Conversation
doodzik
force-pushed
the
refactor
branch
2 times, most recently
from
afcc89b to
e656827
Compare
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| module Gem |
There was a problem hiding this comment.
I'm curious: what is the motivation behind declaring this namespace upfront?
Related question: I see you declare the Gem::Sigstore namespace in many other files, and then define a class as class Gem::Sigstore::TheClass. Why not define the class inside nested module blocks?
There was a problem hiding this comment.
Ah, it's to follow the conventions set by rubygems.
| connection.post("/api/v1/signingCert", { | ||
| publicKey: { | ||
| content: Base64.encode64(pub_key), | ||
| algorithm: "ecdsa" |
There was a problem hiding this comment.
Nevermind. Fulcio's api only provides ecdsa. I wonder if another part of our code is wrong, then? I don't really understand what the aglo parameter does here.
There was a problem hiding this comment.
Maybe it's the algo used to sign the signing certificate using the root Fulcio cert. If that's the case, then once we start retrieving the root cert via the signing cert's AIA field, we'll need to verify the signature using ecdsa as well.
2 participants
fixes #5
TODO