Requirements gathering

[lukehinds]

Let's formulate a list of what we need to develop / migrate into sigstore-go

Please make recommendations below and I will edit them into a list, we can then break those out into issues to be assigned and start setting some milestones.

/pkg/cosign

• tlog operations (upload, verify etc)
• assignee:

pkg/fulcio:

• Verification of Fulcio certs
• assignee:
• Verification of SCT
• assignee:

signing:

• define Option structs like what we have for verification
• assignee:
• Root of trust opts for TUF
• assignee:

verification:

• implement option structs
• assignee:

misc:

• Root of trust interface (This is ongoing in protobuf-specs)
• assignee:
• No environment variables - Clients should put env var values into the opts structs
• assignee:

cc @znewman01 @imjasonh @malancas @codysoyland @haydentherapper

[haydentherapper]

Copying in some ideas from a brainstorming session we did a little bit ago, feel free to say yay or nay!

There's also sigstore/sigstore-go#3.

• No CLI - Cosign will continue to be the CLI for signing containers. Open question of if we want a dedicated tool for blob signing.
• pkg/rekor
  • Verification of log entries, inclusions proofs, SETs, etc
  • Client interactions
• pkg/fulcio
  • Verification of Fulcio certs
  • Verification of SCT
  • Client interactions
• signing:
  • define Option structs like what we have for verification
  • Root of trust opts for TUF
• verification
  • option structs
• Root of trust interface - This is ongoing in protobuf-specs
• No environment variables - Clients should put env var values into the opts structs

[lukehinds]

See sigstore/sigstore-go#3