Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New project root-signing-staging #345

Closed
jku opened this issue Oct 11, 2023 · 2 comments · Fixed by #351
Closed

New project root-signing-staging #345

jku opened this issue Oct 11, 2023 · 2 comments · Fixed by #351

Comments

@jku
Copy link
Member

jku commented Oct 11, 2023

As documented in sigstore/root-signing#929 I'd like to start maintaining the staging TUF repository for root-signing with the TUF-on-CI tool. The reasons are

  • have a meaningful way to test architectural and process changes in root signing
  • If root-signing-staging works well, start maintaining the actual root-signing repository with TUF-on-CI

Currently the "staging TUF repo" is just static files within root-signing git -- a setup that doesn't really resemble production very much. The plan is to actually maintain the staging repository act more like the production one (with some changes like lower signature thresholds to keep maintenance manageable).

I plan to open some PRs to this repo and link to this issue (as I figure out Pulumi etc), but high level plan is this:

  • define a sigstore-rootsigning-team which could include at least @jku (me) and @kommendorkapten
  • define a new project root-signing-staging (I will take other name suggestions though)
  • Configure the GCP KMS like production root-signing, so that the new project can sign with a testing key (preferably a new one for this specific purpose)
  • (likely later) Configure GCS for publishing like production root-signing

cc @haydentherapper
@jku jku mentioned this issue Oct 11, 2023
Closed
8 tasks
jku added a commit to jku/community that referenced this issue Oct 11, 2023
@jku
Add user jku and team tuf-root-signing-staging-codeowners
741c7ec 
* tuf-root-signing-staging-codeowners is for maintainers of
  planned root-signing-staging repository (see sigstore#345)
* New user jku as well as kommendorkapten are added to the new team
* The repository is not defined yet as I understood the team needs to
  exist before it can have an id which is required to define the
  repository

Fixes sigstore#347.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku jku mentioned this issue Oct 11, 2023
Merged
jku added a commit to jku/community that referenced this issue Oct 12, 2023
@jku
Add user jku and team tuf-root-signing-staging-codeowners
03b22b1 
* tuf-root-signing-staging-codeowners is for maintainers of
  planned root-signing-staging repository (see sigstore#345)
* New user jku as well as kommendorkapten and haydentherapper are
  added to the new team
* The repository is not defined yet as I understood the team needs to
  exist before it can have an id which is required to define the
  repository

Fixes sigstore#347.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku
Copy link
Member Author

jku commented Oct 12, 2023

My plan was to enable GitHub Pages publishing from Actions for the the new project (that may later be replaced by GCS publishing). However, it looks like pulumi is not capable of enabling Pages publishing from Actions. So I maye have to either workaround that (somehow?) or go straight to GCS publishing

jku added a commit to jku/community that referenced this issue Oct 12, 2023
@jku
Add a new project root-signing-staging
f3de77f 
Fixes sigstore#345 (although further tweaks will almost certainly be required).

This does not include a team id for the tuf-root-signing-staging-codeowners
team but the code in github-sync seems prepared for that possibility...

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@haydentherapper
Copy link
Contributor

We can also just make you an admin on the project so you can manually enable it.

bobcallaway pushed a commit that referenced this issue Oct 17, 2023
@jku
Add user jku and team tuf-root-signing-staging-codeowners (#348)
e40390a 
* tuf-root-signing-staging-codeowners is for maintainers of
  planned root-signing-staging repository (see #345)
* New user jku as well as kommendorkapten and haydentherapper are
  added to the new team
* The repository is not defined yet as I understood the team needs to
  exist before it can have an id which is required to define the
  repository

Fixes #347.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
jku added a commit to jku/community that referenced this issue Oct 17, 2023
@jku
Add a new project root-signing-staging
3c29298 
Fixes sigstore#345 (although further tweaks may be required: we'll see how the
bot permissions match what tuf-on-ci expects, and what is needed to
configure Pages publishing from GH actions).

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku jku mentioned this issue Oct 17, 2023
Merged
priyawadhwa pushed a commit that referenced this issue Oct 25, 2023
@jku
Add a new project root-signing-staging (#351)
0d7cb9c 
Fixes #345 (although further tweaks may be required: we'll see how the
bot permissions match what tuf-on-ci expects, and what is needed to
configure Pages publishing from GH actions).

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add a new project root-signing-staging jku/community
2 participants
@jku @haydentherapper