bburky
commented
4 months ago TODO. Remind me if I don't get back to this
- rekor PKI. What CA root will it use?
- fulcio use non-exportable crypto (KMS or HSM)
- rekor non-exportable crypto
- ct non-exportable crypto
- rekor and ct uptime requirements? (is it like WebPKI where the CT log "fails" if it's down?)
- GitLab JWTs are ok-ish for OIDC signing. Better would be at a even lower root from infra. Like I think some of the AWS things can give you attestation too. Maybe just do dual Cosign signatures with each identity? Especially if we use dedicated EC2s to improve runner security sandboxing/isolation
- uds/zarf sigs? (basically, review things that would actually use the signatures that this creates)
- Does zarf preserve image hashes?
- zarf/uds does not currently use oci cosign signatures, should it? these are more secure in some respects, can be validated before decompression. Less good if the signature can't be transferred to zarf/uds tarballs
- uds mutates zarf packages? this would invalidate signatures?
- zarf probably should check cosign oci signatures during create? checking during deploy isn't needed probably
- Does Zarf copy cosign image signatures into the zarf registry during deploy?
- How/when/if we plan to have UDS check image signatures at runtime?
- runtime is good, because if any other images run in the cluster (from k8s distro, or externally from non-zarf-injected images) they get verified too
- Keycloak security
- https://github.com/defenseunicorns/uds-core/issues/509#issuecomment-2192087031
- This also changes the security model of keycloak/OIDC to become a source of trust for artifacts too.
Racer159
This sets up the initial repository layout and package for the uds sigstore package.