Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Evidence resolution: fetch and re-appraise what an evidence reference points to

Aperta
  • Qualcosa non va?
#441 1 commento 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
30/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Ambito
security

Direzione di ricerca

Start with docs/rfcs/composite-component-appraisal.md §9 and open question 4, then review #439 for the SEV-SNP packets and appraisals. Define per-profile fetching, re-appraisal scope, retention, and fetch-failure status, and resolve whether resolver should be required in light of COMP-EVID-003. Done means the specification covers these decisions for the SEV-SNP execution profile and addresses backward compatibility.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Spec section affected
None yet. docs/rfcs/composite-component-appraisal.md §9 and open question 4, from #439.

Problem
Every component carries evidence_refs, each with a profile, a media type and a SHA-256 digest of the evidence the appraiser held. The relying party checks that the references are present and that their profiles match the component's. It never fetches the evidence. So a verifier-signed reference proves the verifier referred to that digest, and nothing more.

same-evidence-v1 makes this sharper. It shows that two appraisals cite one evidence object, for example the execution and platform-collateral components from one SEV-SNP packet. It does not show that each appraisal read the part of the object it claims.

Proposed change
Define resolution per evidence profile:

  • who fetches, and from where (the resolver hint is untrusted today);
  • what the relying party re-appraises, and whether that is the whole appraisal or a named subset;
  • retention;
  • the status reported when a fetch fails. The original design said unverifiable, not contraindicated, unless other evidence contradicts the claim.

Start with the SEV-SNP execution profile, where #439 already has real packets and both appraisals.

If resolution is specified, revisit whether resolver becomes required. The first draft of the requirements had it required, and COMP-EVID-003 records the divergence.

Backward compatibility

  • Non-breaking (new optional field, informative addition)

Motivation
Without resolution, component evidence is a signed pointer. This is the largest open piece behind the profile.

Related issues or PRs
#439

Generated with Claude Code

Lingua principale
Python
Stelle
37
Fork
33
Merge medio
1g 4h
PR unite (30g)
122

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di agentrust-io/trace-spec

Tutte le issue di agentrust-io/trace-spec

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.