search

sigstore / scaffolding

Stuff to make standing up sigstore (esp. for testing) easier for e2e/integration testing.
Apache License 2.0
59 stars 57 forks source link

Add functionality to generate trusted_root.json by the TUF server #1191

Closed bkabrda closed 3 months ago

bkabrda commented 4 months ago

Summary

This PR is the first of a series to address https://github.com/sigstore/scaffolding/issues/1182. It adds functionality to the TUF server to generate a trusted_root.json as a target.

There is some overlap with the trtool project and in the future, ideally we would make a library to pull out the common functionality and share it.

Release Note

The TUF server now generates a trusted_root.json target from the supplied files.

Documentation

I don't believe that the TUF server is even documented anywhere, so I don't think documentation change is required, but please let me know if I'm wrong about that.

bkabrda commented 4 months ago

Hi, thanks for the feedback! I can certainly try to add this to sigstore-go. I'll leave this PR open and when the sigstore-go work is merged, I'll update it to use that as a library from here.

bkabrda commented 4 months ago

Oh, I didn't realize that sigstore-go already has so much related code to this in https://github.com/sigstore/sigstore-go/tree/main/pkg/root, this actually makes so much sense... I don't know why I didn't think of looking there first. Thanks again for pointing me in the right direction!

bkabrda commented 4 months ago

Hi :wave: I created https://github.com/sigstore/sigstore-go/pull/247. I have a local modification of this PR that uses the functionality from there and works fine. I'll push it once the sigstore-go PR is merged (ideally we would also release that if possible, not sure if/how I could help with that).

bkabrda commented 3 months ago

This PR is conflicting on multiple files and will need a significant rewrite to utilize https://github.com/sigstore/sigstore-go/pull/247 anyway. I think it's going to be easier if I close it and open a new one instead.