Class TrustedRoot

Namespace

Dev.Sigstore.Trustroot.V1

Assembly

Sigstore.dll

TrustedRoot describes the client's complete set of trusted entities. How the TrustedRoot is populated is not specified, but can be a combination of many sources such as TUF repositories, files on disk etc.

The TrustedRoot is not meant to be used for any artifact verification, only to capture the complete/global set of trusted verification materials. When verifying an artifact, based on the artifact and policies, a selection of keys/authorities are expected to be extracted and provided to the verification function. This way the set of keys/authorities can be kept to a minimal set by the policy to gain better control over what signatures that are allowed.

The embedded transparency logs, CT logs, CAs and TSAs MUST include any previously used instance -- otherwise signatures made in the past cannot be verified.

All the listed instances SHOULD be sorted by the 'valid_for.start' in ascending order, that is, the oldest instance first. Clients MUST accept instances that overlaps in time, if not clients may experience problems during rotations of verification materials.

To be able to manage planned rotations of either transparency logs or certificate authorities, clienst MUST accept lists of instances where the last instance have a 'valid_for' that belongs to the future. This should not be a problem as clients SHOULD first seek the trust root for a suitable instance before creating a per artifact trust root (that is, a sub-set of the complete trust root) that is used for verification.

public sealed class TrustedRoot : IMessage<TrustedRoot>, IEquatable<TrustedRoot>, IDeepCloneable<TrustedRoot>, IBufferMessage, IMessage

Inheritance

object

TrustedRoot

Implements

IMessage<TrustedRoot>

IEquatable<TrustedRoot>

IDeepCloneable<TrustedRoot>

IBufferMessage

IMessage

Inherited Members

object.Equals(object, object)

object.GetType()

object.ReferenceEquals(object, object)

Constructors

TrustedRoot()

public TrustedRoot()

TrustedRoot(TrustedRoot)

public TrustedRoot(TrustedRoot other)

Parameters

other TrustedRoot

Fields

CertificateAuthoritiesFieldNumber

Field number for the "certificate_authorities" field.

public const int CertificateAuthoritiesFieldNumber = 3

Field Value

int

CtlogsFieldNumber

Field number for the "ctlogs" field.

public const int CtlogsFieldNumber = 4

Field Value

int

MediaTypeFieldNumber

Field number for the "media_type" field.

public const int MediaTypeFieldNumber = 1

Field Value

int

TimestampAuthoritiesFieldNumber

Field number for the "timestamp_authorities" field.

public const int TimestampAuthoritiesFieldNumber = 5

Field Value

int

TlogsFieldNumber

Field number for the "tlogs" field.

public const int TlogsFieldNumber = 2

Field Value

int

Properties

CertificateAuthorities

A set of trusted certificate authorities (e.g Fulcio), and any intermediate certificates they provide. If a CA is issuing multiple intermediate certificate, each combination shall be represented as separate chain. I.e, a single root cert may appear in multiple chains but with different intermediate and/or leaf certificates. The certificates are intended to be used for verifying artifact signatures.

public RepeatedField<CertificateAuthority> CertificateAuthorities { get; }

Property Value

RepeatedField<CertificateAuthority>

Ctlogs

A set of trusted certificate transparency logs.

public RepeatedField<TransparencyLogInstance> Ctlogs { get; }

Property Value

RepeatedField<TransparencyLogInstance>

Descriptor

public static MessageDescriptor Descriptor { get; }

Property Value

MessageDescriptor

MediaType

MUST be application/vnd.dev.sigstore.trustedroot.v0.2+json when encoded as JSON. Clients MAY choose to also support application/vnd.dev.sigstore.trustedroot.v0.1+json Clients MAY process and parse content with the media type defined in the old format: application/vnd.dev.sigstore.trustedroot+json;version=0.1

public string MediaType { get; set; }

Property Value

string

Parser

public static MessageParser<TrustedRoot> Parser { get; }

Property Value

MessageParser<TrustedRoot>

TimestampAuthorities

A set of trusted timestamping authorities.

public RepeatedField<CertificateAuthority> TimestampAuthorities { get; }

Property Value

RepeatedField<CertificateAuthority>

Tlogs

A set of trusted Rekor servers.

public RepeatedField<TransparencyLogInstance> Tlogs { get; }

Property Value

RepeatedField<TransparencyLogInstance>

Methods

CalculateSize()

Calculates the size of this message in Protocol Buffer wire format, in bytes.

public int CalculateSize()

Returns

int

The number of bytes required to write this message to a coded output stream.

Clone()

Creates a deep clone of this object.

public TrustedRoot Clone()

Returns

TrustedRoot

A deep clone of this object.

Equals(TrustedRoot)

Indicates whether the current object is equal to another object of the same type.

public bool Equals(TrustedRoot other)

Parameters

other TrustedRoot

An object to compare with this object.

Returns

bool

true if the current object is equal to the other parameter; otherwise, false.

Equals(object)

Determines whether the specified object is equal to the current object.

public override bool Equals(object other)

Parameters

other object

Returns

bool

true if the specified object is equal to the current object; otherwise, false.

GetHashCode()

Serves as the default hash function.

public override int GetHashCode()

Returns

int

A hash code for the current object.

MergeFrom(TrustedRoot)

Merges the given message into this one.

public void MergeFrom(TrustedRoot other)

Parameters

other TrustedRoot

Remarks

See the user guide for precise merge semantics.

MergeFrom(CodedInputStream)

Merges the data from the specified coded input stream with the current message.

public void MergeFrom(CodedInputStream input)

Parameters

input CodedInputStream

Remarks

See the user guide for precise merge semantics.

ToString()

Returns a string that represents the current object.

public override string ToString()

Returns

string

A string that represents the current object.

WriteTo(CodedOutputStream)

Writes the data to the given coded output stream.

public void WriteTo(CodedOutputStream output)

Parameters

output CodedOutputStream

Coded output stream to write the data to. Must not be null.