search

slsa-framework / slsa-verifier

Verify provenance from SLSA compliant builders
Apache License 2.0
216 stars 45 forks source link

feat: npmjs sigstore tuf: use ValidFor.Start and ValidFor.End #757

Open ramonpetgrave64 opened 2 months ago

ramonpetgrave64 commented 2 months ago

The work in https://github.com/slsa-framework/slsa-verifier/pull/731 retrieves the latest the signing key from the TUF root. There is metadata for a ValidFor.Start, and in the future there may be a ValidFor.End.

Consider ensuring that the current timestamp is between the start and end timestamps.