Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
245	0	EP	call site: 00000	model_signing.verifying.Config.verify

1


           atheris.FuzzedDataProvider

[function] [call site] 00001

1


           fdp.ConsumeIntInRange

[function] [call site] 00002

1


           fdp.ConsumeBytes

[function] [call site] 00003

1


           tempfile.TemporaryDirectory

[function] [call site] 00004

1


           tempfile.TemporaryDirectory

[function] [call site] 00005

1


           pathlib.Path

[function] [call site] 00006

1


           utils.create_fuzz_files

[function] [call site] 00007

1


           utils.any_files

[function] [call site] 00008

1


           <builtin>.str

[function] [call site] 00009

1


           os.path.join

[function] [call site] 00010

1


           utils._build_hashing_config_from_fdp

[function] [call site] 00011

1


           scfg.set_hashing_config

[function] [call site] 00012

1


           scfg.use_elliptic_key_signer

[function] [call site] 00013

1


           signer.sign

[function] [call site] 00014

1


           os.path.join

[function] [call site] 00015

1


           <builtin>.open

[function] [call site] 00016

1


           f.write

[function] [call site] 00017

1


           model_signing.verifying.Config.__init__

[function] [call site] 00018

1


           model_signing.verifying.Config.set_hashing_config

[function] [call site] 00019

1


           model_signing.verifying.Config.use_elliptic_key_verifier

[function] [call site] 00020

2


             pathlib.Path

[function] [call site] 00021

2


             model_signing._signing.sign_ec_key.Verifier.__init__

[function] [call site] 00022

3


               public_key_path.read_bytes

[function] [call site] 00023

3


               model_signing._signing.sign_ec_key._check_supported_ec_key

[function] [call site] 00024

1


           model_signing.verifying.Config.verify

[function] [call site] 00025

2


             pathlib.Path

[function] [call site] 00026

2


             model_signing._signing.sign_sigstore.Signature.read

[function] [call site] 00027

3


               path.read_text

[function] [call site] 00028

3


               sigstore.models.Bundle.from_json

[function] [call site] 00029

4


                 sigstore_models.bundle.v1.Bundle.from_json

[function] [call site] 00030

4


                 sigstore.models.Bundle.__init__

[function] [call site] 00031

5


                   sigstore.models.Bundle._verify

[function] [call site] 00032

6


                     enum.Enum.__init__

[function] [call site] 00033

6


                     cryptography.hazmat.bindings._rust.x509.load_der_x509_certificate

[function] [call site] 00034

6


                     cryptography.hazmat.bindings._rust.x509.load_der_x509_certificate

[function] [call site] 00035

6


                     sigstore._utils.cert_is_leaf

[function] [call site] 00036

7


                       sigstore._utils.cert_is_ca

[function] [call site] 00037

8


                         cert.extensions.get_extension_for_oid

[function] [call site] 00038

8


                         cert.extensions.get_extension_for_oid

[function] [call site] 00039

7


                       cert.extensions.get_extension_for_oid

[function] [call site] 00040

7


                       cert.extensions.get_extension_for_oid

[function] [call site] 00041

6


                     sigstore._utils.cert_is_root_ca

[function] [call site] 00042

7


                       sigstore._utils.cert_is_ca

[function] [call site] 00043

7


                       cert.verify_directly_issued_by

[function] [call site] 00044

6


                     _logger.warning

[function] [call site] 00045

6


                     <builtin>.len

[function] [call site] 00046

6


                     sigstore.models.TransparencyLogEntry.__init__

[function] [call site] 00047

7


                       sigstore.models.TransparencyLogEntry._validate

[function] [call site] 00048

6


                     _logger.debug

[function] [call site] 00049

3


               model_signing._signing.sign_sigstore.Signature.__init__

[function] [call site] 00050

2


             pathlib.Path

[function] [call site] 00051

2


             model_signing._signing.sign_sigstore_pb.Signature.read

[function] [call site] 00052

3


               path.read_text

[function] [call site] 00053

3


               json.loads

[function] [call site] 00054

3


               sigstore_models.bundle.v1.Bundle.from_dict

[function] [call site] 00055

3


               model_signing._signing.sign_sigstore_pb.Signature.__init__

[function] [call site] 00056

2


             model_signing._signing.signing.Verifier.verify

[function] [call site] 00057

3


               model_signing._signing.sign_sigstore.Verifier._verify_signed_content

[function] [call site] 00058

4


                 typing.cast

[function] [call site] 00059

4


                 sigstore.verify.verifier.Verifier.verify_dsse

[function] [call site] 00060

5


                   sigstore.verify.verifier.Verifier._verify_common_signing_cert

[function] [call site] 00061

6


                     OpenSSL.crypto.X509Store

[function] [call site] 00062

6


                     OpenSSL.crypto.X509Store.set_flags

[function] [call site] 00063

6


                     OpenSSL.crypto.X509Store.add_cert

[function] [call site] 00064

6


                     sigstore.verify.verifier.Verifier._establish_time

[function] [call site] 00065

7


                       sigstore.verify.verifier.Verifier._verify_timestamp_authority

[function] [call site] 00066

8


                         <builtin>.len

[function] [call site] 00067

8


                         <builtin>.len

[function] [call site] 00068

8


                         <builtin>.set

[function] [call site] 00069

8


                         <builtin>.len

[function] [call site] 00070

8


                         <builtin>.len

[function] [call site] 00071

8


                         sigstore.verify.verifier.Verifier._verify_signed_timestamp

[function] [call site] 00072

9


                           certificate_authority.certificates

[function] [call site] 00073

9


                           <builtin>.len

[function] [call site] 00074

9


                           _logger.debug

[function] [call site] 00075

9


                           rfc3161_client.VerifierBuilder

[function] [call site] 00076

9


                           rfc3161_client.VerifierBuilder.tsa_certificate

[function] [call site] 00077

9


                           builder.add_intermediate_certificate

[function] [call site] 00078

9


                           builder.build

[function] [call site] 00079

9


                           verifier.verify_message

[function] [call site] 00080

9


                           _logger.debug

[function] [call site] 00081

9


                           _logger.debug

[function] [call site] 00082

7


                       verified_timestamps.extend

[function] [call site] 00083

7


                       verified_timestamps.append

[function] [call site] 00084

7


                       datetime.datetime.fromtimestamp

[function] [call site] 00085

6


                     <builtin>.len

[function] [call site] 00086

6


                     OpenSSL.crypto.X509.from_cryptography

[function] [call site] 00087

6


                     sigstore.verify.verifier.Verifier._verify_chain_at_time

[function] [call site] 00088

7


                       OpenSSL.crypto.X509Store

[function] [call site] 00089

7


                       OpenSSL.crypto.X509Store.set_flags

[function] [call site] 00090

7


                       OpenSSL.crypto.X509Store.add_cert

[function] [call site] 00091

7


                       OpenSSL.crypto.X509Store.set_time

[function] [call site] 00092

7


                       OpenSSL.crypto.X509StoreContext

[function] [call site] 00093

7


                       OpenSSL.crypto.X509StoreContext.get_verified_chain

[function] [call site] 00094

6


                     sigstore._internal.sct.verify_sct

[function] [call site] 00095

7


                       sigstore._internal.sct._get_signed_certificate_timestamp

[function] [call site] 00096

8


                         typing.cast.bundle.signing_certificate.extensions.get_extension_for_class

[function] [call site] 00097

8


                         <builtin>.len

[function] [call site] 00098

7


                       sigstore._internal.sct._get_issuer_cert

[function] [call site] 00099

8


                         sigstore._internal.sct._is_preissuer

[function] [call site] 00100

9


                           issuer.extensions.get_extension_for_class

[function] [call site] 00101

7


                       issuer_cert.public_key

[function] [call site] 00102

7


                       sigstore._internal.sct._cert_is_ca

[function] [call site] 00103

8


                         _logger.debug

[function] [call site] 00104

8


                         sigstore._utils.cert_is_ca

[function] [call site] 00105

8


                         _logger.debug

[function] [call site] 00106

7


                       <builtin>.isinstance

[function] [call site] 00107

7


                       sigstore._utils.key_id

[function] [call site] 00108

8


                         key.public_bytes

[function] [call site] 00109

8


                         hashlib.sha256

[function] [call site] 00110

8


                         typing.NewType

[function] [call site] 00111

7


                       sigstore._internal.sct._pack_digitally_signed

[function] [call site] 00112

8


                         <builtin>.len

[function] [call site] 00113

8


                         sigstore._internal.sct._pack_signed_entry

[function] [call site] 00114

9


                           typing.cast.bundle.signing_certificate.public_bytes

[function] [call site] 00115

9


                           <builtin>.len

[function] [call site] 00116

9


                           fields.append

[function] [call site] 00117

9


                           struct.unpack

[function] [call site] 00118

9


                           <builtin>.len

[function] [call site] 00119

9


                           struct.pack

[function] [call site] 00120

9


                           <builtin>.len

[function] [call site] 00121

9


                           pack_format.format

[function] [call site] 00122

9


                           fields.extend

[function] [call site] 00123

9


                           struct.pack

[function] [call site] 00124

8


                         <builtin>.len

[function] [call site] 00125

8


                         sct.timestamp.replace

[function] [call site] 00126

8


                         struct.pack

[function] [call site] 00127

8


                         timestamp.timestamp

[function] [call site] 00128

8


                         <builtin>.int

[function] [call site] 00129

8


                         <builtin>.len

[function] [call site] 00130

7


                       <builtin>.isinstance

[function] [call site] 00131

7


                       sct.log_id.hex

[function] [call site] 00132

7


                       _logger.debug

[function] [call site] 00133

7


                       ct_keyring.verify

[function] [call site] 00134

7


                       typing.NewType

[function] [call site] 00135

6


                     parent_cert.to_cryptography

[function] [call site] 00136

6


                     typing.cast.bundle.signing_certificate.extensions.get_extension_for_class

[function] [call site] 00137

6


                     typing.cast.bundle.signing_certificate.extensions.get_extension_for_class

[function] [call site] 00138

6


                     sigstore.verify.policy.Identity.verify

[function] [call site] 00139

7


                       sigstore.verify.policy._SingleX509ExtPolicy.verify

[function] [call site] 00140

8


                         typing.cast.bundle.signing_certificate.extensions.get_extension_for_oid

[function] [call site] 00141

8


                         ext.value.decode

[function] [call site] 00142

7


                       typing.cast.bundle.signing_certificate.extensions.get_extension_for_class

[function] [call site] 00143

7


                       san_ext.get_values_for_type

[function] [call site] 00144

7


                       <builtin>.set

[function] [call site] 00145

7


                       san_ext.get_values_for_type

[function] [call site] 00146

7


                       all_sans.update

[function] [call site] 00147

7


                       all_sans.update

[function] [call site] 00148

7


                       on.value.decode

[function] [call site] 00149

7


                       san_ext.get_values_for_type

[function] [call site] 00150

6


                     _logger.debug

[function] [call site] 00151

6


                     typing.cast.bundle.log_entry._verify

[function] [call site] 00152

5


                   typing.cast.bundle.signing_certificate.public_key

[function] [call site] 00153

5


                   typing.cast

[function] [call site] 00154

5


                   sigstore.dsse._verify

[function] [call site] 00155

6


                     sigstore.dsse._pae

[function] [call site] 00156

7


                       <builtin>.len

[function] [call site] 00157

6


                     <builtin>.len

[function] [call site] 00158

6


                     cryptography.hazmat.primitives.asymmetric.ec.ECDSA.__init__

[function] [call site] 00159

7


                       cryptography.hazmat.backends.openssl.backend.Backend.ecdsa_deterministic_supported

[function] [call site] 00160

6


                     typing.cast.verify

[function] [call site] 00161

5


                   sigstore.verify.verifier._validate_dsse_v002_entry_body

[function] [call site] 00162

6


                     sigstore_models.rekor.v2.entry.Entry.from_json

[function] [call site] 00163

6


                     sigstore._utils.sha256_digest

[function] [call site] 00164

7


                       <builtin>.isinstance

[function] [call site] 00165

7


                       <builtin>.isinstance

[function] [call site] 00166

7


                       hashlib.sha256

[function] [call site] 00167

7


                       sigstore._utils._sha256_streaming

[function] [call site] 00168

8


                         hashlib.sha256

[function] [call site] 00169

8


                         <builtin>.bytearray

[function] [call site] 00170

8


                         <builtin>.memoryview

[function] [call site] 00171

8


                         io.readinto

[function] [call site] 00172

8


                         sha256.update

[function] [call site] 00173

8


                         io.readinto

[function] [call site] 00174

8


                         sha256.digest

[function] [call site] 00175

6


                     sigstore_models.rekor.v2.verifier.Signature

[function] [call site] 00176

6


                     base64.b64encode

[function] [call site] 00177

6


                     sigstore.verify.verifier._v2_verifier_from_certificate

[function] [call site] 00178

7


                       typing.cast.bundle.signing_certificate.public_key

[function] [call site] 00179

7


                       <builtin>.isinstance

[function] [call site] 00180

7


                       <builtin>.isinstance

[function] [call site] 00181

7


                       <builtin>.isinstance

[function] [call site] 00182

7


                       <builtin>.isinstance

[function] [call site] 00183

7


                       sigstore_models.rekor.v2.verifier.Verifier

[function] [call site] 00184

7


                       sigstore_models.common.v1.X509Certificate

[function] [call site] 00185

7


                       base64.b64encode

[function] [call site] 00186

7


                       typing.cast.bundle.signing_certificate.public_bytes

[function] [call site] 00187

5


                   sigstore.verify.verifier._validate_dsse_v001_entry_body

[function] [call site] 00188

6


                     rekor_types.Dsse.model_validate_json

[function] [call site] 00189

6


                     sigstore._utils.sha256_digest

[function] [call site] 00190

6


                     typing.cast.bundle._dsse_envelope._inner.payload.digest.hex

[function] [call site] 00191

6


                     rekor_types.dsse.Signature

[function] [call site] 00192

6


                     base64.b64encode

[function] [call site] 00193

6


                     sigstore._utils.base64_encode_pem_cert

[function] [call site] 00194

7


                       typing.NewType

[function] [call site] 00195

7


                       typing.cast.bundle.signing_certificate.public_bytes

[function] [call site] 00196

7


                       base64.b64encode

[function] [call site] 00197

3


               json.loads

[function] [call site] 00198

3


               model_signing._signing.signing.dsse_payload_to_manifest

[function] [call site] 00199

4


                 model_signing._signing.signing.dsse_payload_to_manifest_compat

[function] [call site] 00200

5


                   model_signing.manifest.SerializationType.from_args

[function] [call site] 00201

6


                     subclass._from_args

[function] [call site] 00202

5


                   bytes.fromhex

[function] [call site] 00203

5


                   serialization.new_item

[function] [call site] 00204

5


                   items.append

[function] [call site] 00205

5


                   model_signing.manifest.Manifest.__init__

[function] [call site] 00206

4


                 <builtin>.len

[function] [call site] 00207

4


                 model_signing.manifest.SerializationType.from_args

[function] [call site] 00208

4


                 model_signing._hashing.memory.SHA256.__init__

[function] [call site] 00209

5


                   hashlib.sha256

[function] [call site] 00210

4


                 bytes.fromhex

[function] [call site] 00211

4


                 model_signing._hashing.memory.SHA256.update

[function] [call site] 00212

4


                 serialization.new_item

[function] [call site] 00213

4


                 items.append

[function] [call site] 00214

4


                 model_signing._hashing.memory.SHA256.compute

[function] [call site] 00215

4


                 model_signing.manifest.Manifest.__init__

[function] [call site] 00216

2


             model_signing.verifying.Config._guess_hashing_config

[function] [call site] 00217

3


               <builtin>.frozenset

[function] [call site] 00218

3


               <builtin>.frozenset

[function] [call site] 00219

2


             utils._build_hashing_config_from_fdp.add_ignored_paths

[function] [call site] 00220

2


             model_signing.manifest.Manifest.resource_descriptors

[function] [call site] 00221

3


               <builtin>.sorted

[function] [call site] 00222

3


               <builtin>.str

[function] [call site] 00223

2


             model_signing.verifying.Config._hashing_config.hash

[function] [call site] 00224

2


             model_signing.verifying.Config._get_manifest_diff

[function] [call site] 00225

3


               actual.resource_descriptors

[function] [call site] 00226

3


               model_signing.manifest.Manifest.resource_descriptors

[function] [call site] 00227

3


               actual_hashes.keys

[function] [call site] 00228

3


               <builtin>.set

[function] [call site] 00229

3


               <builtin>.set

[function] [call site] 00230

3


               expected_hashes.keys

[function] [call site] 00231

3


               diffs.append

[function] [call site] 00232

3


               <builtin>.sorted

[function] [call site] 00233

3


               expected_hashes.keys

[function] [call site] 00234

3


               <builtin>.set

[function] [call site] 00235

3


               <builtin>.set

[function] [call site] 00236

3


               actual_hashes.keys

[function] [call site] 00237

3


               diffs.append

[function] [call site] 00238

3


               <builtin>.sorted

[function] [call site] 00239

3


               actual_hashes.keys

[function] [call site] 00240

3


               <builtin>.set

[function] [call site] 00241

3


               expected_hashes.keys

[function] [call site] 00242

3


               <builtin>.set

[function] [call site] 00243

3


               <builtin>.sorted

[function] [call site] 00244

3


               diffs.append

[function] [call site] 00245

Fuzz blockers

Fuzzer calltree