protobuf-specs
protobuf-specs copied to clipboard
sigstore
Protocol Buffer specifications
Currently the [trust root](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_trustroot.proto) specifies roots of trust from services (CA, CT log, Rekor, and TSA). For bring-your-own-PKI use cases where verifiers trust a set of keys, rather than certificates,...
Since we've added an issue template in the repo, it means we won't inherit templates from the organization (https://github.com/sigstore/.github/tree/main/.github/ISSUE_TEMPLATE). This duplicates the bug and enhancement templates #### Summary #### Release...
We've got a lot of bundle versions floating out there. Well, really just two. But soon, there will be three! What do y'all thinking about a CLI to "upgrade" a...
Per https://github.com/sigstore/sig-clients/issues/8: releasing a 1.0 version of the specs here would lend weight to cross-client standardization. As part of that, we probably need a task burndown, along a few axes:...
Not sure if this is a good idea, or expands the focus of this repo too much; opening for discussion. Context: * Sigstore bundles support DSSE envelopes (`Bundle.dsse_envelope`), and fully...
We already have message types defined that describe the inputs to the verification process (`Bundle`, `TrustedRoot`, `ArtifactVerificationOptions`) so it seems reasonable to also define a standardized verification response. This will...
Right now it's a manual process of looking through commits since the last cut
When working on https://github.com/sigstore/protobuf-specs/pull/112 I realised that the namely/protoc-all seems to be closed source, and it's very old (Debian Bullseye) which as an example lacks a new Go toolkit (only...
This repository currently contains a copy of the in-toto envelope message definitions, tweaked slightly to influence code generation: https://github.com/sigstore/protobuf-specs/blob/85dce20afb5e8ad9e170328abb7ff2e61b758958/protos/envelope.proto These message definitions currently declare their package namespace as `io.intoto`, which...
[buf](https://github.com/bufbuild/buf) seems to provide some tooling to concretize some of the per-language `.proto` compilation. For example, with Rust: https://docs.rs/protoc-gen-prost/latest/protoc_gen_prost/#usage-with-buf
