Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bundle TUF timestamp with signature on signing #1294

Merged
merged 5 commits into from
Jan 13, 2022
Merged

Bundle TUF timestamp with signature on signing #1294

merged 5 commits into from
Jan 13, 2022

Commits on Jan 11, 2022

  1. Bundle TUF timestamp with signature on signing 

    This updates the code to support adding the TUF timestamp
to the OCI signature.

Changes to pkg/oci add support for reading and saving the
timestamp by annotation key. Changes to the TUF client
add putting the timestamp in memory on client
initialization, so callers can access the timestamp.

Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
    @haydentherapper
    haydentherapper committed Jan 11, 2022
    Configuration menu
    Copy the full SHA
    914d75d View commit details
    Browse the repository at this point in the history

  2. Add TUF timestamp to OCI signature on sign 

    This adds the TUF timestamp to the Fulcio and Rekor
signers. Both are necessary since each relies on
TUF metadata. If both signers are used, the latter
one will overwrite the TUF timestamp.

I also added a basic mock Rekor client for tests.
A number of methods are not implemented yet.

Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
    @haydentherapper
    haydentherapper committed Jan 11, 2022
    Configuration menu
    Copy the full SHA
    5506ea5 View commit details
    Browse the repository at this point in the history

  3. Add license 

    Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
    @haydentherapper
    haydentherapper committed Jan 11, 2022
    Configuration menu
    Copy the full SHA
    9aa4b61 View commit details
    Browse the repository at this point in the history

  4. Move timestamp to TUF package 

    Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
    @haydentherapper
    haydentherapper committed Jan 11, 2022
    Configuration menu
    Copy the full SHA
    e08e07d View commit details
    Browse the repository at this point in the history

  5. Update TUF client to persist local store 

    Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
    @haydentherapper
    haydentherapper committed Jan 11, 2022
    Configuration menu
    Copy the full SHA
    b5242d1 View commit details
    Browse the repository at this point in the history