[WIP] Draft v3 root changes

[asraa]

Signed-off-by: Asra Ali asraa@google.com

Summary

Ticket Link

Fixes

Release Note

[asraa]

• Reduce root/target expiration to 4 months rather than 6
• Rotate out one key-holder TBD
• Create a test setup with >1 YubiKey
• Add custom metadata indicated usage/lifetime/version of the target metadata for the Rekor/Fulcio/CT key
• Add a revocation delegation @haydentherapper
• Enable consistent snapshots (Prerequisites for verification with old targets #80)
• (Optional?): Start including the HSM certs into the root metadata
  Changes in snapshot/targets:
• Snapshot expiration to 5 weeks so re-signing every 3
• Timestamp expiration to 7 days so re-signing w/ automatic merge

[asraa]

Custom metadata added as:

"targets": {
      "artifact.pub": {
        "custom": {
          "sigstore": {
            "status": "Active",
            "usage": "Cosign"
          }
        },
        "hashes": {
          "sha256": "59ebf97a9850aecec4bc39c1f5c1dc46e6490a6b5fd2a6cacdcac0c3a6fc4cbf",
          "sha512": "308fd1d1d95d7f80aa33b837795251cc3e886792982275e062409e13e4e236ffc34d676682aa96fdc751414de99c864bf132dde71581fa651c6343905e3bf988"
        },
        "length": 177
      },
}

[dlorenc]

What's left here? Need any help?

[asraa]

What's left here? Need any help?

Hey! So far key rotation worked and I got blocked on delegation "refreshing" theupdateframework/go-tuf#239

It could be a simple fix that I can work around in the wrapping TUF API code. I'll be able to try that today and do another dry run. Would love help for a very quick dry run later this week! @priyawadhwa since you likely have a key too.

[priyawadhwa]

Yup, I definitely had one! Will try to find it 😅

[trishankatdatadog]

Hey! So far key rotation worked and I got blocked on delegation "refreshing" theupdateframework/go-tuf#239

Let us know how you need help here. @ethan-lowman-dd

[asraa]

@haydentherapper are you sure you didn't see this prompt?
https://github.com/asraa/test-sigstore-root/issues/80#issuecomment-1086201454

maybe it's possible tapping the yubikey had pressed a key? Maybe I'll make it an explicit type Y?