Skip to content

feat(spiffeid): accept case-insensitive scheme and normalize trust domain#376

Open
maxlambrecht wants to merge 4 commits into
spiffe:mainfrom
maxlambrecht:feat/spiffeid-case-insensitive-parse
Open

feat(spiffeid): accept case-insensitive scheme and normalize trust domain#376
maxlambrecht wants to merge 4 commits into
spiffe:mainfrom
maxlambrecht:feat/spiffeid-case-insensitive-parse

Conversation

@maxlambrecht

Copy link
Copy Markdown
Member

Summary

Aligns SPIFFE ID parsing with SPIFFE spec:

  • §2.4 SPIFFE ID parsing — Scheme and trust domain name are case-insensitive; path is case-sensitive. The parser now accepts mixed-case spiffe / authority input and canonicalizes the trust domain host to lowercase.
  • §2.1 Trust domain — The authority host must be lowercase in the canonical form; we enforce that by normalizing after parse.
  • §2.2 Path — Path rules unchanged; path bytes are preserved as provided.

…main

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>
…verage

Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>
Signed-off-by: Max Lambrecht <maxlambrecht@gmail.com>
@maxlambrecht maxlambrecht force-pushed the feat/spiffeid-case-insensitive-parse branch from e95aa4b to b8aac6e Compare April 18, 2026 20:28

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the SPIFFE ID parsing/canonicalization behavior in spiffeid to align with the SPIFFE spec by accepting case-insensitive scheme + trust domain input and emitting a canonical lowercase trust domain (while preserving path bytes/case).

Changes:

  • Accept case-insensitive spiffe:// scheme during parsing.
  • Normalize trust domain to lowercase in parsed/canonical IDs and TrustDomain parsing.
  • Expand/adjust unit tests around canonicalization behavior and additional authority/path edge cases.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
spiffeid/trustdomain.go Normalizes trust domain input to lowercase for TrustDomainFromString.
spiffeid/trustdomain_test.go Adds coverage for case-insensitive scheme/trust domain and additional authority shapes.
spiffeid/require_test.go Updates RequireTrustDomainFromString expectations for mixed-case inputs.
spiffeid/path_test.go Adds tests for additional path/path-segment validation cases.
spiffeid/id.go Accepts case-insensitive scheme and canonicalizes trust domain to lowercase in FromString.
spiffeid/id_test.go Adds tests for canonicalization/equality and expanded parsing behaviors.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread spiffeid/id.go
Comment on lines +55 to 58
case len(id) < schemePrefixLen:
return ID{}, errWrongScheme
case !strings.EqualFold(id[:schemePrefixLen], schemePrefix):
return ID{}, errWrongScheme
Comment thread spiffeid/id.go
Comment on lines +70 to +75
tdNorm := strings.ToLower(id[schemePrefixLen:pathidx])
for i := 0; i < len(tdNorm); i++ {
if !isValidTrustDomainChar(tdNorm[i]) {
return ID{}, errBadTrustDomainChar
}
}
Comment thread spiffeid/trustdomain.go
Comment on lines +32 to 36
name := strings.ToLower(idOrName)
for i := 0; i < len(name); i++ {
if !isValidTrustDomainChar(name[i]) {
return TrustDomain{}, errBadTrustDomainChar
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants