Signing event: sign/root-v11 #1414

sigstore-bot · 2025-01-19T13:24:47Z

Processing signing event sign/root-v11, please wait.

sigstore-bot · 2025-01-19T13:24:47Z

Current signing event state

Event sign/root-v11 (commit 57d0128)

❌ root

Role root is unsigned and not yet verified
Still missing signatures from @joshuagl, @mnm678, @SantiagoTorres, @dlorenc, @bobcallaway
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

jku · 2025-01-19T13:28:04Z

This is work-in-progress: we will notify signers when changes are all ready for signing (likely on Monday)

See #1407 for all the changes that will be included

jku · 2025-01-20T08:19:52Z

Fixed #1355: Extended root signing period and expiry period by 15 days so that we have following deadlines during signing events:

2 weeks to build the signing event and sign it: after this an issue will be filed in root-signing
then 2 weeks to react to the root-signing issue: after this oncall will be alerted
then 2 weeks for oncall to react: after this root has expired

The main purpose is to make sure that normal signing events

don't get issues filed too early: working on a signing event for a week should be perfectly normal
don't have to be hurried because of the fear that oncall gets alerted so quickly.

sigstore-bot · 2025-01-20T08:19:58Z

Current signing event state

Event sign/root-v11 (commit ed3305c)

❌ root

Role root is unsigned and not yet verified
Still missing signatures from @joshuagl, @SantiagoTorres, @bobcallaway, @dlorenc, @mnm678
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

sigstore-bot · 2025-01-20T08:32:54Z

Current signing event state

Event sign/root-v11 (commit 2a603d8)

❌ root

Role root is unsigned and not yet verified
Still missing signatures from @bobcallaway, @joshuagl, @dlorenc, @SantiagoTorres, @mnm678
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

jku · 2025-01-20T08:34:25Z

Fixed #1347 by correcting the key id used to identify the GCP signing key (note that this does not change the key material just how we find the correct signer on Google Cloud): the older id only worked because we added a software workaround in tuf-on-ci

sigstore-bot · 2025-01-20T08:37:55Z

Current signing event state

Event sign/root-v11 (commit fda7da6)

❌ root

Role root is unsigned and not yet verified
Still missing signatures from @dlorenc, @bobcallaway, @SantiagoTorres, @mnm678, @joshuagl
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

jku · 2025-01-20T08:42:59Z

Fixed #1339 by extending the timestamp signing period to 6 days (expiry period remains 7): What this means in practice is that timestamp now gets signed every day instead of every three days. The benefit here is that any issues with online signing are likely to have a 6 day deadline before client failures instead of 4 day deadline

sigstore-bot · 2025-01-20T09:45:41Z

Artifacts have been modified

Event sign/root-v11 (commit 4fb4d6d)
Committed metadata changes for role(s) targets.
Updating signing event state, please wait.

sigstore-bot · 2025-01-20T09:46:11Z

Current signing event state

Event sign/root-v11 (commit 2172801)

❌ root

Role root is unsigned and not yet verified
Still missing signatures from @mnm678, @SantiagoTorres, @joshuagl, @bobcallaway, @dlorenc
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

❌ targets

Role targets contains following artifact changes:

artifact.pub: MODIFIED
ctfe.pub: MODIFIED
ctfe_2022.pub: MODIFIED
fulcio.crt.pem: MODIFIED
fulcio_intermediate_v1.crt.pem: MODIFIED
fulcio_v1.crt.pem: MODIFIED
rekor.pub: MODIFIED
signing_config.json: ADDED
trusted_root.json: MODIFIED

Role targets is unsigned and not yet verified
Still missing signatures from @mnm678, @SantiagoTorres, @joshuagl, @bobcallaway, @dlorenc
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

kommendorkapten · 2025-01-20T10:10:37Z

metadata/root.json

@@ -92,7 +72,7 @@
     "public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWRiGr5+j+3J5SsH+Ztr5nE2H2wO7\nBV+nO3s93gLca18qTOzHY1oWyAGDykMSsGTUBSt9D+An0KfKsD2mfSM42Q==\n-----END PUBLIC KEY-----\n"
    },
    "scheme": "ecdsa-sha2-nistp256",
-    "x-tuf-on-ci-online-uri": "gcpkms://projects/sigstore-root-signing/locations/global/keyRings/root/cryptoKeys/timestamp"
+    "x-tuf-on-ci-online-uri": "gcpkms:projects/sigstore-root-signing/locations/global/keyRings/root/cryptoKeys/timestamp/cryptoKeyVersions/1"


Compared against https://github.com/theupdateframework/tuf-on-ci/pull/423/files

and looks good 👍

kommendorkapten

Metadata changes and KMS uri changes looks good.

(I know this approval will be reverted, but for the record it can be good to see that the changes themselves were approved before signers sign.)

jku · 2025-01-20T11:25:01Z

Agreed, changes look good to me.

Note to signers: this is the first artifact change after the migration.

This leads to small hash style change for all artifacts (as tuf-on-ci uses a single hash instead of both sha256 and sha512)
In the tuf-on-ci-sign output all artifacts are listed as changing
Please review the PR to verify the actual artifact changes -- only signing_config.json and trusted_root.json change

kommendorkapten · 2025-01-20T14:11:37Z

Signing event check is failing due to a bug in TUF-on-CI, I'm looking at that now. (there is an assumption that there is only one PR with a given tip commit, but when using forks, that is not the case as what just happened with the PR from Joshua). I'll revisit this so the constraint is only one open PR for a given commit.

kommendorkapten · 2025-01-20T15:52:53Z

Fix for the bug are in place, once merged we will rebase the signing. Note that the bug is not preventing anything, it's just making the automation fail, so we don't get the nice status comments added to this PR.

haydentherapper

These changes LGTM.

Did we want to rotate any signers?

kommendorkapten · 2025-01-21T07:02:41Z

@haydentherapper

Did we want to rotate any signers?

Not this round.

jku · 2025-01-21T09:04:02Z

Fix for the bug are in place, once merged we will rebase the signing. Note that the bug is not preventing anything, it's just making the automation fail, so we don't get the nice status comments added to this PR.

rebasing this PR on main now to hopefully get the status check fixed up

Signed-off-by: TUF-on-CI <41898282+github-actions[bot]@users.noreply.github.com>

Signed-off-by: Jussi Kukkonen <[email protected]>

Fix online key id as per #1347. Note that this does not change the actual key material. Signed-off-by: Jussi Kukkonen <[email protected]>

Signed-off-by: Jussi Kukkonen <[email protected]>

Added client signing config. See PR #1412 for initial review Signed-off-by: Fredrik Skogman <[email protected]>

See PR #1412 for inital review Signed-off-by: Fredrik Skogman <[email protected]>

Signed-off-by: TUF-on-CI <41898282+github-actions[bot]@users.noreply.github.com>

Signed-off-by: Joshua Lock <[email protected]>

sigstore-bot · 2025-01-21T09:06:07Z

Current signing event state

Event sign/root-v11 (commit 8649795)

❌ root

Role root is not yet verified. It is signed by 1/3 (1/3) signers (@joshuagl).
Still missing signatures from @SantiagoTorres, @mnm678, @bobcallaway, @dlorenc
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

❌ targets

Role targets contains following artifact changes:

artifact.pub: MODIFIED
ctfe.pub: MODIFIED
ctfe_2022.pub: MODIFIED
fulcio.crt.pem: MODIFIED
fulcio_intermediate_v1.crt.pem: MODIFIED
fulcio_v1.crt.pem: MODIFIED
rekor.pub: MODIFIED
signing_config.json: ADDED
trusted_root.json: MODIFIED

Role targets is not yet verified. It is signed by 1/3 signers (@joshuagl).
Still missing signatures from @SantiagoTorres, @dlorenc, @mnm678, @bobcallaway
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

Signed-off-by: Bob Callaway <[email protected]>

sigstore-bot · 2025-01-21T09:12:25Z

Current signing event state

Event sign/root-v11 (commit 996d98c)

❌ root

Role root is not yet verified. It is signed by 2/3 (2/3) signers (@bobcallaway, @joshuagl).
Still missing signatures from @mnm678, @dlorenc, @SantiagoTorres
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

❌ targets

Role targets contains following artifact changes:

artifact.pub: MODIFIED
ctfe.pub: MODIFIED
ctfe_2022.pub: MODIFIED
fulcio.crt.pem: MODIFIED
fulcio_intermediate_v1.crt.pem: MODIFIED
fulcio_v1.crt.pem: MODIFIED
rekor.pub: MODIFIED
signing_config.json: ADDED
trusted_root.json: MODIFIED

Role targets is not yet verified. It is signed by 2/3 signers (@bobcallaway, @joshuagl).
Still missing signatures from @mnm678, @dlorenc, @SantiagoTorres
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

Signed-off-by: Marina Moore <[email protected]>

@mnm678

Signature from @mnm678

sigstore-bot · 2025-01-24T07:46:59Z

Current signing event state

Event sign/root-v11 (commit 04775c6)

✅ root

Role root is verified and signed by 3/3 (3/3) signers (@bobcallaway, @mnm678, @joshuagl).
Still missing signatures from @dlorenc, @SantiagoTorres
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

✅ targets

Role targets contains following artifact changes:

artifact.pub: MODIFIED
ctfe.pub: MODIFIED
ctfe_2022.pub: MODIFIED
fulcio.crt.pem: MODIFIED
fulcio_intermediate_v1.crt.pem: MODIFIED
fulcio_v1.crt.pem: MODIFIED
rekor.pub: MODIFIED
signing_config.json: ADDED
trusted_root.json: MODIFIED

Role targets is verified and signed by 3/3 signers (@mnm678, @bobcallaway, @joshuagl).
Still missing signatures from @dlorenc, @SantiagoTorres
Signers can sign these changes by running tuf-on-ci-sign sign/root-v11

Signing event is successful

Threshold of signatures has been reached: this signing event can be reviewed and merged.

kommendorkapten reviewed Jan 20, 2025

View reviewed changes

kommendorkapten previously approved these changes Jan 20, 2025

View reviewed changes

kommendorkapten dismissed their stale review via 4545473 January 20, 2025 13:56

haydentherapper reviewed Jan 21, 2025

View reviewed changes

github-actions bot and others added 8 commits January 21, 2025 11:04

Periodic version bump: root v11

91bbe2c

Signed-off-by: TUF-on-CI <41898282+github-actions[bot]@users.noreply.github.com>

'root' role/delegation change

05e39a9

Signed-off-by: Jussi Kukkonen <[email protected]>

'root' role/delegation change

46439cc

Fix online key id as per #1347. Note that this does not change the actual key material. Signed-off-by: Jussi Kukkonen <[email protected]>

'timestamp' role/delegation change

145d296

Signed-off-by: Jussi Kukkonen <[email protected]>

Issue #1194

6690673

Added client signing config. See PR #1412 for initial review Signed-off-by: Fredrik Skogman <[email protected]>

Issue #1268

36aee78

See PR #1412 for inital review Signed-off-by: Fredrik Skogman <[email protected]>

Update targets metadata for role targets

4e73b70

Signed-off-by: TUF-on-CI <41898282+github-actions[bot]@users.noreply.github.com>

Signature from @joshuagl

8649795

Signed-off-by: Joshua Lock <[email protected]>

jku force-pushed the sign/root-v11 branch from 4545473 to 8649795 Compare January 21, 2025 09:05

Signature from @bobcallaway

996d98c

Signed-off-by: Bob Callaway <[email protected]>

jku linked an issue Jan 21, 2025 that may be closed by this pull request

2025 Jan/Feb signing event #1407

Open

5 tasks

mnm678 and others added 2 commits January 23, 2025 14:08

Signature from @mnm678

7fc9e2e

Signed-off-by: Marina Moore <[email protected]>

Merge pull request #1423 from mnm678/sign/root-v11

04775c6

Signature from @mnm678

sigstore-bot marked this pull request as ready for review January 24, 2025 07:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Signing event: sign/root-v11 #1414

Signing event: sign/root-v11 #1414

sigstore-bot commented Jan 19, 2025

sigstore-bot commented Jan 19, 2025

jku commented Jan 19, 2025 •

edited

Loading

jku commented Jan 20, 2025 •

edited

Loading

sigstore-bot commented Jan 20, 2025

sigstore-bot commented Jan 20, 2025

jku commented Jan 20, 2025 •

edited

Loading

sigstore-bot commented Jan 20, 2025

jku commented Jan 20, 2025

sigstore-bot commented Jan 20, 2025

sigstore-bot commented Jan 20, 2025

kommendorkapten Jan 20, 2025

kommendorkapten left a comment

jku commented Jan 20, 2025

kommendorkapten commented Jan 20, 2025

kommendorkapten commented Jan 20, 2025

haydentherapper left a comment

kommendorkapten commented Jan 21, 2025

jku commented Jan 21, 2025

sigstore-bot commented Jan 21, 2025

sigstore-bot commented Jan 21, 2025

sigstore-bot commented Jan 24, 2025

Signing event: sign/root-v11 #1414

Are you sure you want to change the base?

Signing event: sign/root-v11 #1414

Conversation

sigstore-bot commented Jan 19, 2025

sigstore-bot commented Jan 19, 2025

Current signing event state

❌ root

jku commented Jan 19, 2025 • edited Loading

jku commented Jan 20, 2025 • edited Loading

sigstore-bot commented Jan 20, 2025

Current signing event state

❌ root

sigstore-bot commented Jan 20, 2025

Current signing event state

❌ root

jku commented Jan 20, 2025 • edited Loading

sigstore-bot commented Jan 20, 2025

Current signing event state

❌ root

jku commented Jan 20, 2025

sigstore-bot commented Jan 20, 2025

Artifacts have been modified

sigstore-bot commented Jan 20, 2025

Current signing event state

❌ root

❌ targets

kommendorkapten Jan 20, 2025

Choose a reason for hiding this comment

kommendorkapten left a comment

Choose a reason for hiding this comment

jku commented Jan 20, 2025

kommendorkapten commented Jan 20, 2025

kommendorkapten commented Jan 20, 2025

haydentherapper left a comment

Choose a reason for hiding this comment

kommendorkapten commented Jan 21, 2025

jku commented Jan 21, 2025

sigstore-bot commented Jan 21, 2025

Current signing event state

❌ root

❌ targets

sigstore-bot commented Jan 21, 2025

Current signing event state

❌ root

❌ targets

sigstore-bot commented Jan 24, 2025

Current signing event state

✅ root

✅ targets

Signing event is successful

jku commented Jan 19, 2025 •

edited

Loading

jku commented Jan 20, 2025 •

edited

Loading

jku commented Jan 20, 2025 •

edited

Loading