Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature|Experimental: Add support to add Policies to TUF #159

Open
3 tasks
Tracked by #240
kairoaraujo opened this issue Jan 22, 2024 · 0 comments
Open
3 tasks
Tracked by #240

Feature|Experimental: Add support to add Policies to TUF #159

kairoaraujo opened this issue Jan 22, 2024 · 0 comments

Comments

@kairoaraujo
Copy link
Collaborator

kairoaraujo commented Jan 22, 2024

Requires

This issue aims to include the policies in the TUF repository.

The initial idea is to deploy a Repository Service for TUF (RSTUF) along with Archivista and have the option to use RSTUF with Archivista.

Users will be able to use the TUF to distribute the policy securely.

When a policy is added to Archivista (#158), it is stored in the Metadata Storage (BLOB) and SQL.
A new step will also be sent to RSTUF. RSTUF will include and sign the registered metadata storage artifact in the TUF metadata.

The TUF repository will have offline keys to protect the TUF Metadata and allow users to have a clear incident response in case:

  • The Metadata Storage is compromised
  • The signing key is compromised
  • Rotate any Root key (Revocation)

When a user wants to validate the attestation against a policy, it can do it using the trusted signed root from TUF.

The idea as an experimental/prototype is to have this feature in a separate branch/release so we can evaluate all features and requirements.

This feature will require

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant