From 0662f30edbda48fc83aa631a083eb28b53d33f49 Mon Sep 17 00:00:00 2001
From: Hayden <8418760+Hayden-IO@users.noreply.github.com>
Date: Tue, 17 Feb 2026 13:58:17 -0800
Subject: [PATCH 1/2] Type assert the entry bundle when verifying inclusion
 proof

This guards against a body unexpectedly being a different type.

Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>
---
 pkg/verify/verify.go      |  7 ++++++-
 pkg/verify/verify_test.go | 23 ++++++++++++++++++++++-
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/pkg/verify/verify.go b/pkg/verify/verify.go
index 61846923b..d5c05a885 100644
--- a/pkg/verify/verify.go
+++ b/pkg/verify/verify.go
@@ -23,6 +23,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"reflect"
 
 	"github.com/cyberphone/json-canonicalization/go/src/webpki.org/jsoncanonicalizer"
 	"github.com/sigstore/rekor/pkg/generated/client"
@@ -155,7 +156,11 @@ func VerifyInclusion(ctx context.Context, e *models.LogEntryAnon) error {
 	}
 
 	// Verify the inclusion proof.
-	entryBytes, err := base64.StdEncoding.DecodeString(e.Body.(string))
+	b, ok := e.Body.(string)
+	if !ok {
+		return fmt.Errorf("entry body must be a string, was %s", reflect.TypeOf(e.Body))
+	}
+	entryBytes, err := base64.StdEncoding.DecodeString(b)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/verify/verify_test.go b/pkg/verify/verify_test.go
index 644070118..0f1eba952 100644
--- a/pkg/verify/verify_test.go
+++ b/pkg/verify/verify_test.go
@@ -228,6 +228,27 @@ func TestInclusion(t *testing.T) {
 			},
 			wantErr: true,
 		},
+		{
+			name: "invalid inclusion - body not string",
+			e: models.LogEntryAnon{
+				Body:           123,
+				IntegratedTime: &time,
+				LogID:          &logID,
+				LogIndex:       conv.Pointer(int64(1)),
+				Verification: &models.LogEntryAnonVerification{
+					InclusionProof: &models.InclusionProof{
+						TreeSize: conv.Pointer(int64(2)),
+						RootHash: conv.Pointer("5be1758dd2228acfaf2546b4b6ce8aa40c82a3748f3dcb550e0d67ba34f02a45"),
+						LogIndex: conv.Pointer(int64(1)),
+						Hashes: []string{
+							"59a575f157274702c38de3ab1e1784226f391fb79500ebf9f02b4439fb77574c",
+						},
+					},
+					SignedEntryTimestamp: strfmt.Base64("MEUCIHJj8xP+oPTd4BAXhO2lcbRplnKW2FafMiFo0gIDGUcYAiEA80BJ8QikiupGAv3R3dtSvZ1ICsAOQat10cFKPqBkLBM="),
+				},
+			},
+			wantErr: true,
+		},
 	} {
 		t.Run(string(test.name), func(t *testing.T) {
 			ctx := context.Background()
@@ -235,7 +256,7 @@ func TestInclusion(t *testing.T) {
 			gotErr := VerifyInclusion(ctx, &test.e)
 
 			if (gotErr != nil) != test.wantErr {
-				t.Fatalf("VerifyInclusion = %t, wantErr %t", gotErr, test.wantErr)
+				t.Fatalf("VerifyInclusion = %s, wantErr %t", gotErr.Error(), test.wantErr)
 			}
 		})
 	}

From 0eeb2adf537309f728b627bcde0852851f5b080a Mon Sep 17 00:00:00 2001
From: Hayden <8418760+Hayden-IO@users.noreply.github.com>
Date: Tue, 3 Mar 2026 14:53:33 -0800
Subject: [PATCH 2/2] Update verify.go

---
 pkg/verify/verify.go | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkg/verify/verify.go b/pkg/verify/verify.go
index d5c05a885..bc840ac58 100644
--- a/pkg/verify/verify.go
+++ b/pkg/verify/verify.go
@@ -23,7 +23,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"reflect"
 
 	"github.com/cyberphone/json-canonicalization/go/src/webpki.org/jsoncanonicalizer"
 	"github.com/sigstore/rekor/pkg/generated/client"
@@ -158,7 +157,7 @@ func VerifyInclusion(ctx context.Context, e *models.LogEntryAnon) error {
 	// Verify the inclusion proof.
 	b, ok := e.Body.(string)
 	if !ok {
-		return fmt.Errorf("entry body must be a string, was %s", reflect.TypeOf(e.Body))
+		return fmt.Errorf("entry body must be a string, was %T", e.Body)
 	}
 	entryBytes, err := base64.StdEncoding.DecodeString(b)
 	if err != nil {