improve KindVersion compatibility #1370
Conversation
Signed-off-by: Ramon Petgrave <[email protected]>
Signed-off-by: Ramon Petgrave <[email protected]>
This reverts commit 79a6d31. Signed-off-by: Ramon Petgrave <[email protected]>
Signed-off-by: Ramon Petgrave <[email protected]>
Signed-off-by: Ramon Petgrave <[email protected]>
Signed-off-by: Ramon Petgrave <[email protected]>
There was a problem hiding this comment.
Can you confirm I've understood correctly: we have two ways to deserialize some sort of log entry:
_from_response()that deserializes the rekor v1 response (that is not an actual v1.TransparencyLogEntry) while signing_from_dict_rekor()deserializer for actual v1.TransparencyLogEntry, currently used by verification when parsing a bundle
And you want to use _from_dict_rekor() to also parse the responses from rekor v2 when signing (because now the response is an actual v1.TransparencyLogEntry)
The changes are required because previously kindversion was only parsed when serializing:
- in rekor v1 response only canonicalized_body contains the kindversion?
- with rekor v2, you want to get kindversion from v1.TransparencyLogEntry -- I think that makes sense since that way you don't have to parse the canonicalized body before you know what kind it is?
This seems to make sense, there is one part here I don't understand:
In rekor V2, we may not be including the KindVersion in the "canonicalized body"
I didn't think this is possible: don't the log witnesses operate only with canonicalized body so need the kindversion there?
|
@jku I checked and with these two patches, KindVersion is now in the canonicalized_body for Rerkor V2. Still the new canonicalized body has a different layout in rekorV2, so I think this patch is simpler. |
Client support for Rekor V2: sigstore-python
Resolves #1369
Summary
_from_response()to parse theKindVersionfrom the responses canonicalized jsonbodyand cache it._from_dict_rekor()and_to_rekor()to store and reuse the cachedKindVersion.Release Note
LogEntry.kind_version, which is now parsed earlier upon receipt from the rekor API,either from the root of the response, or from the reponse's inner base64-encoded JSON
body.Documentation
None