redirect to another intoto.jsonl bundle?

[loosebazooka]

Maybe this is already solved.

Consider this example where I have a bundle that I want to mirror but for many reasons I cannot mirror the bundle as is:

• space requirements
• unclear licensing
• something else?

Is there a provision to have a mybundle.intoto.json just point to another one is permanent storage somewhere? This is a little different that the reference -- as bundles appear to be more of a convention than a named type.

Is there a way to have mybundle.intoto.json to somewhere.intoto.jsonl

for example (I'm not proposing this as is, but something like this)

{ "redirect": "https://storage.example.com/somewhere.intoto.jsonl", "digest": { "sha256": "abcd..." } }

[TomHennen]

NOTE: In some cases policy evaluators may not have internet access so they'd need to figure something else out (but maybe that's OK).

I don't see why this couldn't work with a reference predicate type...

I'd probably do something like

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [{
    "name": "registry.example.com/my-project/my-image",
    "digest": {
      "sha256": "886a77e9b9c993e221d1843e3af5b1fbeea26d8962995e8562174a6aba0c7cc9"
    }
  }],
  "predicateType": "https://in-toto.io/attestation/reference/v0.1",
  "predicate": {
    "attester": {
      "id": "https://my-bundler.com/v1"
    },
    "references": [{
      "downloadLocation": "https://storage.example.com/somewhere.intoto.jsonl",
      "digest": {
        "sha256": "3b0d19b348f1e46a571c6e9df32897637c20dd9803261c2fc9cbe38b0c8422c4"
      },
      "mediaType": "application/vnd.in-toto.bundle"
    }]
  }
}

Maybe the issue is that this just says "hey there's another bundle over here, who knows what's in it", whereas what you're looking for might be "the policy evaluator must go download the bundle over here to evaluate".

[loosebazooka]

So the attester is just someone who created the original bundle or someone who created the reference here?

I think using a reference here allow some leeway on enforcing that is it just a redirect and not one entry in a long list, but perhaps that's the job of the ecosystem in question to enforce anyway

For the usecase of a simple redirect feels a bit verbose, on the otherhand maybe this should be handled by a proxy or something else that's original accepting requests for files.

[TomHennen]

attestor is the creator of the reference attestation, they don't necessarily endorse the data in the thing they point to. All that stuff would be signed, attested, etc separately.

For the usecase of a simple redirect feels a bit verbose

Yeah, I agree.

[marcelamelara]

Chiming in... @loosebazooka has this issue/question been addressed?

For the usecase of a simple redirect feels a bit verbose

A less verbose way to do this would be to use a SCAI predicate where the attribute is something like "REDIRECT" and the target points to the somewhere.intoto.jsonl bundle. The subject would still be mybundle.intoto.json.

using a reference here allow some leeway on enforcing that is it just a redirect and not one entry in a long list, but perhaps that's the job of the ecosystem in question to enforce anyway

Yes, it's mostly up to the consumer / policy engine to enforce this, though I think you can indicate the intent with the SCAI predicate.