Hayden B

Replace the timestamping authority

16

**Description** The timestamping authority is being removed as per https://github.com/sigstore/rekor/issues/812. We will replace it with an improved timestamping authority that will live in its own repository or run as a...

Improvements to rekor-cli verify command

2

**Description** * verify should verify a signed tree head (STH) signature * verify should verify the STH signature uses the Rekor public key from TUF, not from the public key...

Improve the timestamping authority PKI

2

**Description** Currently, we must manually update the timestamping authority certificate chain every 6 months. Additionally, each instance of Rekor generates its own signing certificate on startup, so it is difficult...

Designing list of requirements for new IDPs for public good deployment

4

**Description** In today's community meeting, we discussed two ways of supporting new IDPs: * Integrating with Dex * Adding the IDP directly to Fulcio's OIDC issuer config list We need...

Document process for creating a new CT log shard

14

**Description**

Enforce that identities are of an expected format

5

**Description** Dex - Look like email, K8S - Look like a service account, Username - Doesn't look like an email, etc Context: https://docs.google.com/document/d/1o8_bXIygufgiohJGlmBzqF4_BnXCTfgh4ILgJFJxYRs/edit?resourcekey=0-YEar3v67uoT31kj83dCVvA#heading=h.oiw6nn1ucgaq

API improvement: Specify digest of artifact in certificate

5

**Description** Consider the following attack: * Client generates keypair K * Client fetches a Fulcio certificate * Client uploads signature over artifact and Fulcio certificate to Rekor log * A...

Support verifying offline Rekor bundles

6

**Description** As described in the [specification](https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md), a Rekor response can be stored and verified without hitting the log. The client should: * Verify the SET * Verify that the signature...

CIFuzz CI failure on merge

2

**Description** **Version** https://github.com/sigstore/sigstore/actions/runs/3176930023/jobs/5176789186

Correctness issue: Change to batched entry upload to support witnessing

5

Witnesses monitor the consistency of the log, verifying that the log is append-only and immutable. Roughly, the verification process for a witness is: * Persist a checkpoint (signed tree head)...