What does ClairMeta compute when it checks a DCP's XML signature and certificate chain?

ClairMeta's DCP signature module defines 29 checks: 17 per-certificate checks (version, extensions, fields, encoding, constraints, key usage, organisation and role, dates, RSA 2048/65537, thumbprint, issuer signature), 2 XML-certificate coherence checks, 3 chain checks (length only if configured, issuer/subject and validity nesting, uniform algorithms), 6 XML-signature algorithm and issuer checks, and a real verification of digest and signature over canonicalised XML. Trusted-root and revocation-list checks are not implemented and simply error when such lists are configured. Expiry is reported as INFO by default. Curator qualifications: Code read 2026-10-22; no DCP checked. Curator amendment CA-AM-0058 (2026-10-22): Evidence added for 'ClairMeta BSD-3-Clause (not re-read)': GitHub license API readback 1185fdf3605903bf reports SPDX BSD-3-Clause (repository level, 2026-10-22). The label is now backed by a curator readback. Limitations: Code read 2026-10-22; no DCP checked. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://github.com/Ymagis/ClairMeta/blob/b3b66a024174976ffbde4b6dfff2b599e84e4757/clairmeta/dcp_check_sign.py",
      "note": "clairmeta/dcp_check_sign.py at b3b66a0: def check_* list; L452-460; L478-488; L629-631; clairmeta/profile.py L18-32"
    },
    {
      "url": "https://github.com/Ymagis/ClairMeta/blob/b3b66a024174976ffbde4b6dfff2b599e84e4757/clairmeta/profile.py",
      "note": "clairmeta/dcp_check_sign.py at b3b66a0: def check_* list; L452-460; L478-488; L629-631; clairmeta/profile.py L18-32"
    }
  ]
}