search

notaryproject / notation-go

A collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications.
Apache License 2.0
39 stars 42 forks source link

CRL support #425

Closed JeyJeyGao closed 3 weeks ago

JeyJeyGao commented 3 months ago

As suggested in https://github.com/notaryproject/notation-core-go/issues/125, CRL support is required.

Here is the plan to complete CRL support based on priority:

  1. Basic CRL support (v1.3.0): This includes base CRL downloading and validation, with a fallback rule to automatically choose OCSP and fallback to CRL.
  2. CRL cache support (v1.3.0): Since CRL is a static file with relatively long-term validity, and a well-known CA's CRL is usually greater than 600KiB, a cache mechanism can significantly improve performance.
Two-Hearts commented 3 months ago

@JeyJeyGao Could you move this issue to notation-go? As it's more a library issue than an external user facing one.

priteshbandi commented 3 months ago

LGTM; Additionally, it would be good if we could implement a caching system that allows users to bring their own cache implementation. This would enable users to leverage in-memory caching (for libraries), disk-based caching (for binaries), or any other remote storage option for the cache. Providing this flexibility would give users more control over how the caching is handled in the system and at the same time reducing complexity from our code.

shizhMSFT commented 3 months ago

Cache is important and @JeyJeyGao will share the detailed design later.

JeyJeyGao commented 3 months ago

We will use #425 (for notation-go) and https://github.com/notaryproject/notation-core-go/issues/125 (for notation-core-go) to track the CRL support of notation v1.3.0. Other future work items will be tracked in #428

Two-Hearts commented 3 weeks ago

Closing as completed.