docs: rewrite README #624
Closed
docs: rewrite README #624
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Switch from rst to markdown (syntax is just so much easier) - Add honest project description (securesystemslib is for TUF and in-toto). - Remove wordy Overview section. Relevant information about crypto backends, and key types and formats should be documented as part of the API on RTD. - Replace legacy interface snippets in Usage section with link to securesystemslib RTD page. Legacy interfaces have functional replacements in the new Signer API, i.e. CryptoSigner for file-based RSA, ed25519, ecdsa keys, and GPGSigner for GPG keys. Signer API docs are still WIP (see secure-systems-lab#622), but already seem more useful than the legacy docs. And we definitely don't want to encourage anyone to use legacy interfaces. - Shorten installation/testing sections. Signed-off-by: Lukas Puehringer <[email protected]>
Closed
jku
reviewed
Aug 31, 2023
Comment on lines
+28
to
+29
| - Security issues: [*Draft a new security | ||
| advisory*](https://github.com/secure-systems-lab/securesystemslib/security/advisories/new) |
There was a problem hiding this comment.
Suggested change
| - Security issues: [*Draft a new security | |
| advisory*](https://github.com/secure-systems-lab/securesystemslib/security/advisories/new) | |
| - Security issues: [*Report a vulnerability*](https://github.com/secure-systems-lab/securesystemslib/security/advisories/new) |
Comment on lines
+5
to
+7
| A cryptography interface to sign and verify | ||
| [TUF](https://theupdateframework.io) and [in-toto](https://in-toto.io) | ||
| metadata. |
There was a problem hiding this comment.
This is more honest but maybe goes a bit too far? It's not that you can't sign anything you want...
I've added a bit of hopfully still honest marketing -- also mentioned some tech we use so that the "default installation supports ed25519 only" doesn't scare people away.
Suggested change
| A cryptography interface to sign and verify | |
| [TUF](https://theupdateframework.io) and [in-toto](https://in-toto.io) | |
| metadata. | |
| Securesystemslib is a cryptography interface for signing and verifying digital signatures. It is developed for the [TUF](https://theupdateframework.io) and [in-toto](https://in-toto.io) projects: the key and signature containers are compatible with metadata formats from those projects. | |
| Under the hood Securesystemslib is able to use various digital signing systems (e.g. [cryptography](https://pypi.org/project/cryptography/), PIV hardware keys and multiple cloud based key management systems). |
Comment on lines
+17
to
+18
| # Install with ed25519, RSA, ECDSA sign and verify support | ||
| pip install securesystemslib[crypto] |
There was a problem hiding this comment.
"crypto" is such a confusing term here that maybe worth adding another example
Suggested change
| # Install with ed25519, RSA, ECDSA sign and verify support | |
| pip install securesystemslib[crypto] | |
| # Install with ed25519, RSA, ECDSA sign and verify support | |
| pip install securesystemslib[crypto] | |
| # ...or with HSM (e.g. Yubikey) support | |
| pip install securesystemslib[hsm] |
|
I've asked martin to take this over (with the assumption that lukas is busy), and he's kindly doing this in #634 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Switch from rst to markdown (syntax is just so much easier)
Add honest project description (securesystemslib is for TUF and in-toto).
Remove wordy Overview section. Relevant information about crypto backends, and key types and formats should be documented as part of the API on RTD.
Replace legacy interface snippets in Usage section with link to securesystemslib RTD page.
Legacy interfaces have functional replacements in the new Signer API, i.e. CryptoSigner for file-based RSA, ed25519, ecdsa keys, and GPGSigner for GPG keys.
Signer API docs are still WIP (see Automate Signer API docs for RTD #622), but already seem more useful than the legacy docs. And we definitely don't want to encourage anyone to use legacy interfaces.
Shorten installation/testing sections.
Fixes README part of #511