notation
notation copied to clipboard
notaryproject
Threat Modeling for notation
Threat modeling involves identifying ways that an adversary might try to attack notation and then designing mitigations to prevent, detect or reduce the impact of those attacks.
Aspects: Dir + Config+Registry Interaction TS+TP+Envelope
Discussed on community call today. Would be good to have some brief things written out for process of trying to find vulnerabilities and then if issue(s) found, file issue(s) to help mitigate. Idea would be work shared amongst dev area ownership for those who are most familiar with codebase. Needs estimate.
Putting this for RC-1, but this would be last thing which could potentially be cut and pushed to RC-2. IMO - I believe would be good right after RC-1 and if we find things, ok to release shortly after fix/patches from RC-1.
Confirmed to move this issue out of rc-1 scope. Now moved to "Discuss". We will review all the issues later for rc-2 release scope.
Closed as completed see https://github.com/notaryproject/specifications/blob/main/threatmodels/notation-threatmodel.md