search

twiss / source-code-transparency

Source Code Transparency
11 stars 0 forks source link

IETF SCITT relation #6

Open simon-friedberger opened 1 year ago

simon-friedberger commented 1 year ago

Since I didn't see it on the TPAC list of related work: https://datatracker.ietf.org/group/scitt/about/ This is quite a bit more generic but might be a good way to solve the problem for source code/web content. The trust model may be more complicated for the web but a fairly similar use case would be https://www.ietf.org/archive/id/draft-ietf-scitt-software-use-cases-01.html#name-firmware-delivery-to-large-

twiss commented 1 year ago

Right, I definitely agree it's very related and could potentially work for this use case as well :+1: In particular it would be worth checking whether the architecture described at https://www.ietf.org/archive/id/draft-ietf-scitt-architecture-02.html is sufficient for our use case. I'll have to look into that, but if you or anyone else wants to weigh in that'd be welcome too :)

OR13 commented 1 year ago

I'm interested in exploring a small PoC for this.

We've also looked at persisting the transparency log in indexdb.

SteveLasker commented 1 year ago

Providing some links for the latest version of the docs, and where to find the latest: