From 14ad8727bd3189a96b7ced0e359b2e62bbeeb668 Mon Sep 17 00:00:00 2001 From: Zach Steindler Date: Wed, 11 Sep 2024 14:21:37 -0400 Subject: [PATCH] Add trusted root docs To go with https://github.com/sigstore/cosign/pull/3876 Signed-off-by: Zach Steindler --- content/en/cosign/system_config/custom_components.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/en/cosign/system_config/custom_components.md b/content/en/cosign/system_config/custom_components.md index da1cc3ac..3a1630fd 100644 --- a/content/en/cosign/system_config/custom_components.md +++ b/content/en/cosign/system_config/custom_components.md @@ -9,13 +9,15 @@ This page contains instructions on how to configure Cosign to work with alternat Verifying keyless signatures require verifying signatures from Rekor, material (SCTs) from the CT log, and certificates that chain up to Fulcio. The public keys and root certificates for these components are distributed through [TUF](https://theupdateframework.io/) repositories. By default, Cosign uses a TUF client that has an initial trust in an embedded root and then fetches updated verification material from our public-good-instance TUF repository created on the [root-signing](https://github.com/sigstore/root-signing) GitHub repository. -There are three options to configure Cosign to verify against custom components: +There are several options to configure Cosign to verify against custom components: 1. Use [scaffolding](https://github.com/sigstore/scaffolding) to create a custom Sigstore stack. This provides a TUF root distributing verification material for the custom components, and pre-configured Cosign with the trust root. 2. Create a TUF repository yourself, using [go-tuf](https://github.com/theupdateframework/go-tuf) or [python-tuf](https://github.com/theupdateframework/python-tuf)'s repository writers. Instructions for how to configure this root is in this [blog post](https://blog.sigstore.dev/sigstore-bring-your-own-stuf-with-tuf-40febfd2badd). This [script](https://gist.github.com/asraa/947f1a38afd03af57c7b71d893c36af0) can be used to create a TUF repository from the custom Fulcio, Rekor, and CT log verification material. -3. As a last resort, you may also use the following environment variables to configure custom keys out of band. +3. TUF is recommended because it makes it easy to distribute up-to-date key material to clients. However, if you aren't using TUF, you can manually assemble trusted key material into a trusted root file with `cosign trusted-root create ...`. You can then supply that trusted root file to `cosign verify` commands with `--trusted-root`. + +4. As a last resort, you may also use the following environment variables to configure custom keys out of band. | Env Variable | Description | | ---------- | ------------------- |