Comments (3)
Thanks for your report.
Pedantically, I’d argue that the spec already implies this by referring to RFC 4880 section 11.3. , which refers to specific binary packet formats, and does not talk about ASCII armor; but it’s clearly not explicit enough.
Pragmatically, much more important is that the implementation chosen by the containers_image_openpgp
build tag has always rejected ASCII-armored signatures, so they were not widely interoperable (E.g. CRI-O is rejecting them in the default build).
So, I am proposing #1854 .
As much as I would like to ask for (or provide) handling for content of this sort,
Why is it useful?
To me it seems to only add unnecessary ambiguity, implementation complexity, and data size, for no end-user benefit; if anything, it adds risk because it makes it easier for users to see, and potentially rely on, the contents of the signature without actually verifying its authenticity.
I may well be missing something; what is it?
(Arguably, “we have tons of content signed that way” could count as a good enough reason alone… but, it’s, shall we say, not an elegant reason.)
from image.
BTW if past signed content is the only reason, I wouldn’t object too strongly to detecting and allowing the ASCII-armored signatures through, and letting GPG deal with them the way it has done; that adds little to no signature verification risk. I would be much less happy about actually adding ASCII armor implementation to the containers_image_openpgp
code path, that would directly be adding rarely-used code to a critical signature verification code path.
from image.
#1854 is a satisfactory resolution. Thanks, @mtrmac!
from image.
Related Issues (20)
- Docker client code can no longer talk to the latest verson of the docker daemon 25.0.0 HOT 5
- Allow empty OCI configs for artifacts HOT 9
- policy.json overwrite not honouring $XDG_CONFIG_HOME HOT 3
- Podman cannot pull image from local registry HOT 4
- copy.Options.EnsureCompressionVariantsExist doesn’t detect existing variants with zstd:chunked
- support multiple sigstore keys HOT 6
- How can I copy from a tar file stream HOT 7
- "slices" module only in go 1.21 HOT 1
- Cannot pull sigstore signed image with podman HOT 4
- Error inspecting local manifest-lists HOT 6
- platform.WantedPlatforms is noisy on macOS HOT 7
- Incorrect syntax highlighting in containers-transports.5
- Why do we get the whole image when inspect with docker daemon? HOT 2
- Support sigstore BYO PKI verification HOT 1
- Support more arbitrary credential helper executable names? HOT 4
- OCI image index loose the artifactType property on copy HOT 4
- zstd:chunked and layer encryption don’t make sense together HOT 3
- How to change the policy.json default path? HOT 1
- Mirrors are ignored when registry is blocked HOT 11
- Support Witnessing Sigstore Signing with a Timestamp Authority Server HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from image.