Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CNAB Security 301: Metadata repositories #281

Merged
merged 19 commits into from
Jan 31, 2020
Merged

CNAB Security 301: Metadata repositories #281

merged 19 commits into from
Jan 31, 2020

Conversation

trishankatdatadog
Copy link
Member

@trishankatdatadog trishankatdatadog commented Sep 16, 2019 •
edited
Loading

Part of #253

WIP: please do not merge yet!

Major TODOs:

  • Be more explicit about metadata living on OCI artifacts (or not, completely optional)
  • Start with concepts, and one good way to do it, for example everything with online keys first
  • We can talk about the four top-level roles, distinguish between online and offline keys, talk about possible delegations (keep it optional), talk about one possible implementation for one project
  • Radu: will work on known implementations
  • Move multiple projects to an Appendix, it's too complicated
  • Security analysis

@trishankatdatadog trishankatdatadog changed the title CNAB Security (301): Metadata repositories CNAB Security 301: Metadata repositories Sep 16, 2019
@trishankatdatadog trishankatdatadog mentioned this pull request Sep 16, 2019
Merged
9 tasks
radu-matei
radu-matei reviewed Sep 19, 2019
View reviewed changes
.vscode/settings.json Outdated Show resolved Hide resolved
radu-matei
radu-matei reviewed Sep 19, 2019
View reviewed changes
CNAB.code-workspace Outdated Show resolved Hide resolved
@trishankatdatadog
Copy link
Member Author

Unless @radu-matei has major objections, I am going to consider this PR done for now, and move on to 302 and 303

@trishankatdatadog trishankatdatadog force-pushed the trishankatdatadog/add-metadata-repositories branch from 5b1119f to 946287d Compare December 10, 2019 19:39
@trishankatdatadog
Copy link
Member Author

Sorry this took so long, but was busy with another TUF + in-toto project at work!

This is now ready for review. Could @radu-matei or @squillace take a look? Thanks!

glyn
glyn reviewed Dec 18, 2019
View reviewed changes
301-metadata-repositories.md Outdated Show resolved Hide resolved
vdice
vdice reviewed Dec 23, 2019
View reviewed changes
Copy link
Member

@vdice vdice left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reads great! LGTM. A few minor notes.

301-metadata-repositories.md Outdated Show resolved Hide resolved
301-metadata-repositories.md Outdated Show resolved Hide resolved
301-metadata-repositories.md Outdated Show resolved Hide resolved
technosophos
technosophos approved these changes Jan 15, 2020
View reviewed changes
Copy link
Member

@technosophos technosophos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left only one nit comment, but I think this is a satisfactory draft of the section. I think we should merge it and allow future changes to be done as separate PRs.

301-metadata-repositories.md Show resolved Hide resolved
@trishankatdatadog
Copy link
Member Author

Thanks very much, @technosophos!

@glyn Would you be happy if we merge this PR as a WD for now, and address your concern about clarifying multiple repositories in a follow-up PR?

@radu-matei Would you please 👀 and ✅?

@glyn glyn mentioned this pull request Jan 16, 2020
Closed
@glyn
Copy link
Contributor

glyn commented Jan 16, 2020

@glyn Would you be happy if we merge this PR as a WD for now, and address your concern about clarifying multiple repositories in a follow-up PR?

Sure. I raised #314 so this doesn't get forgotten.

@trishankatdatadog trishankatdatadog force-pushed the trishankatdatadog/add-metadata-repositories branch from e0e00fa to 2d65fbc Compare January 16, 2020 18:32
@trishankatdatadog
Copy link
Member Author

Forced-push to keep DCO happy 😒

@trishankatdatadog
Copy link
Member Author

@radu-matei Can you please 👀 and ✅ ?

radu-matei
radu-matei approved these changes Jan 29, 2020
View reviewed changes
Copy link
Member

@radu-matei radu-matei left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment here - could you please rebase?
Thanks!

@trishankatdatadog
WIP on 301: metadata repositories
56ae29b 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
some WIP
432c169 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
nearly done with first draft
1d041a6 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
add (new|claimed)-bundles example metadata
3aad9f5 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
correctly backtrack vs terminate delegations
0297541 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
update picture
20a75a7 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
ignore VSC files
14b5a7c 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
no spaces between /
b5fb6af 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
massively simplify stuff
bd62364 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
metadata repos physically distinct or not from cnab registry
8d4ae9a 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
revamp concepts in the introduction
c354823 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
write text for MVP
8acedc5 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
finish security analysis
2b9c9b9 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
add newline
5596fbf 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
clarify that MVP is optimized for DCT/Notary 0.6.1
73cf251 
also clarify where online and offline keys are kept for MVP

Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
remove unnecessary term "project"
339fa9c 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
add a note about different servers
7bd1fef 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
address @vdice feedback
b4fe450 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog
address @technosophos feedback
c9b00fc 
Signed-off-by: Trishank K Kuppusamy <[email protected]>
@trishankatdatadog trishankatdatadog force-pushed the trishankatdatadog/add-metadata-repositories branch from 2d65fbc to c9b00fc Compare January 29, 2020 16:28
@trishankatdatadog
Copy link
Member Author

trishankatdatadog commented Jan 29, 2020 •
edited
Loading

@radu-matei Done! Can you please merge? :)

@radu-matei radu-matei merged commit 5d07a43 into cnabio:master Jan 31, 2020
@trishankatdatadog trishankatdatadog deleted the trishankatdatadog/add-metadata-repositories branch January 31, 2020 20:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@glyn glyn glyn left review comments

@vdice vdice vdice left review comments

@technosophos technosophos technosophos approved these changes

@radu-matei radu-matei radu-matei approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@trishankatdatadog @glyn @technosophos @vdice @radu-matei