Skip to content

DESIGN.md: note SPIFFE/SPIRE in the remote-attestation strategic horizon #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cptfinch wants to merge 1 commit into
base: main
Choose a base branch
from
Open

DESIGN.md: note SPIFFE/SPIRE in the remote-attestation strategic horizon #35

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions DESIGN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,15 @@ Deliberately *not* filed as issues: these are directions, not scheduled work.
Each gets picked up when there's a forcing function, and becomes an ADR before
any code lands.

- **SPIFFE/SPIRE-aligned workload attestation.** The actual open standard for
this problem — cryptographically attested, short-lived workload identity
(X.509-SVID / JWT-SVID) issued per-workload rather than trusted by virtue of
the calling OS session. Today "who can mint" means "whoever is logged into
this local session," which holds up fine on one laptop but stops holding
once minting can happen from a remote or cloud-run agent session (Claude
Code supports both). A SPIFFE SVID composes the same way a vendor-OIDC token
would — just another caveat type. **Forcing function**: the day a non-local
(cloud/remote) session needs to mint.
- **Vendor OIDC tokens (Sigstore pattern).** Anthropic / Cursor / Microsoft run
an OIDC issuer for their dev tools; `llms` verifies the JWT against their
JWKS. Composes naturally as a caveat type. **Blocked on vendor cooperation** —
Expand Down
Loading