fix: leaf certificate validation (#202)

Signed-off-by: Patrick Zheng <patrickzheng@microsoft.com>
notaryproject · Apr 18, 2024 · 356b30e · 356b30e
1 parent 9f13c9e
commit 356b30e
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 4 deletions.
diff --git a/x509/cert_validations.go b/x509/cert_validations.go
@@ -186,9 +186,6 @@ func validateLeafKeyUsage(cert *x509.Certificate) error {
 	}
 
 	var invalidKeyUsages []string
-	if cert.KeyUsage&x509.KeyUsageContentCommitment != 0 {
-		invalidKeyUsages = append(invalidKeyUsages, `"ContentCommitment"`)
-	}
 	if cert.KeyUsage&x509.KeyUsageKeyEncipherment != 0 {
 		invalidKeyUsages = append(invalidKeyUsages, `"KeyEncipherment"`)
 	}

diff --git a/x509/cert_validations_test.go b/x509/cert_validations_test.go
@@ -759,7 +759,7 @@ func TestValidateLeafKeyUsage(t *testing.T) {
 				KeyUsage:   x509.KeyUsageDigitalSignature | x509.KeyUsageContentCommitment,
 				Extensions: extensions,
 			},
-			expectedErrMsg: "The certificate with subject \"CN=Test CN\" is invalid. The key usage must be \"Digital Signature\" only, but found \"ContentCommitment\"",
+			expectedErrMsg: "",
 		},
 		{
 			name: "Missing DigitalSignature usage",