Comments (6)
We actually discussed using a subset of VerificationMaterials to omit the key ID as the signature has its own key ID field (sigstore/sig-clients#9). Once that PR is merged, for DSSE, the TAP may be updated to use the extension I think?
versioning
The proposed message also omits this, but that's because the kind
field which holds the media type + version must be defined by securesystemslib as that is a common wrapper for other potential DSSE extensions.
from taps.
FYI: A fully working sigstore signer is available in the securesystemslib v0.27.0. It can already be used in the python-tuf reference implementation via the new signer API.
The API is still experimental and development continues in: securesystemslib/signer/_sigstore_signer.py.
NOTEs to TAP editors:
The following two decisions are currently hard-coded:
- use offline verification
- use sigstore production instance for signing and verifying
I think we should configure the latter via the public key? It should always remain the same for a given public key.
Also, "offline" verification is not really offline. IIUC it skips talking to rekor, but still does a TUF client update with Fulcio.
Last but not least, I opted for storing the sigstore bundle in a separate field, and additionally copying the signature from the bundle into the "sig" field, to remain compatible with the current TUF specification (following discussion in: #168 (comment)). The signature on the wire now looks something like:
{
"keyid": KEYID,
"sig": SIGNATURE, # bundle.message_signature.signature.hex()
"bundle": BUNDLE # bundle.to_dict()
}
from taps.
Nice to see an implementation of this TAP, thanks @lukpueh!
I agree with the assertion that the Sigstore instance should not be hard-coded. Private deployments seem likely and we want TUF to remain flexible.
What would you recommend wrt the "offline" is not really offline observation? Should this be a note in the TAP (do we need a TAP to describe truly offline/airgapped TUF repositories?)
I opened #175 to update the TAP to the key format you've used in the securesystemslib implementation.
from taps.
For reference secure-systems-lab/dsse#61 is adityas signature extension proposal for DSSE
from taps.
After that's merged, the TAP should be updated in the signature format section: https://github.com/theupdateframework/taps/blob/master/tap18.md#signature-format.
Specifically, BUNDLE
should be replaced in favour of the DSSE signature extension and possible similar custom fields should be defined for the legacy signature wrapper? The issue with using the sigstore bundle is it's designed to wrap around a signature envelope with extra verification materials, and is not meant to be embedded for a signature in an existing envelope.
from taps.
TAP18 and the experimental implementation in securesystemslib should definitely be updated if there's a direct way to be consistent with planned DSSE formats.
The issue with using the sigstore bundle is it's designed to wrap around a signature envelope with extra verification materials, and is not meant to be embedded for a signature in an existing envelope.
If you are talking about e.g. using the VerificationMaterial proto instead of Bundle within the signature, then that sounds fine to me (although I notice VerificationMaterial does not have a media_type
field or other versioning in it -- I'm not super familiar with protobufs so maybe that's not an issue)
from taps.
Related Issues (20)
- TAP process (TAP 1) HOT 7
- Allowing TAPs that are licensed with MIT or Apache 2.0? HOT 12
- TAP process: issue with pre-implementation phase visibility
- master branch protection HOT 6
- Discussion of TAP 15: Succinct hash bin delegations HOT 10
- Discussion of TAP 16: Snapshot Merkle trees HOT 3
- Discussion of TAP 12: Improving keyid flexibility HOT 4
- Discussion of TAP 14: Managing TUF Versions HOT 6
- Discussion of TAP 13: User Selection of the Top-Level Target Files Through Mapping Metadata HOT 1
- Discussion of TAP-17: Remove signature wrapper from TUF spec HOT 3
- POUF1 is out of date
- audit logs for root metadata changes
- Should POUF-1 allow whitespace for prettified output? HOT 2
- Define preferred style for wrapping and enforce with linter
- [TAP 8] Should rotate files be listed in snapshot metadata? HOT 1
- Introduce a status for approved/accepted TAPs that are not intended to make it into the core specification
- TAP request: artifact discovery, index files and targets metadata HOT 1
- TAP 19: should discuss privacy HOT 1
- Support for downgrading/revoking a version? HOT 10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from taps.