Skip to content

feat(features): make default verification independent of HTTP and Tokio - #213

Merged
wolfv merged 1 commit into
pre1/offline-rekorfrom
pre1/offline-http
Sep 19, 2026
Merged

wolfv merged 1 commit into
pre1/offline-rekorfrom
pre1/offline-http

Conversation

@wolfv

@wolfv wolfv commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator

Small follow-up to #212: feature gates and dependency declarations, not a transport abstraction.

  • Gate Rekor/TSA HTTP clients and reqwest behind client features.
  • Keep their existing client+rustls defaults; signing explicitly enables clients.
  • Verification uses offline entry types and timestamp validation; its TLS features only configure optional TUF refreshes.
  • Assert offline dependency boundaries in the isolated-feature CI check.

Validation: workspace all-feature tests, strict Clippy, Rust 1.86, docs, isolated features, native-TLS checks and no-default-feature Rekor/TSA/verifier tests passed. Default sigstore-verify and sigstore-bundle, plus offline Rekor/TSA builds, have no reqwest/hyper/Tokio normal dependencies.

Signed-off-by: Wolf Vollprecht <w.vollprecht@gmail.com>
@wolfv
wolfv force-pushed the pre1/offline-http branch from 65c5be0 to 888b3a6 Compare September 5, 2026 19:16
@wolfv
wolfv merged commit 888b3a6 into main Sep 19, 2026
36 checks passed
@wolfv
wolfv deleted the pre1/offline-http branch September 19, 2026 10:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant