Signing event: sign/demo-artifact-add

jku / tuf-demo

An automated TUF repository demo

https://jku.github.io/tuf-demo/metadata/

6 stars 3 forks source link

Signing event: sign/demo-artifact-add #93

Closed github-actions[bot] closed 8 months ago

github-actions[bot] commented 8 months ago

Processing signing event sign/demo-artifact-add, please wait.

github-actions[bot] commented 8 months ago

Artifacts have been modified

Event sign/demo-artifact-add (commit 3f57a3e) Committed metadata changes for role(s) targets. Updating signing event state, please wait.

github-actions[bot] commented 8 months ago

Current signing event state

Event sign/demo-artifact-add (commit c0df6b7)

:x: targets

Role targets contains following artifact changes:

file1.txt: ADDED

Role targets is unsigned and not yet verified Still missing signatures from @jku, @rdimitrov Signers can sign these changes by running tuf-on-ci-sign sign/demo-artifact-add

jku commented 8 months ago

I started this signing event to have a demo for root-signing meeting. This is what I did:

git switch -C sign/demo-artifact-add
echo "abcd" > targets/file1.txt
git add targets/file1.txt && git commit -m "Add artifact file1.txt"
git push origin sign/demo-artifact-add

@rdimitrov if you're around, your signature is appreciated

github-actions[bot] commented 8 months ago

Current signing event state

Event sign/demo-artifact-add (commit d977c4a)

:x: targets

Role targets contains following artifact changes:

file1.txt: ADDED

Role targets is not yet verified. It is signed by 1/2 signers (@jku). Still missing signatures from @rdimitrov Signers can sign these changes by running tuf-on-ci-sign sign/demo-artifact-add

jku commented 8 months ago

I've just signed locally: this is what it looked like on my end: Screenshot from 2024-02-20 11-13-49

github-actions[bot] commented 8 months ago

Current signing event state

Event sign/demo-artifact-add (commit 226c17e)

:white_check_mark: targets

Role targets contains following artifact changes:

file1.txt: ADDED

Role targets is verified and signed by 2/2 signers (@rdimitrov, @jku).

Signing event is successful

Threshold of signatures has been reached: this signing event can be reviewed and merged.

jku commented 8 months ago

Threshold has now been reached:

I'll review and merge this signing event PR:
This results in an online signing process that commits new timestamp and snapshot to main
This leads to a publish process that builds a repo, publishes on GH Pages and runs client tests
Repository is available at https://jku.github.io/tuf-demo/metadata/timestamp.json