Consider endorsing/using Sigstore
@BethGriggs 已经在做这个了。
开始于 2022年11月23日。
评估
这个 Issue 还没有评估数据。
描述
Proposal/Exploration document: Sigstore for Node.js binaries
I believe it is important to reflect on the fundamental problems we are seeking to address and whether Sigstore tooling helps us to solve them. I've heard various community members suggest for us to adopt Sigstore tooling - I'm curious to hear the origins of those suggestions. So, my main ask is:
- What are the problems that we're trying to solve?
- How do we believe Sigstore is solving them?
While there are some potential benefits, from my exploration there are also tradeoffs to consider such as:
- What does this provide to end-users in comparison to our current method of signing and verifying with GPG keys?
- How many users will benefit from it?
- Effort/cost of migrating to new tooling.
- Concerns raised around delegation of trust.
Anyone with an interest, please free to review this Sigstore for Node.js binaries document. The current state of that document is somewhere between a personal scratch-pad of notes and an evolving proposal draft. I hope for that document to eventually help us converge on a decision or outcome of whether we feel Sigstore would add value for the Node.js project to adopt (or not).
cc groups that may have opinions: @nodejs/release, @nodejs/build, @nodejs/security, @nodejs/tsc
Initial suggestion
Chatting with some of the folks working on Rekor (https://rekor.dev/get_started/), they've suggested that it might be something we wish to explore/endorse for Node.js releases.
I will likely not explain it as well as the Rekor folks, but the ledger would be a source of truth for the URL, SHA, Public Key, and Signature of our releases that users can validate against. I believe there is also alerting we could set up - for example, if an old/previous release key was used to sign a release.
They have offered to give us an overview if there's interest. I also believe they've prototyped a ledger for Node.js releases.
cc: @nodejs/build
also cc (from rekor): @bobcallaway @dlorenc @lukehinds
- 主要语言
- JavaScript
- 星标
- 4.4k
- 派生
- 675
- 平均合并
- 22 小时 29 分钟
- 30 天内合并 PR
- 1
贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
nodejs/Release 的其他 Issue
-
难度 1/5 1 小时以内 新手友好度 88/100
-
Release-agenda
难度 1/5 1-3 小时 新手友好度 78/100
-
CitGM backlog 未关闭
难度 4/5 3-5 天 新手友好度 50/100
-
难度 1/5 1 小时以内 新手友好度 20/100
-
难度 1/5 1 小时以内 新手友好度 35/100
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 82/100
-
area-deployment area-integrations triage:bot-seen
难度 2/5 半天 新手友好度 86/100
-
Issue-Bug
难度 2/5 1-3 小时 新手友好度 68/100
sugarlabs/musicblocks#8924 ·
-
难度 1/5 1 小时以内 新手友好度 90/100
ArduPilot/ardupilot_wiki#8088 ·
-
[BUG] createTool tools cannot be registered with Mastra when exactOptionalPropertyTypes is enabled 未关闭customer-eng status: needs triage
难度 2/5 1-3 小时 新手友好度 84/100