search

slsa-framework / slsa-verifier

Verify provenance from SLSA compliant builders
Apache License 2.0
226 stars 48 forks source link

feat: fixes #547: add npm sigstore-tuf suport #731

Closed ramonpetgrave64 closed 5 months ago

ramonpetgrave64 commented 8 months ago

Addresses: https://github.com/slsa-framework/slsa-verifier/issues/547

Currently slsa-verifier has npmjs' attestation key hardcoded. But sigstore now stores the same key within their own TUF root.

This PR

ramonpetgrave64 commented 8 months ago

@laurentsimon please take a look

ramonpetgrave64 commented 5 months ago

I've updated the PR to dynamically use the keyid specified in the sigstore bundle, rather than the hardcoded keyid.

laurentsimon commented 5 months ago

@ramonpetgrave64 feel free to merge after addressing the few nits. Please create a tracking issue for the TUF verification discussed in https://github.com/slsa-framework/slsa-verifier/pull/731#discussion_r1560402195. Thanks for the PR!