CNCF: Evaluate and implement software attestation capabilities
Maintainers usually reply within 1 day
Nobody has claimed this yet.
- #4619 by @cheese-cakee — closed without merging
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 8/100
Research direction
This is an evaluation-and-design task: start with the linked in-toto, SLSA and SCITT specifications in the appendix and the TAG-Security assessment it references, then survey the WasmEdge runtime for where signing/verification of modules already happens. A prior attempt exists as closed, unmerged pull request #4619, which is worth reading before proposing anything. "Done" here is a design decision plus scoping for an implementation, not a single patch.
Written by the indexing model from the issue text.
Description
Summary
The TAG-Security assessment suggests evaluating whether WasmEdge should implement software attestation for edge devices and supply chain attestations using frameworks like in-toto, SLSA, or SCITT.
Software attestation would provide:
- Verification of software running on edge devices
- Supply chain security guarantees
- Trust establishment in distributed edge environments
- Compliance with emerging security standards
Appendix
- Dominant language
- C++
- Stars
- 10.8k
- Forks
- 1.2k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 48
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from WasmEdge/WasmEdge
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
bug: AOT/JIT leave the address of an atomic store on the operand stack (wrong result, ill-typed IR)Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
bug: universal wasm output stores a wrong code address for function 0 when the object references an external symbol starting with f or t (fmaxf)Possibly taken @xmzyshypnc claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
WasmEdge/WasmEdge#5521 · 6 comments ·
Maintainers usually reply within 1 day
-
bug(wasi_crypto): ArrayOutput::pull reports the wrong all-pulled flagPossibly taken @Yashbhu claimed this 24 days ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Maintainers usually reply within 1 day
All issues in WasmEdge/WasmEdge
Similar issues
-
Malformed mark-up in translationsPossibly taken A pull request linked to this issue is open or already merged. OpenBug Translations
Difficulty 1/5 1-3 hours Newbie friendliness 82/100
wesnoth/wesnoth#11728 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
rpm-software-management/dnf5#3043 ·
Maintainers usually reply within 3 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 3 days
-
backlog
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
EchoTools/nevr-runtime#2385 ·
Maintainers usually reply within 1 day
-
needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
AustinKelsay/dnd-diceroll#200 ·
Maintainers usually reply within 1 day