search

sigstore / sigstore-js

Code-signing for npm packages
Apache License 2.0
156 stars 22 forks source link

Client libraries should verify after signing #745

Open znewman01 opened 1 year ago

znewman01 commented 1 year ago

In the Sigstore clients special interest group meeting today, we discussed an issue with the release signatures on CPython.

We have two recommendations for client libraries:

  1. After signing, the clients MUST verify the signature (see Sigstore client spec). 2.
  2. Client library interfaces SHOULD allow callers to specify an identity (and other verification parameters) to use for this verification.

I'm going to be a bit lazy (sorry) and rather than inspecting every client library by hand, just ask whether you're doing the these and, if not, whether you all agree with these recommendations.

bdehamer commented 1 year ago

Currently, sigstore-js does neither of these things. However, I agree with the recommendations.

I'm working on refactoring a lot of the verification logic and will be sure to incorporate these requirements.