Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
name-assertion: Add a name-assertion type
This doesn't get into signature formats, assertion discovery, or
signature-discovery. But we need to agree on the assertion format
itself before those become interesting problems. We can continue to
fill in the remaining pieces in follow-up work.
The assertion blob must be self-describing because the signature
covers the blob itself, and not any descriptors referencing that blob.
For example, a linking structure like:
{
"blob": {descriptor referencing the assertion},
"signature": {descriptor referencing the signature}
}
might be altered by an attacker to adjust the descriptor media types.
Having self-describing assertions and signature blobs protects from
such attacks.
The media-type header makes assertions self-describing in a way that
can survive potential future transitions to non-JSON formats. If we
are comfortable requiring JSON assertions forever, we can move the
self-describing media type into the assertion object as mediaType.
However, the media-type header is awkward enough that it's good to
limit it to the small assertion blob. An alternative approach to
applying assertions would be to add the asserted attribute (e.g. the
name) to the signed object itself (e.g. as a manifest property).
However, having purely-JSON manifests (without the media-type header)
makes them easier to manipulate with generic tools like jq.
Having the assertion in an independent object also clarifies the
assertion being signed. With a 'name' property on the manifest, a
signature on the manifest is signing the entire DAG rooted at that
manifest and asserting something vaguely good about that DAG. With a
separate name assertion you can say "this is Nginx 1.10.1" without
implying "I've audited all the source code and the build system for
security flaws and found none" or other similarly high bars. You can
of course define a separate security-audit assertion and apply that to
the manifest as well.
A final benefit of stand-alone assertions is that you can apply them
to any blob. The name assertion added hear can be applied to
manifest-lists, manifests, configurations, layers, etc., etc. Getting
the same coverage via embedded properties would require per-type
adjustments.
Signed-off-by: W. Trevor King <wking@tremily.us>- Loading branch information
