Verfier rejects valid bundles with more than one tlog entry

[lsd-cat]

models.py raises InvalidBundle("expected exactly one log entry in bundle") for any bundle whose verification_material.tlog_entries has length ≠ 1. The comment notes this is "for the time being".

sigstore-python/sigstore/models.py

Lines 441 to 446 in 2c74d8f

	# Extract the log entry. For the time being, we expect
	# bundles to only contain a single log entry.
	tlog_entries = self._inner.verification_material.tlog_entries
	if len(tlog_entries) != 1:
	raise InvalidBundle("expected exactly one log entry in bundle")
	tlog_entry = tlog_entries[0]

However, the bundle protobuf spec declares tlog_entries as repeated with no exactly-one constraint (contrast the explicit "DSSE envelopes MUST have exactly one signature"), and behavior across the various verifiers is not uniform.

Sources:

• sigstore-js — threshold (tlogThreshold ?? 1)
• sigstore-rs — tlog_entries.len() != 1 → error
• sigstore-go — tlogEntriesThreshold minimum (accepts ≥1)
• protobuf-specs — repeated tlog_entries

Would you be open to a PR to address this?

[woodruffw]

This is an intentional limitation: it's not clear whether a bundle with N tlog entries should be 1-of-N, K-of-N, or N-of-N.

I think there was some movement towards standardizing this on a per-instance basis (each Sigstore instance could communicate its expected quorum via the trust root), but I don't know if that's moved forwards recently.

[lsd-cat]

My impression is that the general approach is threshold-based and it would be nice if that was shipped along with the trust root, though it's not yet. Both go and js implement the threshold, but that is specified when calling the verifier.

I don't have any specific need for a fix right now, it's mostly to flag it as I am doing a general pass at finding discrepancies between the various verifiers.

[woodruffw]

Yeah, threshold seems reasonable. I guess we could support this without needing it in the trust root first, particularly if we could align with other implementations in terms of how they surface this (the CLI flag they use, etc.).

[woodruffw]

(But it would be nice to have top-level determinations on defaults, e.g. if we're going to default to a threshold of 1 it'd be nice to have that documented somewhere "official" within Sigstore as a whole 🙂)