Skip to content

fetch timestamps before submitting to rekor#1463

Merged
woodruffw merged 3 commits intosigstore:mainfrom
ramonpetgrave64:timestamp-first
Jul 1, 2025
Merged

fetch timestamps before submitting to rekor#1463
woodruffw merged 3 commits intosigstore:mainfrom
ramonpetgrave64:timestamp-first

Conversation

@ramonpetgrave64
Copy link
Contributor

Summary

Fetch timestamps before submitting to rekor.

Resolves #1459

Release Note

  • If the user provided TSA urls, rfc3161 timestamps are now fetched before submitting
    entries to rekor.

Documentation

ramonpetgrave64 and others added 3 commits July 1, 2025 16:19
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@ramonpetgrave64 ramonpetgrave64 marked this pull request as ready for review July 1, 2025 16:26
@ramonpetgrave64
Copy link
Contributor Author

@woodruffw @haydentherapper

Copy link
Contributor

@Hayden-IO Hayden-IO left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change should be a no-op for reliable, available infrastructure. Ordering wise, I agree with this change, since Rekor should record a finalized signing event, and timestamps are a part of a signing event.

@Hayden-IO
Copy link
Contributor

/gcbrun

Copy link
Member

@woodruffw woodruffw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, good catch. Thanks @ramonpetgrave64!

@woodruffw woodruffw merged commit 6c71615 into sigstore:main Jul 1, 2025
23 checks passed
@woodruffw woodruffw added the component:signing Core signing functionality label Jul 1, 2025
@woodruffw
Copy link
Member

(Thinking out loud, this is perhaps the kind of thing that would be good to have a conformance test for -- other clients are likely to make the same sequencing mistake here!)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

component:signing Core signing functionality

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Get timestamp before submitting to rekor.

3 participants