TUF integration #274

bdehamer · 2023-01-27T23:12:05Z

Summary

Integrates the tuf-js library and wires it up to the Sigstore TUF repository.

The current implementation queries the TUF repo for the various Rekor/Fulcio/CTFE keys/certs and assembles them into a structure which matches TrustedRoot protobuf. At some point, the Sigstore TUF repo will provide a serialized version of the TrustedRoot directly and a lot of this code will go away (sigstore/root-signing#584).

feelepxyz

Awesome! Looks broadly good, the one thing I'm wondering about is error handling in downstream users like npm. Will we be able to catch and show helpful errors or retry? Worth adding any tests around errors fetching these tuf files?

src/sigstore.ts

src/tuf/index.ts

bdehamer · 2023-01-31T16:55:28Z

I'm wondering about is error handling in downstream users like npm. Will we be able to catch and show helpful errors or retry? Worth adding any tests around errors fetching these tuf files?

I updated things a bit so that errors thrown from our TUF client are caught and rethrown as something that will be more friendly to sigstore-js consumers. Retry on error is already something baked-in to the TUF client so we don't need to do anything here.

src/__tests__/tuf/trustroot.test.ts

src/sigstore.ts

src/tuf/index.ts

src/tuf/trustroot.ts

kommendorkapten · 2023-02-01T09:49:39Z

Nice job 👍

Signed-off-by: Brian DeHamer <[email protected]>

Assembles a TrustedRoot from cert/key material in the Sigstore TUF repository. Signed-off-by: Brian DeHamer <[email protected]>

Signed-off-by: Brian DeHamer <[email protected]>

kommendorkapten

Nice work!

feelepxyz · 2023-02-06T10:02:16Z

src/sigstore.ts

+function defaultCacheDir(): string {
+  let cacheRootDir = os.homedir();
+  try {
+    fs.accessSync(os.homedir(), fs.constants.W_OK | fs.constants.R_OK);


TIL about fs.access, nice!

feelepxyz · 2023-02-06T10:03:26Z

Awesome work getting this in! 🥳

bdehamer requested a review from a team as a code owner January 27, 2023 23:12

bdehamer force-pushed the bdehamer/tuf branch 2 times, most recently from deeaac8 to 7f6a9ef Compare January 27, 2023 23:27

feelepxyz reviewed Jan 29, 2023

View reviewed changes

src/sigstore.ts Outdated Show resolved Hide resolved

src/tuf/index.ts Show resolved Hide resolved

src/tuf/index.ts Show resolved Hide resolved

bdehamer force-pushed the bdehamer/tuf branch 3 times, most recently from 8a53f0f to f6fd64c Compare January 31, 2023 16:49

bdehamer force-pushed the bdehamer/tuf branch from f6fd64c to 8a994bc Compare January 31, 2023 17:09

bdehamer requested a review from kommendorkapten January 31, 2023 17:13

bdehamer force-pushed the bdehamer/tuf branch from 8a994bc to 2f2d2d9 Compare January 31, 2023 20:49