Project

Profile

Help

Story #5523

As a user, I can view certificate-base signatures of Collection content

Added by bmbouter 2 months ago. Updated 2 months ago.

Status:
NEW
Priority:
Normal
Assignee:
-
Sprint/Milestone:
-
Start date:
Due date:
% Done:

0%

Platform Release:
Blocks Release:
Backwards Incompatible:
No
Groomed:
No
Sprint Candidate:
No
Tags:
QA Contact:
Complexity:
Smash Test:
Verified:
No
Verification Required:
No
Sprint:

Description

Problem

Users can get their collection content from many places, and they want to understand where it came from. One great way to do this while increasing security is to have the mechanism of data provenance be a signature along with the claim of who it was made by.

This signature would be for a specific CollectionVersion asset (for a specific version). If the asset is modified even one bit (literally) it wouldn't cryptographically validate anymore so every version would need a signature.

How these signatures are generated or verified is beyond the scope of this ticket.

Solution

Add a new Model to pulp_ansible called CollectionVersionSignature and have it be a ForeignKey to CollectionVersion. Have the backref relationship be called 'signatures'. Assuming both data tables are populated you could:

my_collection_version = CollectionVersion.objects.get(pk=1)
my_collection_version.signatures   #  <---- this would be the Queryset of related objects.

To expose this to the user, we would extend the CollectionVersion serializer to display the signatures themselves.

History

#1 Updated by bmbouter 2 months ago

  • Parent task set to #5517

#2 Updated by bmbouter 2 months ago

  • Parent task deleted (#5517)

Removing since signing is being pushed post GA per https://github.com/ansible/galaxy-dev/issues/103#issuecomment-539037285

Please register to edit this issue

Also available in: Atom PDF