This commit moves existing implementations of attestation predicates into
subpackages to start supporting multiple versions in parallel.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
This is a massive commit that isn't easy to split up, my apologies to
reviewers. Here's everything that's happening.
First, the base tuf package now includes interfaces for RootMetadata,
TargetsMetadata, Rule, and Principal. The first two are self-explanatory. Rule
represents some protection rule, currently matched by the Delegation schema,
while Principal defines a new take on who a trusted party is. Existing schemas
have been moved into a v01 subpackage. v01 also includes a Key type based on
signerverifier.SSLibKey which implements the Principal interface. This means
that expectations elsewhere (such as in repository and policy) re a principal
can be met by existing policy metadata.
Second, with most of the policy metadata manipulations having moved to the tuf
package, this commit drops them from the policy package as they were thin
wrappers. While we originally kept them around for the purposes of migrating
versions when a repository must move from the old metadata schema to a newer
one, it doesn't make sense to implement this in every individual manipulation
function.
Finally, the rest of the packages that handle keys (for adding to metadata or
for signing / verifying) have been updated to use either
signerverifier.SSLibKey directly or the new Principal interface, depending on
what the purpose is. For now, the idea is to continue using the
signerverifier.SSLibKey representation of a key itself for the signature
verification flows, though we may eventually move that into gittuf rather than
rely on go-securesystemslib. Note that some of the transitions have been
included in this commit for compatibility reasons, and subsequent PRs will
update that. For example, the GitHub app pull request approval attestation must
be updated to not use tufv01.Key objects to represent approvers.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
This vendors go-securesystemslib's dsse package in preparation for
adding support for DSSE signature extensions.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
This commit includes several changes discussed with @wlynch synchronously.
Broadly speaking, the biggest changes are allowing the use of multiple apps in
tandem. There are some supporting changes such as making the GitHub instance
URL a parameter to the CLI / API rather than something read from the
environment.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
The code review approval layer is now agnostic to the code review system used.
The only system supported at the moment is GitHub's pull request approvals, but
we should be able to extend this to support GitLab, Gerrit, etc.
In addition, the GitHub app key add endpoint docs have been updated to clarify
what the purpose of the key is.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
