Specify sha256 in TSA request #1373
Conversation
Signed-off-by: Ramon Petgrave <[email protected]>
Signed-off-by: Ramon Petgrave <[email protected]>
Signed-off-by: Ramon Petgrave <[email protected]>
Signed-off-by: Ramon Petgrave <[email protected]>
Signed-off-by: Ramon Petgrave <[email protected]>
Signed-off-by: Ramon Petgrave <[email protected]>
I mentioned this in the issue but for completeness will repeat: I think we should fix verification directly since we can't just support timestamps made by sigstore-python so can't enforce which algorithms we will see. trailofbits/rfc3161-client#144 may be something usable? |
|
@jku I agree. Verification shouldn't assume any specific algorithm, but I think for signing requests this library should specify an algorithm, for the sake of predictability. |
Oh yeah that is a better reason for this PR than "verification currently assumes sha256". SGTM. |
|
/gcbrun |
There was a problem hiding this comment.
I agree, we should be choosing the algorithm explicitly when creating a timestamp. SHA-256 sounds fine to me and we can always bump that up (preferably after verification is ok with it).
I'll file a new issue for the verification hash being hard coded so we don't forget
Client support for Rekor V2: sigstore-python
Summary
Resolves #1372
Makes the TSA request specify sha256 for the message digest,
since verification currently assumes sha256.Verification shouldn't assume any specific algorithm, but I think for signing requests this library should specify an algorithm, for the sake of predictability.Release Note
Documentation