Repository Signatures

[rido-min]

Status: Reviewing

Use this issue to discuss the Repository Signatures spec.

[maartenba]

That looks like a solid spec! One remark: the matrix at the end has Secure as the mode for most entries, where I suspect a couple (near the end of the table) need Strict instead.

Also:

Repository signing certificates will have some requirements which be detailed in the technical specification (TBD).

Any pointers as to what type of certificate would be needed?

[rido-min]

@maartenba I omitted the Strict mode intentionally. It will be covered in more detail with the Client Policies spec.

The certificate requirements will be the same as for author signatures. Code Signing, RSA 2048, SHA256 and so on.

[rrelyea]

We are now feature complete in 15.7. Closing this issue.
We'll open more for follow on issues, like Client Policies.

[maartenba]

Are packages released for working with these?

[loic-sharma]

@maartenba Yes, latest NuGet.Packaging package has the necessary APIs. For an example, see: https://github.com/NuGet/NuGet.Client/blob/095d2d9563bac6b6bb3269e6996dd4e5af690f20/src/NuGet.Clients/NuGet.MSSigning.Extensions/RepoSignCommand.cs#L34

[maartenba]

Seems these aren't in the latest stable 4.6.2?

[dtivel]

Correct.