Looks great.

• In terms of how it would look like for users, I think we could somehow copy the Github way of rendering signed commits.
  • I also wonder if in the UI there should be visibility of the keys used to verify signature? Something only an "Admin" should be able to see. Asking just in case a dedicated REST API would be needed to expose this information.
• In regards of the Upload REST API. I wonder how an SBOM and its signature will be uploaded? I might be wrong but I guess the SBOM and its signature are 2 different files, should/can they be uploaded together?

Looks great.

• In terms of how it would look like for users, I think we could somehow copy the Github way of rendering signed commits.

  • I also wonder if in the UI there should be visibility of the keys used to verify signature? Something only an "Admin" should be able to see. Asking just in case a dedicated REST API would be needed to expose this information.

I think it would be great finding a way to properly expose this through the UI to the user. And also, allow users to manages this through the UI.

• In regards of the Upload REST API. I wonder how an SBOM and its signature will be uploaded? I might be wrong but I guess the SBOM and its signature are 2 different files, should/can they be uploaded together?

It depends. One source might be "sigstore", in which case the system would need to fetch from that source. The question would be: how would be user define if this document is applicable to that sigstore source. If there's more than one.

The second source, would be the SBOM/advisory source. Which in this case, would be the upload form. So, the user should have the ability to upload the signature too. Only works on the order of: document first, signature next. Maybe it makes sense capturing that process in a UI flow. Can be a combined form. Could be a two step process too. Again the user would need to tell the system which trust anchors are applicable.

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 63.55%. Comparing base (058fd52) to head (a0e92f6).
Report is 1 commits behind head on main.

@@           Coverage Diff           @@
##             main    #1568   +/-   ##
=======================================
  Coverage   63.55%   63.55%           
=======================================
  Files         350      350           
  Lines       14286    14286           
=======================================
  Hits         9080     9080           
  Misses       5206     5206           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.