initial commit
This commit is contained in:
commit
db54a28ae9
GPG Key ID:
8E47A1EC35A1551D
|
|
@ -0,0 +1,140 @@
|
||||||
|
# Supsig Specification #
|
||||||
|
|
||||||
|
<http://git.distrust.co/supsig>
|
||||||
|
|
||||||
|
## About ##
|
||||||
|
|
||||||
|
This document defines the specification for "supsig", a portable software
|
||||||
|
supply chain signing solution for code, code reviews, and reproducible artifact
|
||||||
|
builds.
|
||||||
|
|
||||||
|
## Status ##
|
||||||
|
|
||||||
|
This is currently a **DRAFT**
|
||||||
|
|
||||||
|
Current draft is in use at multiple organizations, but current reference
|
||||||
|
tooling such as "git-sig" uses version "v0" and may break at any time until we
|
||||||
|
stabilize at "v1".
|
||||||
|
|
||||||
|
Contributions at this stage are very welcome.
|
||||||
|
|
||||||
|
Please collaborate via Matrix at [https://matrix.to/#/#supsig:matrix.org]
|
||||||
|
|
||||||
|
## Definitions
|
||||||
|
|
||||||
|
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD",
|
||||||
|
"SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this
|
||||||
|
document are to be interpreted as described in RFC2119 when, and only when,
|
||||||
|
they appear in all capitals, as shown here.
|
||||||
|
|
||||||
|
## Goals
|
||||||
|
|
||||||
|
- Define a broadly applicable signing format for code, reviews, and artifacts
|
||||||
|
- Define system for anonymous submission and discovery of signatures
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
- MUST defend against a compromise of any single human or system
|
||||||
|
- MUST exclusively rely on FOSS dependencies with signed reproducible builds
|
||||||
|
- MUST be portable with code archives or any known VCS system
|
||||||
|
- MUST support signing via the CLI, GUI, or web interfaces
|
||||||
|
- Web support implies supporting native signing like Passkeys/Webauthn
|
||||||
|
- SHOULD support any cryptographic tooling supporting detached signatures
|
||||||
|
- We SHOULD NOT attempt to force the FOSS community to migrate off of PGP
|
||||||
|
- We SHOULD NOT attempt to force PGP on organizations with other solutions
|
||||||
|
- MUST support a minimal, yet optional, plaintext review format
|
||||||
|
- MUST support signatures that only indicate reproducible builds
|
||||||
|
- MUST allow signing a review from a wide range of alternative review systems
|
||||||
|
- MAY be small plain-text snippets, or a hash of an external system
|
||||||
|
- MUST support all supply chain artifacts including reviews, code, and binaries
|
||||||
|
- MUST communicate and collaborate on project exclusively with FOSS tools
|
||||||
|
- We want to be inclusive to the open source community, not just corporations
|
||||||
|
- Examples: Forgejo/gitea issues, e-mail, IRC, matrix, jitsi, etc.
|
||||||
|
- SHOULD seek compatibility with popular supply chain security tooling
|
||||||
|
- Examples: in-toto, witness, OCI container signing
|
||||||
|
|
||||||
|
## Format
|
||||||
|
|
||||||
|
```
|
||||||
|
"sig:$version:$vcs_ref:$tree_hash:$review_hash:$sig_type:$signature"
|
||||||
|
```
|
||||||
|
|
||||||
|
- version: (required) version of the supsig format
|
||||||
|
- vcs: (optional) vcs system used (ex, git, hg,svn,cvs,perforce,etc )
|
||||||
|
- tree_hash: (required) sha256 hash of the object or directory being signed
|
||||||
|
- review_hash: (optional) sha256 hash of a review from any review system
|
||||||
|
- sig_type: (required) signature type (webauthn, pgp, etc)
|
||||||
|
- signature: (required) actual ascii armored signature payload
|
||||||
|
|
||||||
|
## Background
|
||||||
|
|
||||||
|
TODO
|
||||||
|
|
||||||
|
### Motivation
|
||||||
|
|
||||||
|
TODO
|
||||||
|
|
||||||
|
### Alternatives
|
||||||
|
|
||||||
|
Here we will comment on other popular approaches to supply chain integrity,
|
||||||
|
and our opinion on what they get right, and where they fall short.
|
||||||
|
|
||||||
|
#### No signing
|
||||||
|
|
||||||
|
Many software distribution systems are very intentional about not supporting
|
||||||
|
signing at all. Some have expressed fears that some developers are intimidated
|
||||||
|
by the idea of signing code or reviews and would stop contributing entirely
|
||||||
|
such practices were normalized.
|
||||||
|
|
||||||
|
Attempts to enforce signing are often rejected as an attempt at gatekeeping,
|
||||||
|
Some distribution system maintainers argue that not signing at all is an
|
||||||
|
appropriate security posture given other mitigations such as the availability
|
||||||
|
of two factor authentication.
|
||||||
|
|
||||||
|
Years of supply chain attacks on systems with this posture have seemingly done
|
||||||
|
little to nothing to dissuade these positions.
|
||||||
|
|
||||||
|
##### npm
|
||||||
|
|
||||||
|
TODO
|
||||||
|
|
||||||
|
##### pip
|
||||||
|
|
||||||
|
TODO
|
||||||
|
|
||||||
|
##### brew
|
||||||
|
|
||||||
|
TODO
|
||||||
|
|
||||||
|
### Centralized signing
|
||||||
|
|
||||||
|
- sigstore/fulcio
|
||||||
|
- nix
|
||||||
|
- apk
|
||||||
|
- fulcio
|
||||||
|
- gitsign
|
||||||
|
|
||||||
|
### Distributed signing
|
||||||
|
|
||||||
|
- bitcoin: https://bitcoinops.org/en/topics/reproducible-builds/
|
||||||
|
- apt: https://wiki.debian.org/SecureApt
|
||||||
|
- pacman: https://wiki.archlinux.org/title/Pacman/Package_signing
|
||||||
|
- crev: ??
|
||||||
|
- git-wotr
|
||||||
|
- git-signatures
|
||||||
|
- sigstore
|
||||||
|
- cosign
|
||||||
|
- notary
|
||||||
|
|
||||||
|
## References ##
|
||||||
|
|
||||||
|
### Noteworthy Supply Chain Attacks ###
|
||||||
|
|
||||||
|
## Funding ##
|
||||||
|
|
||||||
|
This project is housed under the umbrella of Distrust, and self funded to meet
|
||||||
|
the growing needs of Distrust clients, and by extension the wider open source
|
||||||
|
community whose dependencies they heavily rely on.
|
||||||
|
|
||||||
|
Funding for this project and team in the current direction, or partnership with
|
||||||
|
existing projects with compatible goals would be very welcome.
|
||||||
Loading…
Reference in New Issue