Update signature spec with TUF timestamp

[haydentherapper]

The timestamp will be used to find a versioned TUF target metadata.
This allows targets to be rotated while still being able to validate
old entries that were signed by previous targets.

Ref #1273

Signed-off-by: Hayden Blauzvern hblauzvern@google.com

Summary

Cosign currently can only verify signatures from current TUF metadata. This will cause signature verification to fail for old entries once the target, such as the Fulcio certificate, is rotated. Including the timestamp, along with additional work to persist versioned TUF targets, will allow cosign to find the previous target used to generate the signature.

I will implement this feature to be backwards compatible. If an entry does not include the timestamp, then cosign will use the latest TUF metadata.

#1273 contains additional context.

Release Note

* Updated signature spec with TUF timestamp

[haydentherapper]

cc @asraa @bobcallaway

[asraa]

Should this be signed? If not, would just putting the version number of the timestamp be equivalent?

Also -- should we 100% go for doing the timestamp lookup vs holding old fulcio / rekor certs into the current targets metadata to simplify logic?

[asraa]

Should this be signed? If not, would just putting the version number of the timestamp be equivalent?

JK I am wrong, this is not equivalent, the full timestamp contains the signatures on the timestamp.json

[haydentherapper]

Should this be signed? If not, would just putting the version number of the timestamp be equivalent?

Yep, since timestamp.json is signed, we can use the versioned root role to verify it and avoid attacks that trick a client into using a different version of the TUF metadata (for example, maybe one of the targets was compromised) to verify the signature.

Also -- should we 100% go for doing the timestamp lookup vs holding old fulcio / rekor certs into the current targets metadata to simplify logic?

I'd prefer to avoid growing targets indefinitely. As discussed offline, this also makes it easier for those who want offline TUF metadata for verifying old signatures where the TUF metadata is no longer hosted.
One benefit of keeping all old data in targets is if we want to mark a target as untrusted, we simply remove it from the list. However, this can be solved separately, as a signed list of untrusted targets.

[dlorenc]

I like this approach! Nice work!

Should we merge this as is or wait until the implementation is ready?

[bobcallaway]

lgtm

[haydentherapper]

Let's merge now, I'm working on the implementation, it should be ready soon.