Signing event: sign/root-v12 #1439

sigstore-bot · 2025-02-05T08:07:10Z

Processing signing event sign/root-v12, please wait.

Simple version & expiry bump Signed-off-by: Jussi Kukkonen <[email protected]>

sigstore-bot · 2025-02-05T08:07:11Z

Current signing event state

Event sign/root-v12 (commit 9d4602b)

❌ root

Role root is unsigned and not yet verified
Still missing signatures from @dlorenc, @joshuagl, @bobcallaway, @mnm678, @SantiagoTorres
Signers can sign these changes by running tuf-on-ci-sign sign/root-v12
Error: Key 7247f0dbad85b147e1863bade761243cc785dcb7aa410e7105dd3d2b61a36d2c keyid does not match content hash

jku · 2025-02-05T08:08:10Z

This signing event is now ready, keyholders please have a look.

First commit is a simple version bump: this you will see the signing event status error
because we now have a check for the keyid issue (the reason for this signing
event)
Second commit includes the keyid correction

Note that the result looks absolutely awful in git diff, apologies for that

The only change is the online key keyid changing and as a result that key moving
a little in the sorted keys object. No key content changes here.
- old: "7247f0dbad85b147e1863bade761243cc785dcb7aa410e7105dd3d2b61a36d2c"
- new: "0c87432c3bf09fd99189fdc32fa5eaedf4e4a5fac7bab73fa04a2e0fc64af6f5"
Unfortunately the way Git shows this is a disaster
I have a small script that you can run on main branch (to see current situtation)
and on the sign/root-v12 branch (to see situation in signing event) if that helps:
https://gist.github.com/jku/4379186fd4ffb2a19798734c83deb695.

The keys defined in root.json are listed below for reference (this is the output of the script I mentioned):

On main branch:

OWNER | KEYID | DOES KEYID MATCH KEY CONTENT
@santiagotorres | 22f4caec6d8e6f9555af66b3d4c3cb06a3bb23fdc7e39c916c61f462e6f52b06 | keyid matches content
@bobcallaway | 61643838125b440b40db6942f5cb5a31c0dc04368316eb2aaa58b95904a58222 | keyid matches content
@dlorenc | 6f260089d5923daf20166ca657c543af618346ab971884a99962b01988bbe0c3 | keyid matches content
online key | 7247f0dbad85b147e1863bade761243cc785dcb7aa410e7105dd3d2b61a36d2c | ERROR: keyid does not match content hash
@joshuagl | a687e5bf4fab82b0ee58d46e05c9535145a2c9afb458f43d42b45ca0fdce2a70 | keyid matches content
@mnm678 | e71a54d543835ba86adad9460379c7641fb8726d164ea766801a1c522aba7ea2 | keyid matches content

On sign/root-v12:

OWNER | KEYID | DOES KEYID MATCH KEY CONTENT
online key | 0c87432c3bf09fd99189fdc32fa5eaedf4e4a5fac7bab73fa04a2e0fc64af6f5 | keyid matches content
@santiagotorres | 22f4caec6d8e6f9555af66b3d4c3cb06a3bb23fdc7e39c916c61f462e6f52b06 | keyid matches content
@bobcallaway | 61643838125b440b40db6942f5cb5a31c0dc04368316eb2aaa58b95904a58222 | keyid matches content
@dlorenc | 6f260089d5923daf20166ca657c543af618346ab971884a99962b01988bbe0c3 | keyid matches content
@joshuagl | a687e5bf4fab82b0ee58d46e05c9535145a2c9afb458f43d42b45ca0fdce2a70 | keyid matches content
@mnm678 | e71a54d543835ba86adad9460379c7641fb8726d164ea766801a1c522aba7ea2 | keyid matches content

Only the keyid changes (key content remains the same): old: "7247f0dbad85b147e1863bade761243cc785dcb7aa410e7105dd3d2b61a36d2c" new: "0c87432c3bf09fd99189fdc32fa5eaedf4e4a5fac7bab73fa04a2e0fc64af6f5" * Unfortunately the ordering of keys is alphabetical and changing the keyid moves the KMS slightly higher in the list * git diff makes an absolute mess of showing the change (this is one of the reasons I would like to not change keyids but here we are Signed-off-by: Jussi Kukkonen <[email protected]>

sigstore-bot · 2025-02-05T08:09:22Z

Current signing event state

Event sign/root-v12 (commit 1874668)

❌ root

Role root is unsigned and not yet verified
Still missing signatures from @joshuagl, @mnm678, @SantiagoTorres, @dlorenc, @bobcallaway
Signers can sign these changes by running tuf-on-ci-sign sign/root-v12

kommendorkapten

Looks good.

kommendorkapten · 2025-02-05T12:44:43Z

Maybe easier to read?

kommendorkapten@m1m14-msft:~/git/root-signing % diff -u metadata/root_history/11.root.json metadata/root.json
--- metadata/root_history/11.root.json	2025-02-05 13:43:13
+++ metadata/root.json	2025-02-05 13:43:13
@@ -2,30 +2,42 @@
  "signatures": [
   {
    "keyid": "6f260089d5923daf20166ca657c543af618346ab971884a99962b01988bbe0c3",
-   "sig": "304402204e6907aba6343c7c8db2bfaccfd61af810f1dd40b773e7f42a611b9789bb752802200fbd875f4aa6ae5dafc845f39f50331bf415c78e992f4daab3ff1388a339d1db"
+   "sig": ""
   },
   {
    "keyid": "e71a54d543835ba86adad9460379c7641fb8726d164ea766801a1c522aba7ea2",
-   "sig": "3045022100b8549ad03ad6c059ecba6c75511c52ceeb5e3e733b3c9977601a6cff34d1972e0220742c67407c1f9a3f408cb2e9c1abe52cba887e44a2f4734786f54feda57104c3"
+   "sig": ""
   },
   {
    "keyid": "22f4caec6d8e6f9555af66b3d4c3cb06a3bb23fdc7e39c916c61f462e6f52b06",
-   "sig": "3046022100ed5122dd6b91e3ca974841de774d99024ddcae1e9c38bb0fb3c8d75a5aa573fe022100e0945dfe5ce51ccfa205217c6ed0b7c4dd9f84c0246a3a02790efbac49bbfe53"
+   "sig": ""
   },
   {
    "keyid": "61643838125b440b40db6942f5cb5a31c0dc04368316eb2aaa58b95904a58222",
-   "sig": "30450221008edf6889c21ad4ea1863749173a0d2b8f630eb7c61c78dfb89cec1342e9c621f022064cbe2723fde47dbeaa52b2835225c160f83a019b3b729e7bbe1e2b3c9886b1c"
+   "sig": ""
   },
   {
    "keyid": "a687e5bf4fab82b0ee58d46e05c9535145a2c9afb458f43d42b45ca0fdce2a70",
-   "sig": "30440220770e8aabdbf019b0e48a9a7a34f93b3deebd07341c936383eeade828d92c83b00220787019373a612c59ae4dc068d02bf68507da346f1c31909822897e4fd30a6a62"
+   "sig": ""
   }
  ],
  "signed": {
   "_type": "root",
   "consistent_snapshot": true,
-  "expires": "2025-08-05T08:37:20Z",
+  "expires": "2025-08-19T14:33:09Z",
   "keys": {
+   "0c87432c3bf09fd99189fdc32fa5eaedf4e4a5fac7bab73fa04a2e0fc64af6f5": {
+    "keyid_hash_algorithms": [
+     "sha256",
+     "sha512"
+    ],
+    "keytype": "ecdsa",
+    "keyval": {
+     "public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWRiGr5+j+3J5SsH+Ztr5nE2H2wO7\nBV+nO3s93gLca18qTOzHY1oWyAGDykMSsGTUBSt9D+An0KfKsD2mfSM42Q==\n-----END PUBLIC KEY-----\n"
+    },
+    "scheme": "ecdsa-sha2-nistp256",
+    "x-tuf-on-ci-online-uri": "gcpkms:projects/sigstore-root-signing/locations/global/keyRings/root/cryptoKeys/timestamp/cryptoKeyVersions/1"
+   },
    "22f4caec6d8e6f9555af66b3d4c3cb06a3bb23fdc7e39c916c61f462e6f52b06": {
     "keyid_hash_algorithms": [
      "sha256",
\ No newline at end of file
@@ -62,18 +74,6 @@
     "scheme": "ecdsa-sha2-nistp256",
     "x-tuf-on-ci-keyowner": "@dlorenc"
    },
-   "7247f0dbad85b147e1863bade761243cc785dcb7aa410e7105dd3d2b61a36d2c": {
-    "keyid_hash_algorithms": [
-     "sha256",
-     "sha512"
-    ],
-    "keytype": "ecdsa",
-    "keyval": {
-     "public": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWRiGr5+j+3J5SsH+Ztr5nE2H2wO7\nBV+nO3s93gLca18qTOzHY1oWyAGDykMSsGTUBSt9D+An0KfKsD2mfSM42Q==\n-----END PUBLIC KEY-----\n"
-    },
-    "scheme": "ecdsa-sha2-nistp256",
-    "x-tuf-on-ci-online-uri": "gcpkms:projects/sigstore-root-signing/locations/global/keyRings/root/cryptoKeys/timestamp/cryptoKeyVersions/1"
-   },
    "a687e5bf4fab82b0ee58d46e05c9535145a2c9afb458f43d42b45ca0fdce2a70": {
     "keyid_hash_algorithms": [
      "sha256",
\ No newline at end of file
@@ -112,7 +112,7 @@
    },
    "snapshot": {
     "keyids": [
-     "7247f0dbad85b147e1863bade761243cc785dcb7aa410e7105dd3d2b61a36d2c"
+     "0c87432c3bf09fd99189fdc32fa5eaedf4e4a5fac7bab73fa04a2e0fc64af6f5"
     ],
     "threshold": 1,
     "x-tuf-on-ci-expiry-period": 3650,
\ No newline at end of file
@@ -130,7 +130,7 @@
    },
    "timestamp": {
     "keyids": [
-     "7247f0dbad85b147e1863bade761243cc785dcb7aa410e7105dd3d2b61a36d2c"
+     "0c87432c3bf09fd99189fdc32fa5eaedf4e4a5fac7bab73fa04a2e0fc64af6f5"
     ],
     "threshold": 1,
     "x-tuf-on-ci-expiry-period": 7,
\ No newline at end of file
@@ -138,7 +138,7 @@
    }
   },
   "spec_version": "1.0",
-  "version": 11,
+  "version": 12,
   "x-tuf-on-ci-expiry-period": 197,
   "x-tuf-on-ci-signing-period": 46
  }
\ No newline at end of file

jku · 2025-02-05T12:58:22Z

We are now happy with this signing event (well, not happy with the diff output but otherwise): keyholders, please have a look and sign.

Signed-off-by: Bob Callaway <[email protected]>

@bobcallaway

Signature from @bobcallaway

sigstore-bot · 2025-02-05T13:43:07Z

Current signing event state

Event sign/root-v12 (commit b955d81)

❌ root

Role root is not yet verified. It is signed by 1/3 (1/3) signers (@bobcallaway).
Still missing signatures from @mnm678, @SantiagoTorres, @joshuagl, @dlorenc
Signers can sign these changes by running tuf-on-ci-sign sign/root-v12

Signed-off-by: Joshua Lock <[email protected]>

@joshuagl

Signature from @joshuagl

sigstore-bot · 2025-02-05T15:05:55Z

Current signing event state

Event sign/root-v12 (commit ca9de75)

❌ root

Role root is not yet verified. It is signed by 2/3 (2/3) signers (@joshuagl, @bobcallaway).
Still missing signatures from @dlorenc, @SantiagoTorres, @mnm678
Signers can sign these changes by running tuf-on-ci-sign sign/root-v12

Signed-off-by: Marina Moore <[email protected]>

@mnm678

Signature from @mnm678

sigstore-bot · 2025-02-06T08:03:28Z

Current signing event state

Event sign/root-v12 (commit 37060a5)

✅ root

Role root is verified and signed by 3/3 (3/3) signers (@mnm678, @joshuagl, @bobcallaway).
Still missing signatures from @dlorenc, @SantiagoTorres
Signers can sign these changes by running tuf-on-ci-sign sign/root-v12

Signing event is successful

Threshold of signatures has been reached: this signing event can be reviewed and merged.

* This test is not in root-signing-staging since the client does not support staging * Uses current main HEAD since last release does not have the "bundle" example we use * Does not test signing since the client does not support signing with the GitHub Actions workflow identity This test currently fails because of #1431: sigstore-rs expects specifically computed TUF keyids which current root metadata does not provide. Signed-off-by: Jussi Kukkonen <[email protected]>

This sigstore-rs branch contains the v12 root so allows testing when v12 is getting published Signed-off-by: Jussi Kukkonen <[email protected]>

jku · 2025-02-06T08:47:21Z

Thanks for quick keyholder reactions

as fredrik mentioned we're ok with 3/5 signatures this time
we'll include tests: Add sigstore-rs client test #1434 here before merging so we hopefully get an immediate sigstore-rs client test included with this -- this requires no action from keyholders

tests: Add sigstore-rs client test

jku

LGTM

kommendorkapten

lgtm

'root' role/delegation change

9d4602b

Simple version & expiry bump Signed-off-by: Jussi Kukkonen <[email protected]>

This was linked to issues Feb 5, 2025

signing event to fix compatibility issue with sigstore-rs #1437

Closed

key_id mismatch for root v11 #1431

Closed

This was unlinked from issues Feb 5, 2025

key_id mismatch for root v11 #1431

Closed

signing event to fix compatibility issue with sigstore-rs #1437

Closed

jku requested a review from kommendorkapten February 5, 2025 12:21

kommendorkapten previously approved these changes Feb 5, 2025

View reviewed changes

bobcallaway and others added 2 commits February 5, 2025 08:21

Signature from @bobcallaway

6a8f3db

Signed-off-by: Bob Callaway <[email protected]>

Merge pull request #1442 from bobcallaway/sign/root-v12

b955d81

Signature from @bobcallaway

kommendorkapten dismissed their stale review via b955d81 February 5, 2025 13:42

joshuagl and others added 2 commits February 5, 2025 15:03

Signature from @joshuagl

ebb06ef

Signed-off-by: Joshua Lock <[email protected]>

Merge pull request #1444 from joshuagl/sign/root-v12

ca9de75

Signature from @joshuagl

mnm678 and others added 2 commits February 5, 2025 17:00

Signature from @mnm678

0bff37d

Signed-off-by: Marina Moore <[email protected]>

Merge pull request #1445 from mnm678/sign/root-v12

37060a5

Signature from @mnm678

sigstore-bot marked this pull request as ready for review February 6, 2025 08:03

jku added 2 commits February 6, 2025 10:19

tests: Use custom branch in sigstore-rs test

89158ba

This sigstore-rs branch contains the v12 root so allows testing when v12 is getting published Signed-off-by: Jussi Kukkonen <[email protected]>

Merge pull request #1434 from jku/rust-client-test

0a60b8c

tests: Add sigstore-rs client test

jku approved these changes Feb 6, 2025

View reviewed changes

kommendorkapten approved these changes Feb 6, 2025

View reviewed changes

jku merged commit c9f66c1 into main Feb 6, 2025
3 checks passed

jku deleted the sign/root-v12 branch February 6, 2025 08:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Signing event: sign/root-v12 #1439

Signing event: sign/root-v12 #1439

sigstore-bot commented Feb 5, 2025

sigstore-bot commented Feb 5, 2025

jku commented Feb 5, 2025 •

edited

Loading

sigstore-bot commented Feb 5, 2025

kommendorkapten left a comment

kommendorkapten commented Feb 5, 2025 •

edited

Loading

jku commented Feb 5, 2025

sigstore-bot commented Feb 5, 2025

sigstore-bot commented Feb 5, 2025

sigstore-bot commented Feb 6, 2025

jku commented Feb 6, 2025

jku left a comment

kommendorkapten left a comment

Signing event: sign/root-v12 #1439

Signing event: sign/root-v12 #1439

Conversation

sigstore-bot commented Feb 5, 2025

sigstore-bot commented Feb 5, 2025

Current signing event state

❌ root

jku commented Feb 5, 2025 • edited Loading

sigstore-bot commented Feb 5, 2025

Current signing event state

❌ root

kommendorkapten left a comment

Choose a reason for hiding this comment

kommendorkapten commented Feb 5, 2025 • edited Loading

jku commented Feb 5, 2025

sigstore-bot commented Feb 5, 2025

Current signing event state

❌ root

sigstore-bot commented Feb 5, 2025

Current signing event state

❌ root

sigstore-bot commented Feb 6, 2025

Current signing event state

✅ root

Signing event is successful

jku commented Feb 6, 2025

jku left a comment

Choose a reason for hiding this comment

kommendorkapten left a comment

Choose a reason for hiding this comment

jku commented Feb 5, 2025 •

edited

Loading

kommendorkapten commented Feb 5, 2025 •

edited

Loading