Honor custom signer identities during chain evaluation
Shared one verifier configuration across the source tool and GitHub backend so valid custom workflow identities are not discarded during chain construction.
slsa-framework/source-tool · #439
Supply-chain verification fix
Configured signer identities now apply consistently to both top-level attestations and GitHub provenance-chain evaluation.
Problem
Top-level verification honored a configured issuer and subject alternative name, but the GitHub backend created a default verifier while evaluating the chain. Valid attestations signed by a custom workflow identity could therefore be treated as absent and prevent the expected source-level result.
Approach
Passes the optional verifier configuration into the backend and reuses it for chain evaluation. Default and nil configurations retain the existing default identity policy.
Impact and scope
- Makes custom identity policy consistent across every verification stage instead of only the initial attestation check.
- Allows previously valid provenance and verification-summary attestations to participate in source evaluation under the configured trust policy.
- Does not broaden the default trust policy or claim a particular production SLSA level without an independently evaluated artifact chain.
Validation
- Regression coverage verifies custom identities, default behavior, and nil configuration across the GitHub backend and source-tool construction path.
- The full Go test suite, selected race tests, go vet, golangci-lint, and formatting checks passed.
- All four hosted checks passed, the linked issue is closed, and the verified merge commit credits Goutam Adwant.