cert: "." and ".." are accepted as trust store names and resolve outside the named store #1374

What is not working as expected?

truststore.IsValidFileName accepts . and .., because both only contain characters from [a-zA-Z0-9_.-]. The named store is joined to the trust store path, so these names resolve to a directory above the named store:

• notation cert delete --type ca --store .. --all resolves to truststore/x509 and removes the trust stores of every type
• notation cert delete --type ca --store . --all resolves to the ca directory and removes all named CA stores
• notation cert add --store .. copies the certificate into truststore/x509 instead of a named store

The same check is used by cert add, cert show, cert delete, cert generate-test and cert cleanup-test. It only affects the local trust store of whoever runs the command with an explicit --store value, so I do not think it is a security boundary, but removing every trust store because of a one or two character argument is easy to do by mistake.

I found this by reading the code and checked it with unit tests (one for IsValidFileName and one that runs deleteCerts against a temporary config directory), not by running the CLI against a real trust store.

What did you expect to happen?

. and .. are rejected with the same error as other invalid store names (named store name needs to follow [a-zA-Z0-9_.-]+ format), and no trust store is touched.

How can we reproduce it?

In a throwaway config directory (for example with NOTATION_CONFIG pointing to a temporary directory) with certificates in a few stores, run notation cert delete --type ca --store .. --all -y. The unit tests in the linked PR show the same thing without the CLI.

Describe your environment

macOS, go1.26.3, notation main (9ba75db)

What is the version of your Notation CLI or Notation Library?

main (9ba75db)