Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1134014

Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi Reinhard!

I think this changed a bit in the meantime: now the sigstore project has mostly shared lib code, while the individual commands (rekor, fulcio, gitsign, etc) are all in separate repos. So I expect this library to not be THAT difficult to package (the next one on my list is rekor - see #990249 - which will probably require more work).
As soon as #1022937 is done (waiting in NEW since 2 months), I expect sigstore to be a quick follow-up.
However, I'd gladly take an extra pair of eyes on the package, so I can ping you as soon as I have something that builds.

Thanks,
Leo Antunes
------- Original Message -------
On Thursday, January 19th, 2023 at 09:37, Reinhard Tartler <siretart@gmail.com> wrote:

> Hi Leo,
>
> Thank you so much for your interest in packaging this! -- I've noticed that it is a dependency of containers/image for image signing, and have looked at this package before. Unfortunately, I got intimidated with the sheer number of unpackaged dependencies that it requires. Maybe this has improved since the last time I looked at it? In any case, I've decided to patch the source to disable signing functionality to avoid requiring code from sigstore, which is of course very unfortunate.
>
> Let me know if you could use another set of eyeballs or help with this package. It surely seems intimidating (at least to me).
>
> best,
> -rt
>
> On Wed, Jan 18, 2023 at 3:21 PM Leo Antunes <costela@debian.org> wrote:
>
>> Package: wnpp
>> Severity: wishlist
>> Owner: Leo Antunes <costela@debian.org>
>>
>> * Package name : golang-github-sigstore-sigstore
>> Version : 1.5.1-1
>> Upstream Author : The Sigstore Authors <info@sigstore.dev>
>> * URL : https://github.com/sigstore/sigstore
>> * License : Apache-2.0
>> Programming Lang: Go
>> Description : Common go library shared across sigstore services and clients
>>
>> sigstore/sigstore contains common Sigstore code: that is, code shared
>> by infrastructure (e.g. Fulcio and Rekor) and Go language clients (e.g.
>> Cosign and Gitsign.
>
> --
>
> regards,
> Reinhard

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients "Leo Antunes" <costela@debian.org> - 2023-01-18 21:30 +0100
  Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Reinhard Tartler <siretart@gmail.com> - 2023-01-19 09:40 +0100
    Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Leo Antunes <leo@antun.es> - 2023-01-20 13:40 +0100
      Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Reinhard Tartler <siretart@gmail.com> - 2023-01-20 16:00 +0100
        Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Reinhard Tartler <siretart@gmail.com> - 2023-02-02 12:40 +0100
          Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients Leo Antunes <leo@antun.es> - 2023-02-05 21:40 +0100

csiph-web