fix: upgrade sigstore Signer to use sigstore v4#532
fix: upgrade sigstore Signer to use sigstore v4#532mihaimaruseac merged 2 commits intosigstore:mainfrom
sigstore v4#532Conversation
|
Oh, it seems verification fails for non sigstore paths :( I was afraid of this |
Still diving into the tests, but I forgot to fix the unit test mocks. |
spencerschrock
force-pushed
the
protobuf-specs
branch
3 times, most recently
from
4233c5a to
bfa89df
Compare
|
Fixed the unit tests, but signing/verifying between Windows and Linux/macOS seems to be broken still. |
|
It looks like sigstore-python has been just getting lucky on Windows so far... I admit I didn't know that encoding is still guesswork on Python in Windows. This clearly looks like a bug that is now very prominent because rekor2 entries all trigger it The cross os test is a neat idea, I will steal that. |
1. Manually specify `sigstore_protobuf_specs` as a dependency as `sigstore` no longer includes it. 2. Handle the sigstore_signer breaking changes based on: https://www.github.com/sigstore/sigstore-python/pull/1363 Signed-off-by: Spencer Schrock <sschrock@google.com>
spencerschrock
force-pushed
the
protobuf-specs
branch
2 times, most recently
from
3484e67 to
cd4039e
Compare
| @override | ||
| def write(self, path: pathlib.Path) -> None: | ||
| path.write_text(self.bundle.to_json()) | ||
| path.write_text(self.bundle.to_json(), encoding="utf-8") | ||
|
|
||
| @classmethod | ||
| @override | ||
| def read(cls, path: pathlib.Path) -> Self: | ||
| content = path.read_text() |
There was a problem hiding this comment.
I'm assuming we may need to handle backwards compatibility depending on if NVIDIA has signed on windows or not.
But also, we should follow along to see if we should write sigs as text or bytes
sigstore/sigstore-python#1553 (comment)
There was a problem hiding this comment.
Yeah, I think it's a great idea to switch everything to be UTF-8 by default.
Rekor v2 makes use of an em dash `—` in its checkpoint format, which was causing issues when writing the JSON bundle to disk. Linux and macOS default to "utf-8" when writing text files without a provided encoding, while Windows defaults to "cp1252". RFC8259 states JSON text must be "utf-8": https://datatracker.ietf.org/doc/html/rfc8259#section-8.1 Signed-off-by: Spencer Schrock <sschrock@google.com>
spencerschrock
force-pushed
the
protobuf-specs
branch
from
cd4039e to
55d941e
Compare
3 participants
Summary
Manually specify
sigstore_protobuf_specsas a dependency assigstoreno longer includes it.Handle the sigstore_signer breaking changes based on: https://www.github.com/sigstore/sigstore-python/pull/1363
Fixes #531
Checklist