search

sigstore / sigstore-rs

An experimental Rust crate for sigstore
https://sigstore.github.io/sigstore-rs/sigstore/
Apache License 2.0
156 stars 48 forks source link

Support for inclusion/consistency proofs and checkpoint/STH verification. #283

Open vembacher opened 11 months ago

vembacher commented 11 months ago

Summary

I would like to see support for inclusion/consistency proofs and checkpoints/STH.

Also related: #274

Reasoning

Implementation

I'm willing to implement this feature, I have already implemented it in another (non-public) crate so I can just port it to this crate. However, I want to discuss some minor details on how to do it first:

  1. Add the basic implementation to the crypto module that is not be part of the public API.
  2. Add methods to the related Rekor data structures to verify them, this would be part of the public API .
  3. For now I would not add their verification to the Cosign module directly to avoid breaking changes here.
  4. Is there a specification for the checkpoint/STH format?
haydentherapper commented 11 months ago

Checkpoint format comes from https://github.com/sigstore/rekor/blob/main/pkg/util/checkpoint.go. It's Go's SumbDB note format (https://pkg.go.dev/golang.org/x/mod/sumdb/note) with a timestamp in OtherContent.

vembacher commented 11 months ago

Checkpoint format comes from https://github.com/sigstore/rekor/blob/main/pkg/util/checkpoint.go. It's Go's SumbDB note format (https://pkg.go.dev/golang.org/x/mod/sumdb/note) with a timestamp in OtherContent.

Thanks! I was not sure if there was another specification I did not find. I used the Go code as the reference implementation.

gaetanww commented 4 months ago

I'm also interested in supporting inclusion proofs, do you need help to get this over the line?

haydentherapper commented 4 months ago

cc @woodruffw @jleightcap - I think y'all have begun looking at supporting inclusion proof?

tnytown commented 4 months ago

Speaking for the @trailofbits delegation: I don't think we've gotten around to integrating inclusion proofs yet. I was planning on taking a look at the implementation in #285 once the dust settles on bundles (#326 and #311).

gaetanww commented 4 months ago

I tried the implementation in #285 today and there's a problem with it, see my comment. Happy to add a commit if you agree with the fix.