VOA

This project provides Rust libraries, command line tools and a test suite to interact with the File Hierarchy for the Verification of OS Artifacts (VOA).

The VOA specification has been created to provide the means for a generic, OS artifact verification scheme, that can work with different technologies while relying on a unifying lookup directory to retrieve verifiers for signatures.

This project provides a reference implementation for the VOA specification as well as a canonical test suite that is usable by any other implementation.

Currently, only an OpenPGP backend is specified. However, specifications for the minisign, signify, SSH and X.509 backends are already prepared and only require some further input for finalizing. If you have expertise in one of these technologies, please get in touch on the relevant pull request for specification.

This project is currently supported by the Sovereign Tech Agency. Read the official announcement for more information.

Documentation

The latest project documentation can be found at https://voa.archlinux.page

Overview

The following mindmap attempts to provide a high-level overview of the project and put (existing and upcoming) libraries and command line tools into context.

mindmap
  root((📄 VOA specification))
    ⌨️/📚️ voa
    📚️ voa-core
    📚️ voa-minisign *
    📚️ voa-openpgp
    📚️ voa-signify *
    📚️ voa-ssh *
    📚️ voa-x509 *
    ⌨️ voa-verify *
    📚️ voa-test-suite *

[*] Not yet implemented, or subject to change.

Components

Currently the following components are available:

• voa: command line interface and library for interacting with VOA
• voa-core: a library for access to verifiers in VOA hierarchies
• voa-openpgp: a library for using OpenPGP verifiers in VOA

Contributing

Please refer to the contribution guidelines to learn how to contribute to this project.

Releases

Releases of components are created by the developers of this project.

OpenPGP certificates with the following OpenPGP fingerprints can be used to verify signed tags:

• 991F6E3F0765CF6295888586139B09DA5BF0D338 (David Runge <dvzrv@archlinux.org>)
• 165E0FF7C48C226E1EC363A7F83424824B3E4B90 (Orhun Parmaksız <orhun@archlinux.org>)

The above are part of archlinux-keyring and certified by at least three main signing keys of the distribution.

License

This project can be used under the terms of the Apache-2.0 or MIT. Contributions to this project, unless noted otherwise, are automatically licensed under the terms of both of those licenses.