<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">You’ll be amused to find out that the code that generated the Rekor TS cert has been changed to use digitalSignature as its KU. <a href="https://github.com/sigstore/rekor/pull/504/files">https://github.com/sigstore/rekor/pull/504/files</a><div><br></div><div>I think the change you made is correct, but you probably won’t see a nonRepudiation bit for a while again. Mike<br><br><div dir="ltr">Sent from my iPad</div><div dir="ltr"><br><blockquote type="cite">On Nov 17, 2021, at 15:09, Weijun Wang <weijun@openjdk.java.net> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><span>On Tue, 16 Nov 2021 19:36:11 GMT, Weijun Wang <weijun@openjdk.org> wrote:</span><br><span></span><br><blockquote type="cite"><span>There is no need to check for the KeyUsage extension when validating a TSA certificate.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>A test is modified where a TSA cert has a KeyUsage but without the DigitalSignature bit.</span><br></blockquote><span></span><br><span>This pull request has now been integrated.</span><br><span></span><br><span>Changeset: 262d0700</span><br><span>Author: Weijun Wang <weijun@openjdk.org></span><br><span>URL: https://git.openjdk.java.net/jdk/commit/262d07001babcbe7f9acd2053aa3b7bac304cf85</span><br><span>Stats: 6 lines in 2 files changed: 3 ins; 0 del; 3 mod</span><br><span></span><br><span>8277246: Check for NonRepudiation as well when validating a TSA certificate</span><br><span></span><br><span>Reviewed-by: xuelei, mullan</span><br><span></span><br><span>-------------</span><br><span></span><br><span>PR: https://git.openjdk.java.net/jdk/pull/6416</span><br></div></blockquote></div></body></html>