v1 release

[laurentsimon]

This is a proposal for v1 release.
Scope: support sigstore for path only (no in-memory path support). This requires to implement only a subset of #172:

# model.py
def sign(
      input: Path,
      sig: Path  = defaultSigPath(input),
      recompute_paths: []Path = None,
      ignored_paths: []Path = [".git"],
     ) -> None
    ...

def verify(
      input: Path,
      sig: Path  = defaultSigPath(input),
      verifier: Verifier = SigstoreVerifier(),
      ignored_paths: []Path = [".git"],
    ) -> bool

What needs to be done:

Simple

• Make all API private except SigstoreSigner / SigstoreVerifier and model.verify / model.sign - see APIs design #172 for APIs.
• Cleanup BaseResult #174.
• Fix IdP shown in CLI #157
• Add raw signer to API
• Documentation clean working towards release v1 #179
• Handle symlinks and excluded files in serialization #196

Medium

• API for incremental model re-hashing #160.

More work

• Decide the default parameters for sha256pv1 hash (shard size), or
• Investigate different hashes #13. TBD: benchmarking
• Define the manifest format |Support for DSSE signatures over binary payloads sigstore-python#982

We can add support for more features #172 without breaking backward compatibility

[laurentsimon]

@mihaimaruseac what do you think of making these the prio for v1?

[mihaimaruseac]

I think anything that comes for the API are priority. So #172 , #111 (manifest), #140 (hash engine), #160 (incremental rehashing) are a must. As part of this, we will also need to clean-up BaseResult (#174).

Looking back, that's exactly the list you mentioned above.

[mihaimaruseac]

I think #157 might also be good to have in the release

[laurentsimon]

I think #157 might also be good to have in the release

Good call. Added to the list. Thanks!

[mihaimaruseac]

Added all of them to a milestone too. But also added improvement issues there, so it's good to keep track of the important ones on this issue

[laurentsimon]

This was discussed in the SIG meeting of 12 June 24. We would like to also support private PKI for this release. (We don't need to support all possible features, and we'll add new ones without breaking backward compatibility)