Drop DSSE support#744
Conversation
We have found that DSSE requests can be quite large with comprehensive SBOMs, and these requests have become a source for server crashes in Rekor v1. Before Rekor v2 is widely deployed, we will drop support for DSSE requests, instead requiring clients to provide the DSSE PAE hash and signature extracted from the envelope. We are not removing the protos to avoid any downstream breaking changes. Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #744 +/- ##
==========================================
- Coverage 30.05% 27.29% -2.77%
==========================================
Files 62 61 -1
Lines 3327 3158 -169
==========================================
- Hits 1000 862 -138
+ Misses 2216 2200 -16
+ Partials 111 96 -15 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
|
||
| m.newHashedRekordEntries = f.NewCounter(prometheus.CounterOpts{ | ||
| Name: "rekor_v2_new_hashedrekord_entries", | ||
| Help: "The total number of new dsse log entries", |
There was a problem hiding this comment.
oh oops, that must look weird in our logs.
| } | ||
|
|
||
| // Add uploads a hashedrekord or DSSE log entry and returns the TransparencyLogEntry proving the entry's inclusion in the log. | ||
| // Add uploads a hashedrekord log entry and returns the TransparencyLogEntry proving the entry's inclusion in the log. |
There was a problem hiding this comment.
I'm a little curious how this is called. Should we leave this func signature generic to allow for some future flexibility, or should we try to change
- func (w *writeClient) Add(ctx context.Context, entry any) (*pbs.TransparencyLogEntry, error) {
+ func (w *writeClient) Add(ctx context.Context, entry pb.HashedRekorRequestV002) (*pbs.TransparencyLogEntry, error) {
There was a problem hiding this comment.
Probably leave it generic, we're likely to add new ones
|
remember to resync the protobuf-specs import of these proto defs |
| return nil, status.Errorf(codes.InvalidArgument, "invalid dsse request") | ||
| } | ||
| metricsCounter = getMetrics().newDsseEntries | ||
| _ = grpc.SetHeader(ctx, metadata.Pairs(httpStatusCodeHeader, "405")) |
There was a problem hiding this comment.
Is 405 the best code for this? The method and the endpoint are valid, it's just an unsupported type. What about reusing codes.InvalidArgument for this, as below?
4 participants
We have found that DSSE requests can be quite large with comprehensive SBOMs, and these requests have become a source for server crashes in Rekor v1. Before Rekor v2 is widely deployed, we will drop support for DSSE requests, instead requiring clients to provide the DSSE PAE hash and signature extracted from the envelope.
We are not removing the protos to avoid any downstream breaking changes.
Summary
Release Note
Documentation