signature/pkcs7: tighten validation per Copilot review

- ParseEnvelope rejects non-1 signer count and empty EncryptedDigest
- validateSignRequest rejects empty Payload.Content (matches base.Envelope)
- verifySignerOutput guards against nil leaf certificate
- signerAdapter.Sign returns error instead of panicking on second call
- Content().Payload.ContentType is empty (PKCS#7 detached doesn't carry it)
- add tests for new validation checks

Signed-off-by: Dallas Delaney <dadelan@microsoft.com>

Author: dallasd1

signature/pkcs7/envelope.go

@@ -74,9 +74,15 @@ func ParseEnvelope(envelopeBytes []byte) (env signature.Envelope, err error) {
 		return nil, &signature.InvalidSignatureError{Msg: err.Error()}
 	}
 
-	var sigBytes []byte
-	if len(p7.Signers) > 0 {
-		sigBytes = p7.Signers[0].EncryptedDigest
+	// dm-verity profile: exactly one signer with a non-empty signature.
+	if len(p7.Signers) != 1 {
+		return nil, &signature.InvalidSignatureError{
+			Msg: fmt.Sprintf("dm-verity PKCS#7 envelope requires exactly one signer; got %d", len(p7.Signers)),
+		}
+	}
+	sigBytes := p7.Signers[0].EncryptedDigest
+	if len(sigBytes) == 0 {
+		return nil, &signature.InvalidSignatureError{Msg: "dm-verity PKCS#7 envelope has empty signature"}
 	}
 
 	return &envelope{
@@ -142,9 +148,12 @@ func (e *envelope) Sign(req *signature.SignRequest) ([]byte, error) {
 	return encoded, nil
 }
 
-// validateSignRequest enforces the dm-verity profile: no signed-attribute
-// fields, RSA-2048 key only.
+// validateSignRequest enforces the dm-verity profile: non-empty payload,
+// no signed-attribute fields, RSA-2048 key only.
 func validateSignRequest(req *signature.SignRequest) error {
+	if len(req.Payload.Content) == 0 {
+		return &signature.InvalidSignRequestError{Msg: "dm-verity PKCS#7 envelope requires a non-empty Payload.Content"}
+	}
 	if !req.SigningTime.IsZero() {
 		return &signature.InvalidSignRequestError{Msg: "dm-verity PKCS#7 envelope does not support SigningTime"}
 	}
@@ -189,6 +198,9 @@ func verifySignerOutput(payload, sig []byte, certs []*x509.Certificate) error {
 	if len(certs) == 0 {
 		return &signature.InvalidSignatureError{Msg: "no certificates returned from signer"}
 	}
+	if certs[0] == nil {
+		return &signature.InvalidSignatureError{Msg: "signer returned a nil leaf certificate"}
+	}
 	pub, ok := certs[0].PublicKey.(*rsa.PublicKey)
 	if !ok {
 		return &signature.UnsupportedSigningKeyError{
@@ -222,10 +234,10 @@ func (a *signerAdapter) Public() crypto.PublicKey {
 }
 
 // Sign returns the pre-computed signature. The digest and opts arguments
-// are ignored. Panics if called more than once.
+// are ignored. Returns an error if called more than once.
 func (a *signerAdapter) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
 	if a.used {
-		panic("pkcs7: signerAdapter.Sign called more than once")
+		return nil, errors.New("pkcs7: signerAdapter.Sign called more than once")
 	}
 	a.used = true
 	return a.sig, nil
@@ -253,9 +265,10 @@ func (e *envelope) Content() (*signature.EnvelopeContent, error) {
 			CertificateChain: e.certs,
 			Signature:        e.sigBytes,
 		},
-		Payload: signature.Payload{
-			ContentType: MediaTypeEnvelope,
-		},
+		// Payload.ContentType identifies the signed payload's media type,
+		// not the envelope format. PKCS#7 detached signatures don't carry
+		// the payload's content type, so it is unknown after parsing.
+		Payload: signature.Payload{},
 	}, nil
 }
 

signature/pkcs7/envelope_test.go

@@ -25,6 +25,7 @@ import (
 
 	"github.com/notaryproject/notation-core-go/signature"
 	"github.com/notaryproject/notation-core-go/testhelper"
+	gopkcs7 "go.mozilla.org/pkcs7"
 )
 
 const testPayload = "test dm-verity root hash payload"
@@ -94,8 +95,10 @@ func TestSignParseVerifyRoundTrip(t *testing.T) {
 	if len(content.SignerInfo.CertificateChain) == 0 {
 		t.Fatal("Content() returned no certificates")
 	}
-	if content.Payload.ContentType != MediaTypeEnvelope {
-		t.Fatalf("ContentType = %q, want %q", content.Payload.ContentType, MediaTypeEnvelope)
+	// PKCS#7 detached signatures don't carry the signed payload's content
+	// type, so Content() reports it as unknown.
+	if content.Payload.ContentType != "" {
+		t.Fatalf("ContentType = %q, want empty", content.Payload.ContentType)
 	}
 }
 
@@ -259,3 +262,68 @@ func (s *customSignSigner) Sign(payload []byte) ([]byte, []*x509.Certificate, er
 	return sig, s.certs, nil
 }
 func (s *customSignSigner) KeySpec() (signature.KeySpec, error) { return s.keySpec, nil }
+
+// TestSignRejectsEmptyPayload verifies that an empty Payload.Content is
+// rejected with InvalidSignRequestError.
+func TestSignRejectsEmptyPayload(t *testing.T) {
+	req := newSignRequest()
+	req.Payload.Content = nil
+	_, err := NewEnvelope().Sign(req)
+	var want *signature.InvalidSignRequestError
+	if !errors.As(err, &want) {
+		t.Fatalf("want InvalidSignRequestError, got %T: %v", err, err)
+	}
+}
+
+// TestSignRejectsNilLeafCertificate verifies that a signer returning a
+// nil leaf certificate is rejected with InvalidSignatureError.
+func TestSignRejectsNilLeafCertificate(t *testing.T) {
+	base := newRSATestSigner()
+	req := &signature.SignRequest{
+		Payload: signature.Payload{ContentType: MediaTypeEnvelope, Content: []byte(testPayload)},
+		Signer: &customSignSigner{
+			certs:   []*x509.Certificate{nil, base.certs[1]},
+			keySpec: base.keySpec,
+			sign: func(payload []byte) ([]byte, error) {
+				h := sha256.Sum256(payload)
+				return rsa.SignPKCS1v15(rand.Reader, base.key.(*rsa.PrivateKey), crypto.SHA256, h[:])
+			},
+		},
+	}
+	_, err := NewEnvelope().Sign(req)
+	var want *signature.InvalidSignatureError
+	if !errors.As(err, &want) {
+		t.Fatalf("want InvalidSignatureError, got %T: %v", err, err)
+	}
+}
+
+// TestParseEnvelopeRejectsMultipleSigners verifies that the dm-verity
+// profile's "exactly one signer" guard fires on multi-signer envelopes.
+// Empty-EncryptedDigest is also exercised by FuzzSignaturePkcs7.
+func TestParseEnvelopeRejectsMultipleSigners(t *testing.T) {
+	tuple := testhelper.GetRSACertTuple(2048)
+	sd, err := gopkcs7.NewSignedData([]byte(testPayload))
+	if err != nil {
+		t.Fatalf("NewSignedData() error: %v", err)
+	}
+	sd.SetDigestAlgorithm(gopkcs7.OIDDigestAlgorithmSHA256)
+	sd.SetEncryptionAlgorithm(gopkcs7.OIDEncryptionAlgorithmRSA)
+	cfg := gopkcs7.SignerInfoConfig{}
+	if err := sd.SignWithoutAttr(tuple.Cert, tuple.PrivateKey, cfg); err != nil {
+		t.Fatalf("SignWithoutAttr() #1 error: %v", err)
+	}
+	if err := sd.SignWithoutAttr(tuple.Cert, tuple.PrivateKey, cfg); err != nil {
+		t.Fatalf("SignWithoutAttr() #2 error: %v", err)
+	}
+	sd.Detach()
+	encoded, err := sd.Finish()
+	if err != nil {
+		t.Fatalf("Finish() error: %v", err)
+	}
+
+	_, err = ParseEnvelope(encoded)
+	var want *signature.InvalidSignatureError
+	if !errors.As(err, &want) {
+		t.Fatalf("want InvalidSignatureError, got %T: %v", err, err)
+	}
+}