laurentsimon

Transferring this issue to the slsa-verifier repo

v0.2 provenance does not have a stable builder ID, so we may defer implementation to v1.0

not. blocker for the release. We can iterate on this one.

I think we're talking about 2 different things and both have value :) 1. When connecting to rekor, ensure the TLS connection verifies presence of the cert in the CT...

Yes. I'm realizing this may not be strictly necessary for verification, since TUF does not need TLS. Maybe better suited for the generator during OIDC cert with Fulcio; it would...

let's also add a comment in the code that CT is verified for leaf certs, as per https://github.com/sigstore/cosign/blob/5d2964c3d7cb33dada6e945aac2c80008780475d/pkg/cosign/verify.go#L237

NOTE: this is also useful in the context of SBOMs. If the trusted builder only generates binaries, the SBOM builder may want to re-use the existing provenance and append to...

note: we currently verify the image 'immutability' before the API call https://github.com/slsa-framework/slsa-verifier/blob/main/cli/slsa-verifier/verify/verify_image.go#L56. This should probably be handled within the API instead

> Verifying the sigs match implicitly verifies the public key of the cert, since, except at very statistically improbable events, no two pks should give the same sigs on the...

re-opening based on today's discussion. We will support the trusted builder.