From b15eb28b234687affd3b16d12c0b743b84749ec0 Mon Sep 17 00:00:00 2001 From: Andrew Pan <3821575+tnytown@users.noreply.github.com> Date: Wed, 17 Jun 2026 16:39:26 -0400 Subject: [PATCH] Merge commit from fork Signed-off-by: Andrew Pan --- lib/sigstore/verifier.rb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/sigstore/verifier.rb b/lib/sigstore/verifier.rb index f55c652..12e1df6 100644 --- a/lib/sigstore/verifier.rb +++ b/lib/sigstore/verifier.rb @@ -93,9 +93,12 @@ def verify(input:, policy:, offline:) end end - Internal::SET.verify_set(keyring: @rekor_keyring, entry:) if entry.inclusion_promise + if entry.inclusion_promise + Internal::SET.verify_set(keyring: @rekor_keyring, entry:) + timestamps << Time.at(entry.integrated_time).utc + end - timestamps << Time.at(entry.integrated_time).utc + return VerificationFailure.new("No verified timestamp") if timestamps.empty? # 3) # The Verifier MUST perform certification path validation (RFC 5280 ยง6) of the certificate chain with the