkgVerifier.cs @@ -14,12 +14,6 @@ namespace Microsoft.SignCheck.Verification { public class NupkgVerifier : ArchiveVerifier { - private static List AllowListEntries = new List() - { - new CertificateHashAllowListEntry(VerificationTarget.Author | VerificationTarget.Repository, SignaturePlacement.PrimarySignature, "3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE", HashAlgorithmName.SHA256), - new CertificateHashAllowListEntry(VerificationTarget.Author | VerificationTarget.Repository, SignaturePlacement.PrimarySignature, "0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D", HashAlgorithmName.SHA256) - }; - public NupkgVerifier(Log log, Exclusions exclusions, SignatureVerificationOptions options) : base(log, exclusions, options, fileExtension: ".nupkg") { @@ -42,7 +36,7 @@ private bool IsSigned(string path) IEnumerable providers = SignatureVerificationProviderFactory.GetSignatureVerificationProviders(); var packageSignatureVerifier = new PackageSignatureVerifier(providers); - var verifierSettings = SignedPackageVerifierSettings.GetVerifyCommandDefaultPolicy(clientAllowListEntries: AllowListEntries); + var verifierSettings = SignedPackageVerifierSettings.GetVerifyCommandDefaultPolicy(); IEnumerable verificationProviders = SignatureVerificationProviderFactory.GetSignatureVerificationProviders(); var verifier = new PackageSignatureVerifier(verificationProviders);