docs(adr): Minor corrections to ADR 0008 and align with signing handler implementation by morri-son · Pull Request #2353 · open-component-model/open-component-model

morri-son · 2026-04-21T15:40:28Z

Summary

Align ADR 0008 (Signing & Verification) with the actual RSA and Sigstore handler implementations.

Fix consumer identity attributes: replace non-existent name with algorithm + signature
Fix identity types: PEM/v1alpha1 → RSA/v1alpha1, RSASSA-PSS/v1alpha1 → RSASigningConfiguration/v1alpha1
Fix sigstore types: sign.sigstore.dev/v1alpha1 → SigstoreSigningConfiguration/v1alpha1, verify.sigstore.dev/v1alpha1 → SigstoreVerificationConfiguration/v1alpha1
Fix sigstore verification identity: PEM/v1alpha1 → TrustedRoot/v1alpha1
Fix CLI flags in mermaid diagrams: --signer/--verifier → --signer-spec/--verifier-spec
Update signer-spec/verifier-spec YAML examples to match implementation structs

Relates to: open-component-model/ocm-project#996

- Fix consumer identity attributes: replace non-existent 'name' with 'algorithm' + 'signature' as used by RSA and sigstore handlers - Fix identity types: PEM/v1alpha1 -> RSA/v1alpha1, RSASSA-PSS/v1alpha1 -> RSASigningConfiguration/v1alpha1 - Fix sigstore types: sign.sigstore.dev/v1alpha1 -> SigstoreSigningConfiguration/v1alpha1, verify.sigstore.dev/v1alpha1 -> SigstoreVerificationConfiguration/v1alpha1, SigstoreOIDC/v1 -> v1alpha1 - Fix sigstore verification: PEM/v1alpha1 -> TrustedRoot/v1alpha1, public_key_pem_file -> trusted_root_json_file - Fix CLI flags in mermaid diagrams and shell examples: --signer/--verifier -> --signer-spec/--verifier-spec - Update signer-spec/verifier-spec YAML to match implementation structs Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>

netlify · 2026-04-21T15:40:34Z

✅ Deploy Preview for ocm-website canceled.

Name	Link
🔨 Latest commit	`2163078`
🔍 Latest deploy log	https://app.netlify.com/projects/ocm-website/deploys/69e8d881615af00008f976a0

coderabbitai · 2026-04-21T15:40:49Z

📝 Walkthrough

Walkthrough

This PR updates an Architecture Decision Record (ADR 0008) that documents signing and verification flows. The changes replace algorithm shorthand CLI flags with spec file references, rename handler type configurations for RSA and Sigstore implementations, and update the corresponding credential consumer identity types to match new handler specifications.

Changes

Cohort / File(s)	Summary
ADR 0008 Documentation Updates `docs/adr/0008_signing_verification.md`	Updated CLI examples from algorithm shorthand (`--signer rsapss`) to spec file references (`--signer-spec ./rsapss.yaml`). Renamed handler types: RSASSA-PSS handler from `RSASSA-PSS/v1alpha1` to `RSASigningConfiguration/v1alpha1`, Sigstore handlers from `sign.sigstore.dev/v1alpha1` / `verify.sigstore.dev/v1alpha1` to `SigstoreSigningConfiguration/v1alpha1` / `SigstoreVerificationConfiguration/v1alpha1`. Updated spec filenames and credential consumer identity types (RSA from `PEM/v1alpha1` to `RSA/v1alpha1`, Sigstore from PEM-based to `TrustedRoot/v1alpha1`). Added `algorithm` and `signature` fields to configuration examples.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

chore: enhance CLI help: add example for signer spec and add some more explaining lines #1965: Updates documentation and CLI examples for the signer-spec flag usage.
docs: add ADR for sigstore handler #2300: Adds a Sigstore-specific ADR alongside the handler type and configuration updates in this PR.

Suggested labels

size/m

Suggested reviewers

jakobmoellerdev
matthiasbruns

Poem

🐰 Hops through the docs with specs in paw,
Where --signer-spec is now the law!
RSA and Sigstore, renamed with care,
Configuration flows drift through the air,
Identity types bloom like spring clover,
The ADR's journey is finally over! 📜✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The PR description comprehensively explains the changes, listing specific type/attribute replacements, CLI flag updates, and configuration adjustments that align the documentation with implementation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title directly relates to the main change: aligning ADR 0008 documentation with actual signing handler implementation, including corrections to type names, identity attributes, and CLI flags.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

morri-son added kind/chore chore, maintenance, etc. area/documentation Documentation related labels Apr 21, 2026

github-actions Bot added the size/s Small label Apr 21, 2026

Skarlso approved these changes Apr 21, 2026

View reviewed changes

morri-son changed the title ~~docs(adr): align ADR 0008 with signing handler implementation~~ docs(adr): Minor corrections to ADR 0008 and align with signing handler implementation Apr 22, 2026

frewilhelm approved these changes Apr 22, 2026

View reviewed changes

Merge branch 'main' into fix/adr-0008-align-with-implementation

2163078

morri-son enabled auto-merge (squash) April 22, 2026 14:17

morri-son merged commit acb752a into open-component-model:main Apr 22, 2026
25 checks passed

coderabbitai Bot mentioned this pull request Apr 22, 2026

feat(sigstore): add cosign signing handler [1/2] #2344

Merged

3 tasks

morri-son deleted the fix/adr-0008-align-with-implementation branch April 23, 2026 12:45

This was referenced Apr 24, 2026

docs: add consolidated security design and assurance case #2290

Merged

feat(cli): integrate cosign signing handler [2/2] #2346

Merged

This was referenced May 6, 2026

feat: typed credentials for rsa binding (Phase 2) #2418

Merged

feat(sigstore): typed credentials for sigstore binding (Phase 2) #2453

Closed

This was referenced May 15, 2026

feat(sigstore)!: add issuer/clientID to SignConfig for enterprise OIDC #2512

Merged

docs(website): add keyless sign/verify how-tos and group sign/verify docs in own folder #2561

Closed

docs(website): add Sigstore to signing concept and trust models #2584

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs(adr): Minor corrections to ADR 0008 and align with signing handler implementation#2353

docs(adr): Minor corrections to ADR 0008 and align with signing handler implementation#2353
morri-son merged 2 commits into
open-component-model:mainfrom
morri-son:fix/adr-0008-align-with-implementation

morri-son commented Apr 21, 2026

Uh oh!

netlify Bot commented Apr 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 21, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

morri-son commented Apr 21, 2026

Summary

Uh oh!

netlify Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for ocm-website canceled.

Uh oh!

coderabbitai Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

netlify Bot commented Apr 21, 2026 •

edited

Loading

coderabbitai Bot commented Apr 21, 2026 •

edited

Loading