Comments (12)
Tagging: @MarkLodato @SantiagoTorres @lukpueh @trishankatdatadog @mnm678 @joshuagl @JustinCappos
from dsse.
FYI: I just tagged v0.1.0 -- https://github.com/secure-systems-lab/signing-spec/releases/tag/v0.1.0
from dsse.
Do we have working prototypes somewhere, especially one to support Google's use case, and another to support our Canonical JSON? That would be the only thing that would really convince me, not endless specifications.
from dsse.
I suggest creating a GitHub milestone for this. (If you add me as an editor in the project, I'd be happy to set that up for you.)
I filed #28 for the reference implementation.
from dsse.
I've created the milestone and added #28 to it.
from dsse.
Do we have working prototypes somewhere, especially one to support Google's use case, and another to support our Canonical JSON? That would be the only thing that would really convince me, not endless specifications.
I don't know if this is a "reference" implementation, but we have "an" implementation here: https://github.com/in-toto/in-toto-golang/blob/master/pkg/ssl/sign.go
from dsse.
I propose that the following are the only blockers:
- #16 Choose a more specific name than "signing-spec"
- #27 Use a simpler PAE
- #28 Create a reference implementation and test vectors
Once we have done these three, we tag it as 1.0. Any objections?
from dsse.
How much do were care about #27? There's already an implementation that uses the already defined PAE.
I'm fine either way, I just want to make sure this is actually a good use of time.
from dsse.
IMO it's valuable since it significantly simplifies the implementation and is an easy change to make.
from dsse.
SGTM
from dsse.
I chatted offline with @MarkLodato on the possibility to use a simpler encoding for the envelope part too: that would prevent recipients from using a full-blown json parser on untrusted input. But it's yet more work to make this change and may not best use of time at this stage.
from dsse.
It's 1.0 now!
from dsse.
Related Issues (20)
- Add data structure and convention associating multiple messages with an artifact HOT 4
- Relax URI requirement on payloadType? HOT 5
- Use a simpler PAE HOT 11
- Create a reference implementation and test vectors HOT 4
- Wrong signature in example? HOT 1
- Design: Where to put timestamps in envelope? HOT 23
- Add envelope version HOT 8
- Communicating signing algorithm and parameters HOT 10
- Envelope headers HOT 6
- Extending DSSE to accept optional signature specific metadata HOT 26
- How to verify an envelope properly? HOT 5
- Add field for certificate chains, or explain alternative solution HOT 26
- Clarify design philosphy
- Document the sigstore/sigstore client libraries? HOT 3
- Specify DSSE Signature encoding in the Protocol or as a Parameter HOT 6
- "DSSE Multi-signature Verification" protocol lacks detail about threshold verification HOT 3
- Have you considered signing a hash digest of the payload instead of the payload itself? HOT 3
- Feature: generate DSSE language clients from the protobuf HOT 4
- reconsider threshold (aka multi-sig) verification HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dsse.