asraa

C++ URI validation in Envoy

2

Looks like Envoy is using C++ URI validations in StsService: https://github.com/envoyproxy/envoy/blob/062c895f499382ae61dead16db2a7e78b9146525/api/envoy/api/v2/core/grpc_service.proto#L94 Config validations throw an unimplemented exception when initializing the server (rather than a controlled a `ProtoValidation` error). https://oss-fuzz.com/testcase-detail/5665272556158976 It...

fix: make rekor verify work with sharded uuids

5

Signed-off-by: Asra Ali #### Summary Fixes https://github.com/sigstore/rekor/issues/877 See issue for the problem: `rekor verify` didn't work with sharding: If the requested UUID was a sharded Entry UUID (Tree ID +...

Sharding: Will using a virtual index impact inclusion verification?

5

**Description** Verification of the inclusion proof relies on the log index and the tree size. Using a virtual index will likely modify the calculation of the inclusion proof, resulting in...

Support Roughtime types in Rekor

3

**Description** Add an additional timestmaping type to Rekor. Roughtime is a modern timestamping standard https://blog.cloudflare.com/roughtime/ In addition to supporting RFC 3161 for compatibility (eg https://github.com/sigstore/gitsign/issues/22#issuecomment-1126291036), Rekor could also log Roughtime...

Question: How will clients interact with sharded rekor instances when verifying?

5

**Description** I'm thinking of rekor sharding, and how it will interact with how we verify rekor entries. Particularly, how do we fetch the correct Rekor Pubs for the shard in...

Add container simple signing type

4

Signed-off-by: Asra Ali Adds a container type which understands simple signing payloads. This allows upload where the container signed can be indexed in the rekor entry. Adds search by reference...

New Type based on Container signing specification

6

**Description** This would be a rekor type specifically for container signatures (https://github.com/containers/image/blob/main/docs/containers-signature.5.md). This came up because cosign upload the hash of the entire signed payload, and rekor does not understand...

Signed Note verification question

6

When verifying SignedNotes, we never check that the loaded public key matches the hash. I think the only purpose is for easy lookup and early rejection in case none of...

Get signed proof from rekor for bundled cosign signatures

5

**Description** This is for getting bundling (https://github.com/sigstore/cosign/issues/181) working. When cosign uploads the {signature, public key, payload} to rekor, we need rekor to provide proof that the entry is in the...

Implement TAP 4: Multi-repository mappings

6

This tracking issue is to implement [TAP 4](https://github.com/theupdateframework/taps/blob/master/tap4.md): Multiple repository consensus on entrusted targets. To implement this, I propose creating a NEW type `MultiRepositoryClient` which takes a `map.json` file. It...