Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support arbitrary blob signing #283

Merged
merged 26 commits into from
Feb 26, 2024
Merged

Support arbitrary blob signing #283

merged 26 commits into from
Feb 26, 2024

Conversation

rgnote
Copy link
Contributor

@rgnote rgnote commented Nov 8, 2023

Spec updates for Arbitrary blob signing. Proposal https://hackmd.io/ewbJr2ZnT4a8U1ObDVXcSw?view#CLI-Spec

Issue : #281

Signed-off-by: rgnote [email protected]

@rgnote rgnote changed the title Blob Support arbitrary blob signing Nov 8, 2023
Copy link
Contributor

@yizha1 yizha1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @rgnote

specs/signature-envelope-cose.md Outdated Show resolved Hide resolved
media/detached-signature-specification.svg Outdated Show resolved Hide resolved
media/detached-signature-specification.svg Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signature-envelope-jws.md Outdated Show resolved Hide resolved
specs/signature-envelope-jws.md Outdated Show resolved Hide resolved
Copy link
Contributor

@Two-Hearts Two-Hearts left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like changes related to trust policy version 1.1 is not included in this PR?
/cc: @yizha1 @priteshbandi

Nvm, just notice that there will be other PRs.

Copy link
Contributor

@Two-Hearts Two-Hearts left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@yizha1 yizha1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @rgnote just one comment. Overall looks good.

specs/signature-specification.md Show resolved Hide resolved
Copy link
Contributor

@priteshbandi priteshbandi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall LGTM, added some nits

specs/signature-envelope-cose.md Outdated Show resolved Hide resolved
specs/signature-envelope-cose.md Outdated Show resolved Hide resolved
specs/signature-specification.md Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
@rgnote
Copy link
Contributor Author

rgnote commented Nov 22, 2023

@yizha1 I'm raising a separate PR for them. I'm fine if we want to hold off until we have that PR ready.

yizha1
yizha1 previously approved these changes Nov 23, 2023
Copy link
Contributor

@yizha1 yizha1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. We can open PRs for other specifications.

@rgnote
Copy link
Contributor Author

rgnote commented Nov 23, 2023

specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signing-and-verification-workflow.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
Copy link
Contributor

@gokarnm gokarnm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed signature spec and signing/verification workflow. Yet to review trust store and policy.

specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signing-and-verification-workflow.md Outdated Show resolved Hide resolved
specs/signing-and-verification-workflow.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signing-and-verification-workflow.md Outdated Show resolved Hide resolved
specs/signing-and-verification-workflow.md Outdated Show resolved Hide resolved
Copy link
Contributor

@gokarnm gokarnm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done reviewing all changes.

specs/signature-envelope-cose.md Outdated Show resolved Hide resolved
specs/signature-envelope-jws.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
specs/signature-specification.md Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signing-and-verification-workflow.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
gokarnm
gokarnm previously approved these changes Dec 13, 2023
Copy link
Contributor

@gokarnm gokarnm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Added minor comments.

media/detached-signature-specification.svg Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
media/detached-signature-specification.svg Outdated Show resolved Hide resolved
specs/signature-envelope-cose.md Outdated Show resolved Hide resolved
specs/signature-envelope-cose.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signature-specification.md Outdated Show resolved Hide resolved
specs/signing-and-verification-workflow.md Outdated Show resolved Hide resolved
specs/signing-and-verification-workflow.md Outdated Show resolved Hide resolved
specs/signing-and-verification-workflow.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
specs/trust-store-trust-policy.md Outdated Show resolved Hide resolved
rgnote and others added 22 commits February 26, 2024 14:44
Signed-off-by: rgnote <[email protected]>
* Update threat model to add rollback attack

Signed-off-by: Pritesh Bandi <[email protected]>
Signed-off-by: rgnote <[email protected]>
Co-authored-by: Patrick Zheng <[email protected]>
Signed-off-by: Rakesh Gariganti <[email protected]>
Signed-off-by: rgnote <[email protected]>
Co-authored-by: Pritesh Bandi <[email protected]>
Signed-off-by: Rakesh Gariganti <[email protected]>
Co-authored-by: Pritesh Bandi <[email protected]>
Signed-off-by: Rakesh Gariganti <[email protected]>
Co-authored-by: Pritesh Bandi <[email protected]>
Signed-off-by: Rakesh Gariganti <[email protected]>
Co-authored-by: Pritesh Bandi <[email protected]>
Signed-off-by: Rakesh Gariganti <[email protected]>
Signed-off-by: rgnote <[email protected]>
Signed-off-by: rgnote <[email protected]>
Signed-off-by: rgnote <[email protected]>
Signed-off-by: rgnote <[email protected]>
Signed-off-by: rgnote <[email protected]>
@priteshbandi priteshbandi merged commit f2d8f8f into notaryproject:main Feb 26, 2024
1 check passed
Copy link
Contributor

@gokarnm gokarnm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks @rgnote for working through iterations and getting a final version out!

rgnote added a commit to notaryproject/notation that referenced this pull request Mar 8, 2024
CLI Spec updated for Arbitrary blob signing. Proposal
https://hackmd.io/ewbJr2ZnT4a8U1ObDVXcSw?view#CLI-Spec and
https://hackmd.io/@-KPyDkW6QfGA-pldFa13pA/ByuHffALa

Signing Scheme and trust policy updates :
notaryproject/specifications#283

Signed-off-by: rgnote <[email protected]>

---------

Signed-off-by: rgnote <[email protected]>
Signed-off-by: Patrick Zheng <[email protected]>
Signed-off-by: Feynman Zhou <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Cameron Rozean <[email protected]>
Signed-off-by: Yi Zha <[email protected]>
Signed-off-by: Rakesh Gariganti <[email protected]>
Signed-off-by: Junjie Gao <[email protected]>
Signed-off-by: Toddy Mladenov <[email protected]>
Co-authored-by: Patrick Zheng <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Feynman Zhou <[email protected]>
Co-authored-by: Cameron Rozean <[email protected]>
Co-authored-by: Yi Zha <[email protected]>
Co-authored-by: Shiwei Zhang <[email protected]>
Co-authored-by: Milind Gokarn <[email protected]>
Co-authored-by: Junjie Gao <[email protected]>
Co-authored-by: Toddy Mladenov <[email protected]>
Co-authored-by: Pritesh Bandi <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants