Skip to content

Commit 619f839

Browse files
gregoire-mullvadgregoire-mullvad
committed
Add built-in policies
1 parent 774c03f commit 619f839

6 files changed

Lines changed: 134 additions & 0 deletions

‎src/policy/builtin.rs‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
use super::Policy;
2+
3+
const SIGSUM_TEST1_2025: &str = include_str!("sigsum-test1-2025.builtin-policy");
4+
const SIGSUM_TEST2_2025: &str = include_str!("sigsum-test1-2025.builtin-policy");
5+
const SIGSUM_TEST_2025_3: &str = include_str!("sigsum-test1-2025.builtin-policy");
6+
const SIGSUM_GENERAL_2025_1: &str = include_str!("sigsum-test1-2025.builtin-policy");
7+
8+
impl Policy {
9+
pub fn builtin(name: &str) -> Option<Self> {
10+
match name {
11+
"sigsum-test1-2025" => Some(Policy::parse(SIGSUM_TEST1_2025).unwrap()),
12+
"sigsum-test2-2025" => Some(Policy::parse(SIGSUM_TEST2_2025).unwrap()),
13+
"sigsum-test-2025-3" => Some(Policy::parse(SIGSUM_TEST_2025_3).unwrap()),
14+
"sigsum-general-2025-1" => Some(Policy::parse(SIGSUM_GENERAL_2025_1).unwrap()),
15+
_ => None,
16+
}
17+
}
18+
}
19+
20+
#[cfg(test)]
21+
mod tests {
22+
use super::*;
23+
24+
#[test]
25+
fn parse_builtin_policies() {
26+
assert!(Policy::builtin("sigsum-test1-2025").is_some());
27+
assert!(Policy::builtin("sigsum-test2-2025").is_some());
28+
assert!(Policy::builtin("sigsum-test-2025-3").is_some());
29+
assert!(Policy::builtin("sigsum-general-2025-1").is_some());
30+
}
31+
}

‎src/policy/mod.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ use std::collections::HashMap;
22

33
use crate::crypto::{Hash, PublicKey};
44

5+
mod builtin;
56
mod parsing;
67

78
pub use parsing::ParsePolicyError;

‎src/policy/sigsum-generic-2025-1.builtin-policy‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# This is a Sigsum trust policy that has been vetted by the Sigsum project
2+
# See https://git.glasklar.is/sigsum/project/documentation/-/blob/main/policy-maintenance.md
3+
4+
# https://git.glasklar.is/glasklar/services/sigsum-logs/-/blob/main/instances/seasalp.md (accessed 2025-12-04)
5+
log 0ec7e16843119b120377a73913ac6acbc2d03d82432e2c36b841b09a95841f25 https://seasalp.glasklar.is
6+
7+
# https://ginkgo.tlog.mullvad.net/about (accessed 2025-12-04)
8+
log f00c159663d09bbda6131ee1816863b6adcacfe80b0b288000b11aba8fe38314 https://ginkgo.tlog.mullvad.net
9+
10+
# https://git.glasklar.is/glasklar/services/witnessing/-/blob/main/witness.glasklar.is/about.md (accessed 2025-12-04)
11+
witness witness.glasklar.is b2106db9065ec97f25e09c18839216751a6e26d8ed8b41e485a563d3d1498536
12+
13+
# https://witness.mullvad.net/about (accessed 2025-12-04)
14+
witness witness.mullvad.net 15d6d0141543247b74bab3c1076372d9c894f619c376d64b29aa312cc00f61ad
15+
16+
# https://github.com/tillitis/tillitis.se-tillitis-witness-1/blob/main/about.md (accessed 2025-12-04)
17+
witness tillitis.se/tillitis-witness-1 076be8c9ee7ea60916f0df3608c945d7730082ecb37749dad2c9ed339fea770c
18+
19+
# Requiring 2 of 3 is intended to give reasonable balance between security and availability.
20+
group quorum-rule 2 witness.glasklar.is witness.mullvad.net tillitis.se/tillitis-witness-1
21+
22+
quorum quorum-rule

‎src/policy/sigsum-test-2025-3.builtin-policy‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Policy using two sigsum test logs at test.sigsum.org/barreleye and serviceberry.tlog.stagemole.eu
2+
3+
log 4644af2abd40f4895a003bca350f9d5912ab301a49c77f13e5b6d905c20a5fe6 https://test.sigsum.org/barreleye
4+
log 47e481606d8acba747a6b053d6c2d191605fb122175d410a1202a91430abce39 https://serviceberry.tlog.stagemole.eu
5+
6+
# Test witness operated by Niels Möller running on a Glasklar Teknik server
7+
witness poc.sigsum.org/nisse 1c25f8a44c635457e2e391d1efbca7d4c2951a0aef06225a881e46b98962ac6c
8+
9+
# Test witness operated by Rasmus Dahlberg - https://www.rgdd.se/poc-witness/about
10+
witness rgdd.se/poc-witness 28c92a5a3a054d317c86fc2eeb6a7ab2054d6217100d0be67ded5b74323c5806
11+
12+
# Test witness operated by Elias Rudberg - https://witness1.smartit.nu/witness1/about.txt
13+
witness witness1.smartit.nu/witness1 f4855a0f46e8a3e23bb40faf260ee57ab8a18249fa402f2ca2d28a60e1a3130e
14+
15+
# Staging witness operated by Filippo Valsorda - https://navigli.sunlight.geomys.org/
16+
witness witness.navigli.sunlight.geomys.org dcbf728e02d479f5a7e20dc09adf525833ed6e797526517aeb07fc6854849fc6
17+
18+
# Test witness operated by Florian Larysch - https://remora.n621.de/
19+
witness remora.n621.de ebcdeb78e7fdb2ef9227b2c1ef11e94600b55b4d6d9a57877e31ee89e59adc36
20+
21+
# Test witness operated by Mullvad VPN AB - https://witness.stagemole.eu/about
22+
witness witness.stagemole.eu 4a921b7caef58ae670cdc11ef4184f1c058f7b9259a9107a969f69fa54aa496f
23+
24+
# Test witness operated by Tillitis AB - new key since October 2025
25+
witness tillitis.se/test-witness-1 636582aec12f32c18a21733db9e3f718058ee7aaec6dbe4eb81781e0f4300c6e
26+
27+
# Test witness operated by Google TrustFabric team - https://transparency.dev/witnesses/
28+
witness transparency.dev/DEV:witness-little-garden 2b6eb0ec483503544cde4e8fc1ce6d1921db21dffccc186865f808f7625443cc
29+
30+
# Group of 3 witnesses that are all run by Glasklar employees
31+
group glasklar-test-witnesses 2 poc.sigsum.org/nisse rgdd.se/poc-witness witness1.smartit.nu/witness1
32+
33+
# Requiring 4 of 6 is intended to give reasonable reliability.
34+
group quorum-rule 4 glasklar-test-witnesses witness.navigli.sunlight.geomys.org remora.n621.de witness.stagemole.eu tillitis.se/test-witness-1 transparency.dev/DEV:witness-little-garden
35+
36+
quorum quorum-rule

‎src/policy/sigsum-test1-2025.builtin-policy‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Policy using the sigsum test log at test.sigsum.org/barreleye
2+
3+
log 4644af2abd40f4895a003bca350f9d5912ab301a49c77f13e5b6d905c20a5fe6 https://test.sigsum.org/barreleye
4+
5+
witness poc.sigsum.org/nisse 1c25f8a44c635457e2e391d1efbca7d4c2951a0aef06225a881e46b98962ac6c
6+
witness rgdd.se/poc-witness 28c92a5a3a054d317c86fc2eeb6a7ab2054d6217100d0be67ded5b74323c5806
7+
witness witness1.smartit.nu/witness1 f4855a0f46e8a3e23bb40faf260ee57ab8a18249fa402f2ca2d28a60e1a3130e
8+
9+
# Requiring 2 of 3 is intended to give reasonable reliability.
10+
group quorum-rule 2 poc.sigsum.org/nisse rgdd.se/poc-witness witness1.smartit.nu/witness1
11+
12+
quorum quorum-rule

‎src/policy/sigsum-test2-2025.builtin-policy‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Policy using the sigsum test log at test.sigsum.org/barreleye
2+
3+
log 4644af2abd40f4895a003bca350f9d5912ab301a49c77f13e5b6d905c20a5fe6 https://test.sigsum.org/barreleye
4+
5+
# Test witness operated by Niels Möller running on a Glasklar Teknik server
6+
witness poc.sigsum.org/nisse 1c25f8a44c635457e2e391d1efbca7d4c2951a0aef06225a881e46b98962ac6c
7+
8+
# Test witness operated by Rasmus Dahlberg
9+
witness rgdd.se/poc-witness 28c92a5a3a054d317c86fc2eeb6a7ab2054d6217100d0be67ded5b74323c5806
10+
11+
# Test witness operated by Elias Rudberg
12+
witness witness1.smartit.nu/witness1 f4855a0f46e8a3e23bb40faf260ee57ab8a18249fa402f2ca2d28a60e1a3130e
13+
14+
# Test witness operated by Filippo Valsorda
15+
witness navigli.sunlight.geomys.org/dev b20196b937a30d19f0cb7dfa2d5388bc8ddde9cc3df4c24fcf63db27a573d3f2
16+
17+
# See about page: https://remora.n621.de/
18+
witness remora.n621.de ebcdeb78e7fdb2ef9227b2c1ef11e94600b55b4d6d9a57877e31ee89e59adc36
19+
20+
# Test witness operated by Grégoire Détrez
21+
witness witness.stagemole.eu 4a921b7caef58ae670cdc11ef4184f1c058f7b9259a9107a969f69fa54aa496f
22+
23+
# Test witness operated by Tillitis AB
24+
witness tillitis.se/test-witness-1 5c35281928e9da396beede5f22a2251a589e6ac6de52a4de85de8634ffccaf6d
25+
26+
# Group of 3 witnesses that are all run by Glasklar employees
27+
group glasklar-test-witnesses 2 poc.sigsum.org/nisse rgdd.se/poc-witness witness1.smartit.nu/witness1
28+
29+
# Requiring 4 of 5 is intended to give reasonable reliability.
30+
group quorum-rule 4 glasklar-test-witnesses navigli.sunlight.geomys.org/dev remora.n621.de witness.stagemole.eu tillitis.se/test-witness-1
31+
32+
quorum quorum-rule

0 commit comments

Comments
 (0)