feat(extensions): add verifiable CloudEvents with DSSE#1386
Open
xibz wants to merge 1 commit into
Open
Conversation
Author
|
@duglin - I decided to recreate the PR. There were too many merge conflicts, 800+ T-T, because of how poorly it diverged. I tried to force push by hard resetting then cherry picking, but it autoclosed the PR :(. Anywho updated! But the verify tools look broken since the removal the locale files references #1371 |
Collaborator
|
@xibz no worries. I’ll fix the CI issues tomorrow. They’re not related to your changes |
Collaborator
|
@xibz can you rebase using the latest 'main' branch? I think that should fix your CI issues. |
Introduces the verifiability extension, enabling producers to cryptographically sign CloudEvents and consumers to verify authenticity and integrity using DSSE (Dead Simple Signing Envelope) v1.0.2. Key design points: - Canonical value serialization per CloudEvents type for format-neutral signatures (no wire-bytes requirement for context attributes) - Optional signing of extension attributes via signedextattrs - Consumer behavior configuration matrix (strict/passthrough/core-only) - Proxy guidance: SHOULD re-sign when modifying signed fields - SDK phased rollout: JSON format first, additional formats by vote - Timestamp normalization to RFC 3339 Zulu with second precision Signed-off-by: xibz <bjp@apple.com>
Author
|
@duglin - Done! |
Collaborator
Author
|
Yep, it's good for a final review |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed Changes
feat: Add DSSE-based cryptographic signing for CloudEvents verification
Implements verifiable CloudEvents using DSSE (Dead Simple Signing Envelope) to ensure event authenticity and integrity across untrusted transport layers.
Key features:
Technical approach:
This enables cryptographic proof that events:
Does NOT address: event ordering, completeness, replay attacks, or confidentiality
Fixes #1302
Release Note