gittuf/gittuf

Fix sigstore integration and testing

Open

#73 opened on Aug 7, 2023

View on GitHubContributor guide
 (0 comments) (0 reactions) (0 assignees)Go (127 forks)auto 404
enhancementhelp wantedtests

Repository metrics

Stars
 (629 stars)
PR merge metrics
 (PR metrics pending)

Description

#72 introduced gitsign verification support in gittuf using TUF's TAP-18. However, there's work to be done in testing the gitsign support.

  1. It might be possible to prune the dependency graph by switching from cosign+gitsign+sigstore/sigstore to https://github.com/sigstore/sigstore-go once it matures and has the capabilities we need.
  2. We can't mock some of the necessary behavior with the current libraries pertaining to looking up the tlog entry for the signature. These are marked internal at the moment, the sigstore-go library may also help us out here.
  3. The TAP-18 implementation depends on go-securesystemslib's sigstore-support branch that hasn't been merged into main and released.

Contributor guide

Research direction
Explore dependency pruning by evaluating sigstore go maturity, investigate mocking capabilities for tlog entry lookup, and track merge status of go securesystemslib's sigstore support branch.
Tech stack
go
Domain
backendsecurity
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
GoGitcosign/gitsign
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30