Jussi Kukkonen
Jussi Kukkonen
During #910 development the test suite was passing but a simply running this failed with InvalidSCTKeyError: ``` sigstore sign README.md sigstore verify identity --cert-identity $ID --cert-oidc-issuer $ISSUER README.md ``` The...
**Description** * trusted_root.json contains urls for each rekor key: this makes sense since the point is to be able to have multiple logs. * same goes for fulcio (although only...
**Description** Joshuas original TUF PR and the "sigstore TUF client" design doc contain the idea of not fetching remote metadata if it's not required: * the PR just checked if...
### Update to new (currently unreleased) securesystemslib API * API changes covered: * keys and interface modules removed * SSlibSigner removed * CryptoSigner added: this replaces the removed functionality *...
Enable linters: * flake8-unused-arguments * flake8-executable * pygrep-hooks * flake8-pie * flake8-pyi * flake8-raise * flake8-self These were all low hanging fruit where ruff can autofix or where there were...
I've spent far too long in the past week looking at CDN logs... I collected some notes from this, and wrote a first draft of a blog post or something....
ngclient accesses `SimpleEnvelope._DEFAULT_PAYLOAD_TYPE`. flake8-self linter complains about this, I think correctly. If we use the value from a different module, it should be public CC @lukpueh for comment
sigstore-conformance 0.11 supports testing against staging infrastructure. This requires two things: * Support the optional `--staging` in all commands Sigstore-Java CLI, see [CLI protocol](https://github.com/sigstore/sigstore-conformance/blob/main/docs/cli_protocol.md) * Add the extra call in...
While I was readin up on passim (a mDNS based content addressable storage) I noticed that their main use case fwupd does not use passim for artifact downloads because of...
> Implementation Version(s) Covered: v0.12.* We're 9 versions behind :grimacing:. If we do update this, I think we should try to improve content as well: * A lot of the...