cnabio / signy

Go implementation for CNAB content trust verification using TUF, Notary, and in-toto
MIT License
31 stars 11 forks source link

Use length from Notary to cap bundle download size #81

Open trishankatdatadog opened 4 years ago

radu-matei commented 4 years ago

This is a great point - although I'm not sure if we can control this behaviour from Signy, since we're offloading bundle pulling to cnab-to-oci.

Perhaps we can ask that cnab-to-oci expose a way to stop pulling when a certain size has been reached?

ref https://github.com/cnabio/cnab-to-oci/blob/00159a9fe7bb55d43f207db22698d6ba22a9588f/remotes/pull.go#L152-L166