mirror of
https://github.com/vee1e/gittuf.git
synced 2026-09-03 11:17:08 +00:00
2f0be5c46f
This is a massive commit that isn't easy to split up, my apologies to reviewers. Here's everything that's happening. First, the base tuf package now includes interfaces for RootMetadata, TargetsMetadata, Rule, and Principal. The first two are self-explanatory. Rule represents some protection rule, currently matched by the Delegation schema, while Principal defines a new take on who a trusted party is. Existing schemas have been moved into a v01 subpackage. v01 also includes a Key type based on signerverifier.SSLibKey which implements the Principal interface. This means that expectations elsewhere (such as in repository and policy) re a principal can be met by existing policy metadata. Second, with most of the policy metadata manipulations having moved to the tuf package, this commit drops them from the policy package as they were thin wrappers. While we originally kept them around for the purposes of migrating versions when a repository must move from the old metadata schema to a newer one, it doesn't make sense to implement this in every individual manipulation function. Finally, the rest of the packages that handle keys (for adding to metadata or for signing / verifying) have been updated to use either signerverifier.SSLibKey directly or the new Principal interface, depending on what the purpose is. For now, the idea is to continue using the signerverifier.SSLibKey representation of a key itself for the signature verification flows, though we may eventually move that into gittuf rather than rely on go-securesystemslib. Note that some of the transitions have been included in this commit for compatibility reasons, and subsequent PRs will update that. For example, the GitHub app pull request approval attestation must be updated to not use tufv01.Key objects to represent approvers. Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net> |
||
|---|---|---|
| .. | ||
| dsse.go | ||
| dsse_test.go | ||