The Sigsum team is happy to announce a first release of the
sign-if-logged tool. This program lets you use a TKey security key to
create signatures only on data that has already been Sigsum logged
according to a configured policy, using a signing key tied to both the
policy and the device.
This is intended to enable transparency for signatures verified by
systems that are unlikely to support and enforce transparency logging
directly, due to limited performance, or adherence to other standards.
See the README file
https://git.glasklar.is/sigsum/apps/sign-if-logged/-/blob/main/README.md
for more information.
The source code for the release can be checked out using
git clone -b v1.0.0 https://git.glasklar.is/sigsum/apps/sign-if-logged.git
or installed using
go install sigsum.org/sign-if-logged/cmd/sign-if-logged@v1.0.0
The v1.0.0 tag is signed using the key
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/xZ+v5e435605MS4BYE89PLcgk8DT5PvuoM2oASnuk
This is the same release key also published for nisse(a)glasklarteknik.se
at https://www.system-transparency.org/keys/allowed-ST-release-signers.
The release bundles a precompiled TKey app corresponding to version
1.0.0 of tkey-sign-if-logged. It can be reproduced by running
make -C build-device-app
The source code of the TKey app can also be checked out using
git clone -b v1.0.0 https://git.glasklar.is/sigsum/apps/tkey-sign-if-logged.git
/The Sigsum team
NEWS for the sign-if-logged v1.0.0 release
This is the initial release of the sign-if-logged program. It
is used together with the corresponding TKey device app
https://git.glasklar.is/sigsum/apps/tkey-sign-if-logged, and a
precompiled device app is bundled with this program.
This version supports Ed25519, and ECDSA over the Secp256r1
curve. For each curve, one can configure either raw signatures
or OpenSSH-style signatures, and if device touch should be
required when signing.
The Sigsum team is happy to announce an update of the Sigsum C Library
(aka sigsum-c or libsigsum), version 1.1.0. See NEWS file, excerpt
below, for a summary of changes.
Library documentation is included in the package and online at
https://git.glasklar.is/sigsum/core/sigsum-c/-/blob/main/doc/sigsum-c.md.
The release source code can be downloaded using
git clone -b v1.1.0 https://git.glasklar.is/sigsum/core/sigsum-c.git
The v1.1.0 tag is signed using the key
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/xZ+v5e435605MS4BYE89PLcgk8DT5PvuoM2oASnuk
This is the same release key also published for nisse(a)glasklarteknik.se
at https://www.system-transparency.org/keys/allowed-ST-release-signers.
/The Sigsum team
NEWS for the sigsum-c 1.1.0 release
This is a minor update of the sigsum-c library. The new
version is fully compatible with with version 1.0.0 with one
minor exception, see below.
The shared library name is libsigsum.so.0.1, with unchanged
soname libsigsum.so.0.
Incompatible change:
* The list of of cosignatures in struct sigsum_proof is now
sorted by witness key hash. Out of order cosignatures are
ignored, making verification of some otherwise valid proofs
return failure. The required sorting is taken care of by
sigsum_proof_parse, but applications that populate a
sigsum_proof by other means must be updated accordingly.
New features:
* New configure flag --disable-tools, to not build and install
the sigsum-c-verify tool. Contributed by Florian Larysch.
Improvements:
* The returned error message from sigsum_proof_verify now
makes a distinction between problems with the log signature
and problems with the leaf signature.
