Skip to content

cli: Add --rekor-version to sign arguments#1471

Merged
jku merged 7 commits into
sigstore:mainfrom
jku:add-rekor-version-option
Aug 26, 2025
Merged

cli: Add --rekor-version to sign arguments#1471
jku merged 7 commits into
sigstore:mainfrom
jku:add-rekor-version-option

Conversation

@jku

@jku jku commented Jul 22, 2025 •
edited
Loading

Copy link
Copy Markdown
Member

This adds a CLI option that should not be needed... but it could be handy if

  • SigningConfig already contains rekor v2 (and still contains a v1 instance)
  • user for some reason does not want rekor v2 entries in the bundle

This option only does anything if there are multiple Rekor versions listed in SigningConfig.

The test is changed since the "ANY" selector is now considered to not be
an error if there are 0 services:

  • This is not a problem since for both TSAs and tlogs we have a check
    that there is at least one service
  • This improves the error message when --rekor-version is used with
    a version that is not found in signingconfig

@jku jku force-pushed the add-rekor-version-option branch 3 times, most recently from aa1cb9e to a86bcf7 Compare July 22, 2025 11:59
di
di reviewed Jul 22, 2025
View reviewed changes
Comment thread sigstore/_cli.py
@jku jku force-pushed the add-rekor-version-option branch from a86bcf7 to 55c8911 Compare July 23, 2025 13:47
@jku

jku commented Jul 23, 2025

Copy link
Copy Markdown
Member Author

I'm filing a separate issue about testing the bundle compatibility -- choosing the rekor version is one thing but there are other related changes in the bundle we produce (like TSA timestamps) that could affect compatibility

@jku jku mentioned this pull request Jul 23, 2025
Closed
@jku jku changed the base branch from parallel-signing to main July 23, 2025 14:46
jku added 3 commits July 23, 2025 17:48
@jku
cli: Add --rekor-version to sign arguments
74fdbfd 
This should not be needed... but it could be handy if
* SigningConfig already contains rekor v2
* user for some reason does not want rekor v2 entries in
  the bundle

This option only does anything if there are multiple Rekor versions
listed in SigningConfig.

The test is changed since the "ANY" selector is now considered to not be
an error if there are 0 services:
* This is not a problem since for both TSAs and tlogs we have a check
  that there is at least one service
* This improves the error message when --rekor-version is used with
  a version that is not found in signingconfig

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku
README: Update help output
3c7fa40 
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku
cli: Improve help output for --rekor-version
dc21376 
Avoid saying "default: None", mention the valid values instead.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku jku force-pushed the add-rekor-version-option branch from 55c8911 to dc21376 Compare July 23, 2025 14:49
@jku

jku commented Jul 23, 2025

Copy link
Copy Markdown
Member Author

I'm keeping this a draft until I'm confident I know how #1474 looks like

This was referenced Jul 30, 2025
Closed
Merged
@jku jku mentioned this pull request Aug 11, 2025
Closed
@jku jku force-pushed the add-rekor-version-option branch from 25be8c6 to b36e65b Compare August 15, 2025 12:14
@jku

jku commented Aug 15, 2025

Copy link
Copy Markdown
Member Author

Marking ready for review: I'm still not sure if this is actually useful but happy to include (and improve) it if others feel like it's useful.

sigstore-python 3.6.5 correctly verifies a signature bundle created with sigstore-python from this branch if --rekor-version 1 is used.

@jku jku marked this pull request as ready for review August 15, 2025 13:23
@jku

jku commented Aug 20, 2025

Copy link
Copy Markdown
Member Author

any opinions on this @woodruff or @di ?

@jku jku mentioned this pull request Aug 20, 2025
Closed
8 tasks
@jku jku added the component:cli CLI components label Aug 25, 2025
woodruffw
woodruffw approved these changes Aug 25, 2025
View reviewed changes

@woodruffw woodruffw left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM -- no strong opinion, but one thing we could do here is make --rekor-version a global argument instead, similar to --staging works. I don't have a strong intuition on whether that's a better fit or not.

@jku

jku commented Aug 26, 2025

Copy link
Copy Markdown
Member Author

one thing we could do here is make --rekor-version a global argument instead, similar to --staging works

I will merge as is for two reasons:

  • I think there is no good reason to limit verification to specific rekor versions -- For signing it makes some limited sense since there are compatibility concerns: are other users able to verify the signatures we produce.
  • extending this to verification would make trust root management more complex: this seems even less desirable than making singing config more complex

@jku jku merged commit 7b5c684 into sigstore:main Aug 26, 2025
23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@di di di left review comments

@woodruffw woodruffw woodruffw approved these changes

Assignees

No one assigned

Labels

component:cli CLI components

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jku @di @woodruffw