self-signed leaf cert validation issue

[JeyJeyGao]

We didn’t check the issuer of the self-signed leaf certificate. The self-signed leaf certificate should also be self-issued.

notation-core-go/x509/cert_validations.go

Lines 46 to 58 in d336b6a

	if len(certChain) == 1 {
	cert := certChain[0]
	if signingTime != nil && (signingTime.Before(cert.NotBefore) || signingTime.After(cert.NotAfter)) {
	return fmt.Errorf("certificate with subject %q was not valid at signing time of %s", cert.Subject, signingTime.UTC())
	}
	if err := cert.CheckSignature(cert.SignatureAlgorithm, cert.RawTBSCertificate, cert.Signature); err != nil {
	return fmt.Errorf("invalid self-signed certificate. subject: %q. Error: %w", cert.Subject, err)
	}
	if err := validateLeafCertificate(cert, expectedLeafEku); err != nil {
	return fmt.Errorf("invalid self-signed certificate. Error: %w", err)
	}
	return nil
	}

[github-actions]

This issue is stale because it has been opened for 60 days with no activity. Remove stale label or comment. Otherwise, it will be closed in 30 days.

[yizha1]

@JeyJeyGao is this still a valid issue?

[JeyJeyGao]

We can close it now.