Retrieve CTFE signing key via TUF

[tetsuo-cpp]

At the moment, we've decided to check in the CTFE public key and use it to verify SCTs. The way this should really work is that we should check in the root key (root.json) and use it to download the CTFE key via TUF.

[di]

Now that we're including an intermediate key, this should also include that as well.

[wxjdsr]

Hi, we are a small team (@wxjdsr, @vcharapa) that is working with professor Santiago (@SantiagoTorres) on fixing this issue.

[woodruffw]

Cool! Please let me or one of the other maintainers know if there's something we can do to help.

[joshuagl]

👋 python-tuf maintainer and sigstore/root-signing contributor here.

I posted a message on the #python Slack channel a few weeks back about some WIP changes I have to implement the certificate update workflow in python-sigstore. You can see my WIP branch here: https://github.com/joshuagl/sigstore-python/commits/joshuagl/tuf

Apologies for not posting about that work here, I didn't find this issue when I tried searching for something about the TUF workflow 🤦

It would be cool to collaborate on this, or have your work build on top of mine, @wxjdsr and @vcharapa?

[wxjdsr]

👋 python-tuf maintainer and sigstore/root-signing contributor here.

I posted a message on the #python Slack channel a few weeks back about some WIP changes I have to implement the certificate update workflow in python-sigstore. You can see my WIP branch here: https://github.com/joshuagl/sigstore-python/commits/joshuagl/tuf

Apologies for not posting about that work here, I didn't find this issue when I tried searching for something about the TUF workflow 🤦

It would be cool to collaborate on this, or have your work build on top of mine, @wxjdsr and @vcharapa?

Cool. I think we can collaborate on this.

[joshuagl]

Great! Let me know how you want to proceed. Given timezone differences, if you want to build on my existing work (or even start afresh with that for inspiration) I'd be OK with that. Just want to make sure we aren't duplicating efforts, so please let me know how you would like to proceed :-)

[wxjdsr]

Sorry for late reply.
We would like to build on your existing work. Currently we are working on fetching data from RemoteRoot for TUF. And I hope this does not conflict with your current work. XD

[joshuagl]

Awesome, look forward to seeing your changes. I'd be more than willing to collaborate in any way that is useful for you and your team. Feel free to ping me on Sigstore Slack (I'm in the #python channel).

If you look at the branch I linked to above (https://github.com/joshuagl/sigstore-python/commits/joshuagl/tuf), you can see my WIP changes include initial retrieval of the TUF metadata and changes to access the certificates from a directory the TUF client fetches to, rather than accessing the bundled certificates using resourcelib (see joshuagl@e343366).

What's next is adapting to the pending v5 root-signing changes in sigstore/root-signing#430 where, instead of fetching a hard-coded set of targets, each of the certificates listed in the Targets metadata have additional metadata in the custom field that describes their usage.

For CTFE certificates we can query the metadata to retrieve only the targets in the which have custom.sigstore.usage == "CTFE". You can see how the Go Sigstore library is implementing this pattern in https://github.com/sigstore/sigstore/blob/fe89132b9369fc783254378ff8cfa68edfb64f72/pkg/fulcioroots/fulcioroots.go#L69 and https://github.com/sigstore/sigstore/blob/fe89132b9369fc783254378ff8cfa68edfb64f72/pkg/tuf/client.go#L373.

[asraa]

each of the certificates listed in the Targets metadata have additional metadata in the custom field that describes their usage.

While this will work currently for all top-level targets, we're also adding targets to folders named by their usage, so all targets under ctfe/** will be for ctfe: this pattern will be stable in the future, and secure for any future delegations we add, so I recommend that pattern!

[joshuagl]

Thanks for chiming in @asraa! To be clear, are we recommending targets are searched by delegation path not by the usage field in custom?