Embedded root.json is expired

sigstore / sigstore-go

Go library for Sigstore signing and verification

Apache License 2.0

43 stars 21 forks source link

Embedded root.json is expired #294

Open cmurphy opened 2 days ago

cmurphy commented 2 days ago

Description

The default root.json for the public good instance expired last week: https://github.com/sigstore/sigstore-go/blob/ce459a84121500bf0a658aba8503a5836fd55ad6/pkg/tuf/repository/root.json#L6

Version

$ git rev-parse --short=8 HEAD
ce459a84

haydentherapper commented 1 day ago

That's fine, this metadata is the root of trust for the TUF metadata. As per the TUF spec, a TUF client will download N+1 versions until it receives an error, verify N-1 signed N, and then check the timestamp on the most recent root metadata.

We should still update the root as an optimization though so that clients don't have to download the latest root metadata each time.