Include a list of used permissions in signed part of bundles
Open
Nobody has claimed this yet.
feature request
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 125
- PR merge metrics
- No merged PRs in 30d
Description
@slightlyoff mentioned that we might want to have third-party security reviewers check more or less stringently depending on which permissions an app uses. To do that, they'll need to be able to sign over the permissions they've checked for.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked Web Package use case, especially section 2.2.3, and then inspect the signed bundle format documentation in this repository. Define how a list of checked permissions would be represented and covered by the signature; the issue is done when the format and reviewer workflow are specified.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100