compatibility issue with root-signing TUF metadata

jku commented 4 months ago

@tnytown found some compatibility issues with root-signing-staging during https://github.com/sigstore/sigstore-rs/pull/354:

keyids were accidentally non-compliant: this concerns root-signing-staging only and will be fixed there, hopefully next week (sigstore-rs needs to initialize with the fixed root.json at that point, sorry about that)
it turns out that awslabs/tough does not support METAFILEs without hashes and length in TUF metadata: they are optional in the specification. Current root-signing-staging metadata does not include these optional items but because awslabs/tough requires them sigstore-rs will not work with root-signing-staging even after the previous issue is fixed

This issue is about the second item above: . Some more context:

I maintain tuf-on-ci, the tool that is used to produce the root-signing-staging repository
The plan is to start maintaining the production root-signing repo with the same tool: this means sigstore-rs will have the same issue with production infra soon
I was not planning on including hashes and length in the metadata in the future but I am willing to discuss...
I imagine adding support for optional hashes and length into awslabs/tough client is not an unreasonable amount of work

tnytown commented 3 months ago

@flavio any ideas on what path we should take going forward? This change is imminent and will break sigstore-rs' TUF code.

tnytown commented 3 months ago

I made an attempt at switching to rust-tuf and encountered a different issue: https://github.com/theupdateframework/rust-tuf/issues/408

Trail of Bits is out of time on sigstore-rs, so I won't be taking this on in the short term.

flavio commented 3 months ago

Sorry, I was swamped during the last weeks. I'm going to look into that.

flavio commented 3 months ago

@jku I've run into the keyid issue you reported. Please ping me once the staging repo is fixed :pray:

Thanks again for this heads up!

jku commented 1 month ago

This wasn't updated since June so it's clearly time:

the keyid issue was fixed in root-signing-staging in july
there is still an upcoming compatibility issue with root-signing
- https://github.com/sigstore/root-signing/issues/1320 will be the signing event that introduces the incompatible change in root-signing, plan is to try that next week
- Fix has been merged in awslabs/tough but they have not released since then

flavio commented 1 week ago

We can close it, sigstore-rs 0.10.0 has all the fixes we need :partying_face:

sigstore / sigstore-rs