Hayden B

Results 828 comments of Hayden B

Offline Rekor bundle generation and verification

We said `.sigstore` for the bundle. I'd be fine with `.rekor`

compatibility: go-tuf ecdsa key format is incompatible

Supporting both should be easy. I greatly prefer PEM encoded keys as the spec already defines, but if DER has been supported currently, I don’t think we should drop it....

consider moving core sign & verify functions from cosign to sigstore

Closing as this will be a part of sigstore-go

Add KeyID (public key fingerprint) to signature in in-toto attestation

@asraa still an issue?

deal with deprecation of x/crypto/openpgp

Golang recommends https://github.com/ProtonMail/go-crypto, which seems to be supported. Keybase has a fork too but it hasn't been updated in 2 years. cc @lukehinds

Use ed25519 for KMS's that support it? E.g. Vault

ed25519 is now supported throughout the sigstore ecosystem.

Merge 'cosign/pkg/providers' into sigstore/sigstore.

@wlynch Are we good to close this and punt til sigstore-go?

verification of `gcpkms://` requires overly broad permissions

Closing as WAI

Fuzz - Reduce the corpus input size for RSA and ed25519

Is this still an issue @naveensrinivasan ?

move tlog pkg functionalities to sigstore

Closing as this will be a part of sigstore-go