CNAB Security 304: Known implementations #288
Conversation
|
Can you assign me to review? Thanks! |
radu-matei
force-pushed
the
304-implementations
branch
2 times, most recently
from
f4cbf2a to
ef9d385
Compare
There was a problem hiding this comment.
@radu-matei I think it's a great start! A few comments:
- Could we show a complete workflow? Such as setting up the metadata repository for the first time (TUF roles and keys, in-toto root layout and keys, etc). The in-toto bit should be OPTIONAL for most users.
- Could we use a real live registry, if possible, instead of localhost, please?
304-known-implementations.md
Outdated
| INFO[0001] Pushed successfully, with digest "sha256:b4936e42304c184bafc9b06dde9ea1f979129e09a021a8f40abc07f736de9268" | ||
| ``` | ||
|
|
||
| - if the TUF metadata associated with a bundle also contains in-toto metadata in the `custom` object of the targets file, Signy will validate all layouts and links, and perform the verifications inside a verification image: |
There was a problem hiding this comment.
This is still an open work item for Signy.
|
Per meeting today, Radu and I will work on a Python implementation |
|
What's the status on this? Should we review it? The last comment makes it sound like there is more work to do. |
|
@technosophos As a 1.0 WD, it is fine. We are working on the Go implementation right now, so things will change in the near future :) |
There was a problem hiding this comment.
@radu-matei Can you pls make it clear it's a 1.0 WD, add it to ToC in README, and link to it from a sentence in 300?
|
Do not add the version (1.0 Draft) on this file. We just got that fixed across all files this week. Only the 300 doc needs the version string. Subsections are not independently versioned. |
|
@technosophos Ooops, got it, thanks! |
|
@radu-matei Bump, is there anything else we need to do for this? |
|
Quick ping on this: What is left to do? |
Apply review feedback Update 304 known implementations Signed-off-by: Radu M <root@radu.sh>
radu-matei
force-pushed
the
304-implementations
branch
from
748496d to
70ab70b
Compare
|
@radu-matei You have two ✅ but since there was that one question of that link I'll leave it to you to time when to merge. |
depends on #280