Comments (5)
Something like the Docker/OCI alternative mentioned seems reasonable to me instead of just application/json
. One thing, and I may be misunderstanding this, is that OCI seems to exhaustively list their media types. Will enforcement of "more information than just application/json" become an issue with something like the signing-spec which anyone can use, and therefore define a media type for?
If the URI requirement is dropped to a SHOULD
, would implementations be expected to also support media type alternatives? Especially if the spec lists them as an alternative?
from dsse.
I'm thinking that we'd say something like:
payloadType
is an opaque, case-sensitive string that uniquely and unambiguously identifies how to interpretpayload
. This includes both the encoding (JSON, CBOR, etc.) as well as the meaning/schema. To prevent collisions, it SHOULD be either:
- (recommended) A case-normalized URI. Example:
https://in-toto.io/Statement/v1-json
- A lowercase Media Type (a.k.a. MIME type or Content Type). Example:
application/vnd.in-toto.statement.v1+json
.
- IMPORTANT: If Media Type is used, it SHOULD NOT be a generic one that only represents encoding but not schema. For example,
application/json
is almost always WRONG. Instead, invent a media type specific for your application in theapplication/vnd
namespace.
from dsse.
I like the option to use media type. This would also allow for future use within OCI without any major changes.
from dsse.
I'm thinking that we'd say something like:
Thanks @MarkLodato. This seems reasonable to me.
from dsse.
Thanks! Sent out pull request #26 to implement.
from dsse.
Related Issues (20)
- Add envelope version HOT 8
- Communicating signing algorithm and parameters HOT 10
- Envelope headers HOT 6
- Extending DSSE to accept optional signature specific metadata HOT 26
- How to verify an envelope properly? HOT 5
- Add field for certificate chains, or explain alternative solution HOT 26
- Clarify design philosphy
- Document the sigstore/sigstore client libraries? HOT 3
- Specify DSSE Signature encoding in the Protocol or as a Parameter HOT 6
- "DSSE Multi-signature Verification" protocol lacks detail about threshold verification HOT 3
- Have you considered signing a hash digest of the payload instead of the payload itself? HOT 3
- Feature: generate DSSE language clients from the protobuf HOT 4
- reconsider threshold (aka multi-sig) verification HOT 7
- DSSE Maintainers HOT 4
- Process to enhance DSSE HOT 2
- Extending DSSE Signatures HOT 22
- DSSE Extension for Timestamping and PKI Support
- Document rationale for DSSE vs COSE etc. HOT 4
- Reducing overhead for payload encoding HOT 15
- What should be listed as parameters for signature in the protocol?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dsse.