fix: use SHA384 for ECDSA P384 (#629)

Signed-off-by: mrjoelkamp <joel.kamp@docker.com>
Co-authored-by: Fredrik Skogman <kommendorkapten@github.com>

Author: mrjoelkamp

metadata/keys.go

@@ -38,6 +38,7 @@ const (
 	KeyTypeRSASSA_PSS_SHA256      = "rsa"
 	KeySchemeEd25519              = "ed25519"
 	KeySchemeECDSA_SHA2_P256      = "ecdsa-sha2-nistp256"
+	KeySchemeECDSA_SHA2_P384      = "ecdsa-sha2-nistp384"
 	KeySchemeRSASSA_PSS_SHA256    = "rsassa-pss-sha256"
 )
 

metadata/metadata.go

@@ -312,7 +312,14 @@ func (meta *Metadata[T]) VerifyDelegate(delegatedRole string, delegatedMetadata
 		// use corresponding hash function for key type
 		hash := crypto.Hash(0)
 		if key.Type != KeyTypeEd25519 {
-			hash = crypto.SHA256
+			switch key.Scheme {
+			case KeySchemeECDSA_SHA2_P256:
+				hash = crypto.SHA256
+			case KeySchemeECDSA_SHA2_P384:
+				hash = crypto.SHA384
+			default:
+				hash = crypto.SHA256
+			}
 		}
 		// load a verifier based on that key
 		verifier, err := signature.LoadVerifier(publicKey, hash)