# \[pre-RFC\] Using Sigstore for signing and verifying crates

**URL:** <https://internals.rust-lang.org/t/pre-rfc-using-sigstore-for-signing-and-verifying-crates/18115>\
**Category:** tools and infrastructure\
**Created:** [January 10, 2023, 11:18am UTC](https://internals.rust-lang.org/t/pre-rfc-using-sigstore-for-signing-and-verifying-crates/18115 "2023-01-10T11:18:12Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![bascule](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/bascule/32/3057_2.png) [@bascule](https://internals.rust-lang.org/u/bascule)\
**Post date:** [January 10, 2023, 2:11pm UTC](https://internals.rust-lang.org/t/pre-rfc-using-sigstore-for-signing-and-verifying-crates/18115/2 "2023-01-10T14:11:48Z")

</div>

Hi there! Several years ago I opened [this crates.io issue](https://github.com/rust-lang/crates.io/issues/75) on a security model, and let me just say it's very exciting to see proposed Sigstore integrations.

You mention TUF, and separately posit this open question:

> Should [crates.io](http://crates.io) use the signing information to enforce that the signature of crate-to-be-published matches the publisher?

I think it'd be great to start working on the machinery of Sigstore for AuthN / crate signing (and the workflow looks great), but it really needs an associated AuthZ policy to be useful, as this blog post highlights:

[https://blog.sigstore.dev/signatus-ergo-securus-who-can-sign-what-with-tuf-and-sigstore-ea4d3d84b8b6](https://blog.sigstore.dev/signatus-ergo-securus-who-can-sign-what-with-tuf-and-sigstore-ea4d3d84b8b6)

As it were, there are some early discussions happening on the Cargo team right now on potentially using TUF for things like (sparse) index signing.

You do mention TUF repeatedly in the pre-RFC, including the index signing work and various potential integrations. I guess what I think is missing here specifically a future work statement which describes how TUF could be used for AuthZ in a system where Sigstore is used for AuthN, answering the open question you posed about this, e.g. how TUF's delegated targets feature could provide AuthZ policies which specify which [crates.io](http://crates.io) users (and their associated GitHub OIDC identities) are allowed to sign which particular crates.

---

_[View the full topic](https://internals.rust-lang.org/t/pre-rfc-using-sigstore-for-signing-and-verifying-crates/18115)._