Re: Sigstore rekor current status and request for help
On Tue, Jan 16, 2024 at 4:16 AM Simon Josefsson <simon@josefsson.org> wrote:
>
> Hi
>
> I want to get Sigstore's rekor <https://github.com/sigstore/rekor> into
> Debian so that <https://gitlab.com/debdistutils/apt-sigstore> can be
> included. I'm new to Go and how Debian approaches Go code, but have
> made some progress. I'm now stuck. This e-mail summarize the open
> issues. Can someone take a look and help me? If you want, feel free to
> push to any of the git repositories below with improvements.
>
As you want to package rekor to support apt-sigstore, I would suggest
you to only package rekor-cli, the client part of rekor.
The rekor repository contains both server and client implementations.
This will cut down lots of dependencies. The server part not only
brings more library dependencies, but also more maintenance burden,
like how to setup, how to support version upgrade between Debian
releases.
--
Shengjing Zhu
Reply to: