using media types for errors

[OR13]

application/problem+json vs application/json

#60 (comment)

Why?

Are there any references for this design choice I can review?

[johnandersen777]

Running into this issue in scitt-community/scitt-api-emulator#27 as well. Would be great to return an object in addition to or instead of a string. Or allow for other properties which would be fully content-typeable to a custom response object within the error response on claim insert failure.

Lack of this prevents an automated conversation to resolve issues with claim insertion. Human readable strings are great, but ideally a human doesn't even get involved and machines can auto remediate issues due to detailed failure reasoning. This way the a human readable string might only be needed after a failed machine driven insert conversation (more than one call response).

For example if the identity is an OIDC token with an invalid subject, the policy error could say what the subject and or other fields should contain or be set to.

• References
  • https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#example-requiring-a-reusable-workflow
  • https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/using-openid-connect-with-reusable-workflows
  • job_workflow_ref is insufficient to disambiguate actions workflows sigstore/fulcio#305) mentions wanting job_workflow_ref,repository_id,repository_owner_id to effectively pin auth to a known workflow. Ideally this expands to attestable stacks, where stack is logged in SCITT, i.e. secure boot (example: ChromeOS: Attesting Device Mode) and TEEs. A policy engine could require that a notary signed from an attested setup.
    • gh oidc-sub set --repo org/repo --subs "job_workflow_ref,repository_id,repository_owner_id"
  • job_workflow_sha may also be helpful for pinning to a release

[SteveLasker]

Should this move to SCRAPI

[SteveLasker]

Closing, with a link to the copied issue in SCRAPI: using media types for errors #4