Warn users if fetching trusted root via TUF · Issue #3932 · sigstore/cosign · GitHub

8000 Warn users if fetching trusted root via TUF · Issue #3932 · sigstore/cosign · GitHub

More Web Proxy on the site http://driver.im/

Warn users if fetching trusted root via TUF #3932

Closed

Closed

Warn users if fetching trusted root via TUF#3932

Labels

opened

on Nov 11, 2024

Description

With #3796, we added support to cosign for using trusted roots when verifying protobuf bundles. If you leave off the trusted root, we assuming the public good instance, and we fetch the trusted root via TUF with a network request. This was confusing to some users, so we should add a log message explaining what's going on.

Metadata

Assignees

No one assigned

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

0