Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1133804 > unrolled thread

Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients "Leo Antunes" <costela@debian.org> - 2023-01-18 21:30 +0100
    Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Reinhard Tartler <siretart@gmail.com> - 2023-01-19 09:40 +0100
      Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Leo Antunes <leo@antun.es> - 2023-01-20 13:40 +0100
        Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Reinhard Tartler <siretart@gmail.com> - 2023-01-20 16:00 +0100
          Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Reinhard Tartler <siretart@gmail.com> - 2023-02-02 12:40 +0100
            Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Leo Antunes <leo@antun.es> - 2023-02-05 21:40 +0100

#1133804 — Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients

Package: wnpp
Severity: wishlist
Owner: Leo Antunes <costela@debian.org>

* Package name    : golang-github-sigstore-sigstore
  Version         : 1.5.1-1
  Upstream Author : The Sigstore Authors <info@sigstore.dev>
* URL             : https://github.com/sigstore/sigstore
* License         : Apache-2.0
  Programming Lang: Go
  Description     : Common go library shared across sigstore services and clients

 sigstore/sigstore contains common Sigstore code: that is, code shared
 by infrastructure (e.g. Fulcio and Rekor) and Go language clients (e.g.
 Cosign and Gitsign.

[toc] | [next] | [standalone]

#1133845

[Multipart message — attachments visible in raw view] — view raw

Hi Leo,

Thank you so much for your interest in packaging this! -- I've noticed that
it is a dependency of containers/image for image signing, and have looked
at this package before. Unfortunately, I got intimidated with the sheer
number of unpackaged dependencies that it requires. Maybe this has improved
since the last time I looked at it? In any case, I've decided to patch the
source to disable signing functionality to avoid requiring code from
sigstore, which is of course very unfortunate.

Let me know if you could use another set of eyeballs or help with this
package. It surely seems intimidating (at least to me).

best,
-rt

On Wed, Jan 18, 2023 at 3:21 PM Leo Antunes <costela@debian.org> wrote:

> Package: wnpp
> Severity: wishlist
> Owner: Leo Antunes <costela@debian.org>
>
> * Package name    : golang-github-sigstore-sigstore
>   Version         : 1.5.1-1
>   Upstream Author : The Sigstore Authors <info@sigstore.dev>
> * URL             : https://github.com/sigstore/sigstore
> * License         : Apache-2.0
>   Programming Lang: Go
>   Description     : Common go library shared across sigstore services and
> clients
>
>  sigstore/sigstore contains common Sigstore code: that is, code shared
>  by infrastructure (e.g. Fulcio and Rekor) and Go language clients (e.g.
>  Cosign and Gitsign.
>
>

-- 
regards,
    Reinhard

[toc] | [prev] | [next] | [standalone]

#1134014

[Multipart message — attachments visible in raw view] — view raw

Hi Reinhard!

I think this changed a bit in the meantime: now the sigstore project has mostly shared lib code, while the individual commands (rekor, fulcio, gitsign, etc) are all in separate repos. So I expect this library to not be THAT difficult to package (the next one on my list is rekor - see #990249 - which will probably require more work).
As soon as #1022937 is done (waiting in NEW since 2 months), I expect sigstore to be a quick follow-up.
However, I'd gladly take an extra pair of eyes on the package, so I can ping you as soon as I have something that builds.

Thanks,
Leo Antunes
------- Original Message -------
On Thursday, January 19th, 2023 at 09:37, Reinhard Tartler <siretart@gmail.com> wrote:

> Hi Leo,
>
> Thank you so much for your interest in packaging this! -- I've noticed that it is a dependency of containers/image for image signing, and have looked at this package before. Unfortunately, I got intimidated with the sheer number of unpackaged dependencies that it requires. Maybe this has improved since the last time I looked at it? In any case, I've decided to patch the source to disable signing functionality to avoid requiring code from sigstore, which is of course very unfortunate.
>
> Let me know if you could use another set of eyeballs or help with this package. It surely seems intimidating (at least to me).
>
> best,
> -rt
>
> On Wed, Jan 18, 2023 at 3:21 PM Leo Antunes <costela@debian.org> wrote:
>
>> Package: wnpp
>> Severity: wishlist
>> Owner: Leo Antunes <costela@debian.org>
>>
>> * Package name : golang-github-sigstore-sigstore
>> Version : 1.5.1-1
>> Upstream Author : The Sigstore Authors <info@sigstore.dev>
>> * URL : https://github.com/sigstore/sigstore
>> * License : Apache-2.0
>> Programming Lang: Go
>> Description : Common go library shared across sigstore services and clients
>>
>> sigstore/sigstore contains common Sigstore code: that is, code shared
>> by infrastructure (e.g. Fulcio and Rekor) and Go language clients (e.g.
>> Cosign and Gitsign.
>
> --
>
> regards,
> Reinhard

[toc] | [prev] | [next] | [standalone]

#1134038

[Multipart message — attachments visible in raw view] — view raw

Awesome, thanks for the update!

Skimming over the sources of sigstore, it seems to me that the awk-sdk
might be easy to disable with minor surgery. Would you be open to uploading
a sigstore package to NEW with the aws functionality disabled and re-enable
it as soon as the awk package becomes available in Debian?

-rt

On Fri, Jan 20, 2023 at 7:30 AM Leo Antunes <leo@antun.es> wrote:

> Hi Reinhard!
>
> I think this changed a bit in the meantime: now the sigstore project has
> mostly shared lib code, while the individual commands (rekor, fulcio,
> gitsign, etc) are all in separate repos. So I expect this library to not be
> THAT difficult to package (the next one on my list is rekor - see #990249
> - which will probably require more work).
> As soon as #1022937 is done (waiting in NEW since 2 months), I expect
> sigstore to be a quick follow-up.
> However, I'd gladly take an extra pair of eyes on the package, so I can
> ping you as soon as I have something that builds.
>
>
> Thanks,
> Leo Antunes
> ------- Original Message -------
> On Thursday, January 19th, 2023 at 09:37, Reinhard Tartler <
> siretart@gmail.com> wrote:
>
> Hi Leo,
>
> Thank you so much for your interest in packaging this! -- I've noticed
> that it is a dependency of containers/image for image signing, and have
> looked at this package before. Unfortunately, I got intimidated with the
> sheer number of unpackaged dependencies that it requires. Maybe this has
> improved since the last time I looked at it? In any case, I've decided to
> patch the source to disable signing functionality to avoid requiring code
> from sigstore, which is of course very unfortunate.
>
> Let me know if you could use another set of eyeballs or help with this
> package. It surely seems intimidating (at least to me).
>
> best,
> -rt
>
> On Wed, Jan 18, 2023 at 3:21 PM Leo Antunes <costela@debian.org> wrote:
>
>> Package: wnpp
>> Severity: wishlist
>> Owner: Leo Antunes <costela@debian.org>
>>
>> * Package name : golang-github-sigstore-sigstore
>> Version : 1.5.1-1
>> Upstream Author : The Sigstore Authors <info@sigstore.dev>
>> * URL : https://github.com/sigstore/sigstore
>> * License : Apache-2.0
>> Programming Lang: Go
>> Description : Common go library shared across sigstore services and
>> clients
>>
>> sigstore/sigstore contains common Sigstore code: that is, code shared
>> by infrastructure (e.g. Fulcio and Rekor) and Go language clients (e.g.
>> Cosign and Gitsign.
>>
>>
>
> --
> regards,
> Reinhard
>
>
>

-- 
regards,
    Reinhard

[toc] | [prev] | [next] | [standalone]

#1135983

[Multipart message — attachments visible in raw view] — view raw

seems https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022937 was
accepted. Any update on sigstore packaging?

On Fri, Jan 20, 2023 at 9:47 AM Reinhard Tartler <siretart@gmail.com> wrote:

> Awesome, thanks for the update!
>
> Skimming over the sources of sigstore, it seems to me that the awk-sdk
> might be easy to disable with minor surgery. Would you be open to uploading
> a sigstore package to NEW with the aws functionality disabled and re-enable
> it as soon as the awk package becomes available in Debian?
>
> -rt
>
> On Fri, Jan 20, 2023 at 7:30 AM Leo Antunes <leo@antun.es> wrote:
>
>> Hi Reinhard!
>>
>> I think this changed a bit in the meantime: now the sigstore project has
>> mostly shared lib code, while the individual commands (rekor, fulcio,
>> gitsign, etc) are all in separate repos. So I expect this library to not be
>> THAT difficult to package (the next one on my list is rekor - see #990249
>> - which will probably require more work).
>> As soon as #1022937 is done (waiting in NEW since 2 months), I expect
>> sigstore to be a quick follow-up.
>> However, I'd gladly take an extra pair of eyes on the package, so I can
>> ping you as soon as I have something that builds.
>>
>>
>> Thanks,
>> Leo Antunes
>> ------- Original Message -------
>> On Thursday, January 19th, 2023 at 09:37, Reinhard Tartler <
>> siretart@gmail.com> wrote:
>>
>> Hi Leo,
>>
>> Thank you so much for your interest in packaging this! -- I've noticed
>> that it is a dependency of containers/image for image signing, and have
>> looked at this package before. Unfortunately, I got intimidated with the
>> sheer number of unpackaged dependencies that it requires. Maybe this has
>> improved since the last time I looked at it? In any case, I've decided to
>> patch the source to disable signing functionality to avoid requiring code
>> from sigstore, which is of course very unfortunate.
>>
>> Let me know if you could use another set of eyeballs or help with this
>> package. It surely seems intimidating (at least to me).
>>
>> best,
>> -rt
>>
>> On Wed, Jan 18, 2023 at 3:21 PM Leo Antunes <costela@debian.org> wrote:
>>
>>> Package: wnpp
>>> Severity: wishlist
>>> Owner: Leo Antunes <costela@debian.org>
>>>
>>> * Package name : golang-github-sigstore-sigstore
>>> Version : 1.5.1-1
>>> Upstream Author : The Sigstore Authors <info@sigstore.dev>
>>> * URL : https://github.com/sigstore/sigstore
>>> * License : Apache-2.0
>>> Programming Lang: Go
>>> Description : Common go library shared across sigstore services and
>>> clients
>>>
>>> sigstore/sigstore contains common Sigstore code: that is, code shared
>>> by infrastructure (e.g. Fulcio and Rekor) and Go language clients (e.g.
>>> Cosign and Gitsign.
>>>
>>>
>>
>> --
>> regards,
>> Reinhard
>>
>>
>>
>
> --
> regards,
>     Reinhard
>


-- 
regards,
    Reinhard

[toc] | [prev] | [next] | [standalone]

#1136507

Hi Reinhard,

It seems I underestimated the work and overestimated by free time: we need some bumps for deps (e.g. golang-github-azure-azure-sdk-for-go-dev) and maybe some patching to get rid of other deps (e.g. github.com/letsencrypt/boulder), if we can manage that.
OTOH, I see you already took care of #1030555 and #1030557! That's great! :)

Cheers
Leo


------- Original Message -------
On Thursday, February 2nd, 2023 at 12:33, Reinhard Tartler <siretart@gmail.com> wrote:


> seems https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022937 was accepted. Any update on sigstore packaging?

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web