Clarified how clients should work with the trust root during rotations #210
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Fredrik Skogman <[email protected]>
Signed-off-by: Fredrik Skogman <[email protected]>
kommendorkapten
force-pushed
the
clarify-rotations
branch
from
d20b224 to
a3c1cb9
Compare
protos/sigstore_trustroot.proto
Outdated
| // order, that is, the oldest instance first. Only the last instance is | ||
| // allowed to have their 'end' timestamp unset. All previous instances MUST | ||
| // have a closed interval of validity. The last instance MAY have a closed | ||
| // interval. |
There was a problem hiding this comment.
The last instance MAY have a closed interval.
What is the use case for this?
There was a problem hiding this comment.
I can't think of a good reason I wanted to do so, but as an example, the current Fulcio root expires Not After : Oct 5 13:56:58 2031 GMT and I think it should be ok to have that value as end.
And also this makes the language clear that clients must not treat the last instance with an open interval in any specific way.
| // | ||
| // To be able to manage planned rotations of either transparency logs or | ||
| // certificate authorities, clienst MUST accept lists of instances where | ||
| // the last instance have a 'valid_for' that belongs to the future. |
There was a problem hiding this comment.
+1, thanks for mentioning this.
Signed-off-by: Fredrik Skogman <[email protected]>
haydentherapper
approved these changes
Feb 2, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Clarified how clients should interpret the trust root with respect to rotations of trusted material
Release Note
Documentation
N/A
ping: @loosebazooka @codysoyland @bdehamer @haydentherapper @woodruffw