Added an option for a more generic observer time, and aligned with v0…

….2 (#179) * Added an option for a more generic observer time, and aligned with v0.2 in v0.2 inclusion proofs are preferred over SETs, and so it's now optional to extract the timestamp from the SET. Signed-off-by: Fredrik Skogman <[email protected]> * Renamed a field based on PR feed back and clarified the comment. Signed-off-by: Fredrik Skogman <[email protected]> * Update protos/sigstore_verification.proto Co-authored-by: William Woodruff <[email protected]> Signed-off-by: Fredrik Skogman <[email protected]> * Updated verification options for tlog integrated time Signed-off-by: Fredrik Skogman <[email protected]> * Update protos/sigstore_verification.proto Co-authored-by: Hayden B <[email protected]> Signed-off-by: Fredrik Skogman <[email protected]> * Updated timestamp options: default is to only require one observer of any kind. added missing options to the ArtifactVerificationOptions Signed-off-by: Fredrik Skogman <[email protected]> --------- Signed-off-by: Fredrik Skogman <[email protected]> Co-authored-by: William Woodruff <[email protected]> Co-authored-by: Hayden B <[email protected]>
sigstore · Jan 11, 2024 · a0c939f · a0c939f
1 parent d96fa44
commit a0c939f
Show file tree

Hide file tree

Showing 9 changed files with 677 additions and 103 deletions.
diff --git a/gen/jsonschema/schemas/ArtifactVerificationOptions.schema.json b/gen/jsonschema/schemas/ArtifactVerificationOptions.schema.json
@@ -26,7 +26,17 @@
                 "tsaOptions": {
                     "$ref": "#/definitions/dev.sigstore.verification.v1.ArtifactVerificationOptions.TimestampAuthorityOptions",
                     "additionalProperties": false,
-                    "description": "Optional options for certificate signed timestamp verification. If none is provided, the default verification options are: Threshold: 1 Disable: false"
+                    "description": "Optional options for certificate signed timestamp verification. If none is provided, the default verification options are: Threshold: 0 Disable: true"
+                },
+                "integratedTsOptions": {
+                    "$ref": "#/definitions/dev.sigstore.verification.v1.ArtifactVerificationOptions.TlogIntegratedTimestampOptions",
+                    "additionalProperties": false,
+                    "description": "Optional options for integrated timestamp verification. If none is provided, the default verification options are: Threshold: 0 Disable: true"
+                },
+                "observerOptions": {
+                    "$ref": "#/definitions/dev.sigstore.verification.v1.ArtifactVerificationOptions.ObserverTimestampOptions",
+                    "additionalProperties": false,
+                    "description": "Optional options for observed timestamp verification. If none is provided, the default verification options are: Threshold 1 Disable: false"
                 }
             },
             "additionalProperties": false,
@@ -56,6 +66,16 @@
                     "required": [
                         "tsa_options"
                     ]
+                },
+                {
+                    "required": [
+                        "integrated_ts_options"
+                    ]
+                },
+                {
+                    "required": [
+                        "observer_options"
+                    ]
                 }
             ],
             "title": "Artifact Verification Options",
@@ -212,6 +232,21 @@
             "type": "object",
             "title": "Ctlog Options"
         },
+        "dev.sigstore.verification.v1.ArtifactVerificationOptions.ObserverTimestampOptions": {
+            "properties": {
+                "threshold": {
+                    "type": "integer",
+                    "description": "The number of external observers of the timestamp. This is a union of RFC3161 signed timestamps, and integrated timestamps from a transparency log, that could include additional timestamp sources in the future."
+                },
+                "disable": {
+                    "type": "boolean",
+                    "description": "Disable observer timestamp verification."
+                }
+            },
+            "additionalProperties": false,
+            "type": "object",
+            "title": "Observer Timestamp Options"
+        },
         "dev.sigstore.verification.v1.ArtifactVerificationOptions.TimestampAuthorityOptions": {
             "properties": {
                 "threshold": {
@@ -227,6 +262,21 @@
             "type": "object",
             "title": "Timestamp Authority Options"
         },
+        "dev.sigstore.verification.v1.ArtifactVerificationOptions.TlogIntegratedTimestampOptions": {
+            "properties": {
+                "threshold": {
+                    "type": "integer",
+                    "description": "The number of integrated timestamps that are expected."
+                },
+                "disable": {
+                    "type": "boolean",
+                    "description": "Disable integrated timestamp verification."
+                }
+            },
+            "additionalProperties": false,
+            "type": "object",
+            "title": "Tlog Integrated Timestamp Options"
+        },
         "dev.sigstore.verification.v1.ArtifactVerificationOptions.TlogOptions": {
             "properties": {
                 "threshold": {

diff --git a/gen/jsonschema/schemas/Input.schema.json b/gen/jsonschema/schemas/Input.schema.json
@@ -662,7 +662,17 @@
                 "tsaOptions": {
                     "$ref": "#/definitions/dev.sigstore.verification.v1.ArtifactVerificationOptions.TimestampAuthorityOptions",
                     "additionalProperties": false,
-                    "description": "Optional options for certificate signed timestamp verification. If none is provided, the default verification options are: Threshold: 1 Disable: false"
+                    "description": "Optional options for certificate signed timestamp verification. If none is provided, the default verification options are: Threshold: 0 Disable: true"
+                },
+                "integratedTsOptions": {
+                    "$ref": "#/definitions/dev.sigstore.verification.v1.ArtifactVerificationOptions.TlogIntegratedTimestampOptions",
+                    "additionalProperties": false,
+                    "description": "Optional options for integrated timestamp verification. If none is provided, the default verification options are: Threshold: 0 Disable: true"
+                },
+                "observerOptions": {
+                    "$ref": "#/definitions/dev.sigstore.verification.v1.ArtifactVerificationOptions.ObserverTimestampOptions",
+                    "additionalProperties": false,
+                    "description": "Optional options for observed timestamp verification. If none is provided, the default verification options are: Threshold 1 Disable: false"
                 }
             },
             "additionalProperties": false,
@@ -692,6 +702,16 @@
                     "required": [
                         "tsa_options"
                     ]
+                },
+                {
+                    "required": [
+                        "integrated_ts_options"
+                    ]
+                },
+                {
+                    "required": [
+                        "observer_options"
+                    ]
                 }
             ],
             "title": "Artifact Verification Options",
@@ -712,6 +732,21 @@
             "type": "object",
             "title": "Ctlog Options"
         },
+        "dev.sigstore.verification.v1.ArtifactVerificationOptions.ObserverTimestampOptions": {
+            "properties": {
+                "threshold": {
+                    "type": "integer",
+                    "description": "The number of external observers of the timestamp. This is a union of RFC3161 signed timestamps, and integrated timestamps from a transparency log, that could include additional timestamp sources in the future."
+                },
+                "disable": {
+                    "type": "boolean",
+                    "description": "Disable observer timestamp verification."
+                }
+            },
+            "additionalProperties": false,
+            "type": "object",
+            "title": "Observer Timestamp Options"
+        },
         "dev.sigstore.verification.v1.ArtifactVerificationOptions.TimestampAuthorityOptions": {
             "properties": {
                 "threshold": {
@@ -727,6 +762,21 @@
             "type": "object",
             "title": "Timestamp Authority Options"
         },
+        "dev.sigstore.verification.v1.ArtifactVerificationOptions.TlogIntegratedTimestampOptions": {
+            "properties": {
+                "threshold": {
+                    "type": "integer",
+                    "description": "The number of integrated timestamps that are expected."
+                },
+                "disable": {
+                    "type": "boolean",
+                    "description": "Disable integrated timestamp verification."
+                }
+            },
+            "additionalProperties": false,
+            "type": "object",
+            "title": "Tlog Integrated Timestamp Options"
+        },
         "dev.sigstore.verification.v1.ArtifactVerificationOptions.TlogOptions": {
             "properties": {
                 "threshold": {