Proto commits in spiffe/spiffe

These 17 commits are when the Protocol Buffers files have changed:

2026-07-01

Integrating WIT to the SPIFFE standards (#362) * WIT-SVID Workload API Profile (#327) * Add draft of proto for WIT-SVID Workload API Signed-off-by: Noah Stride <noah.stride@goteleport.com> * First draft of WIT-SVID profile in the SPIFFE Workload API specification Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove TODO from WITSVIDRequest message Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove remark regarding trust bundles from FetchWITSVID RPC Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add initial draft of pagination support Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Move "Default Identity" section out of X509-SVID Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Revert "Add initial draft of pagination support" This reverts commit 713f75e3465d545b99003fbd7c24f71d57f64685. Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Correct header markdown Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add warning headers Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add support for `spiffe_id` field to WIT SVID profile Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Fix ToC Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Merge WIT profile into the workloadapi.proto Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Require inclusion of `kid` in WIT trust bundle Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Wrap line consistently with rest of document Signed-off-by: Noah Stride <noah.stride@goteleport.com> * SPAG Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Make sure proto comments align in doc and .proto Signed-off-by: Noah Stride <noah.stride@goteleport.com> --------- Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Introduce WIT-SVID Token Document (#361) * Add framework for document Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add `kid` header Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add references to WIT-SVID in other documents Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Rejig wording in SVID doc Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Describe `sub` claim Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Expand content in WIT-SVID.md Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add section on presentation Signed-off-by: Noah Stride <noah.stride@goteleport.com> * More todos Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add notes on JTI Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove TODO about "JTI" Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Rewrite section intros Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Make section summaries feel less "optional" Suggested by @yoctozepto Signed-off-by: Noah Stride <noah.stride@goteleport.com> * SPAG Suggested by @yoctozepto Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Rewrite sub/jti claim sections Thanks to @yoctozepto for suggestions Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add TODO inline to update datatracker links Thanks @yoctozepto Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add `typ` section Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Clarify language in comparison Thanks @yoctozepto Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add remark on revocation mechanism and `jti` Thanks @yoctozepto for the suggestion Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add `alg` section Signed-off-by: Noah Stride <noah.stride@goteleport.com> * header -> parameter Signed-off-by: Noah Stride <noah.stride@goteleport.com> * `structure` -> `format` Thanks yoctozepto & arndt-s Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add draft example WIT-SVID Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Fix up example JWT Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Modify example WIT-SVID to use ES256 for the WIT key-pair Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Clarify introductory statement on what WIT-SVIDs are. Thanks yoctozepto & arndt-s Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Will -> Does Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Validators should ignore unrecognized claims Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Emphasize that the WIT should not be presented using the Authorization header Signed-off-by: Noah Stride <noah.stride@goteleport.com> * exp, iat, nbf Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add note on uniqueness of `kid` across WIT and JWT SVIDs Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Clarify language around presentation protocols Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add TODO for appendix C/D focussing on differences Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add more stern remarks on the validation of WIT-SVIDs without a pop Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add issuer claim notes Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add info on cnf claim Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Token Issuance and Validation Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Emphasize PoP in Token PResentation Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Expand on the topic of `kid`s Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Start on comparative appendices - still wip Signed-off-by: Noah Stride <noah.stride@goteleport.com> * SHOULD NOT provide additioanl header params Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove more spurious commas - thanks @jsnctl Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Fix missing word in section 4 - thanks @jsnctl Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Update example WIT to include kid header param Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Update datatracker links Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Security considerations around replay/tamper Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Appendix D Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Appendix C Signed-off-by: Noah Stride <noah.stride@goteleport.com> * spag Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add TODO for appendix B Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Use arndt's wording for X509 protocol comparison Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Appendix B Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Validators should ignore unknown header params except where crit Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add note on compat with WIT in introduction Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add note on implementations reusing jti and hence not good for re-play protection - thanks @arndt-s Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add note on lifespan policies Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Shorten sentence Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Fix broken heading Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Allow for clock skew on `exp` - thanks @arndt-s Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Fix heading numerals Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Note that CNF must be present Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Note that WIT-SVID may be issued to multiple instances of workload Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Some wordsmithing re: feedback from @jsnctl Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Reorganise WIT-SVID vs WIMSE-WIT comparison Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove comments/TODOs Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add ToC and address SPAG from @jsnctl Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Update warning header to make more sense Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Downgrade nbf/iat to MAY Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Some tweaks to appendices - thanks yoctozepto Signed-off-by: Noah Stride <noah.stride@goteleport.com> * spag Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Adjust language in sec 4 - thanks yoctozepto Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Prohibit use of `jti` in WIT for replay protection Signed-off-by: Noah Stride <noah.stride@goteleport.com> * must -> MUST Signed-off-by: Noah Stride <noah.stride@goteleport.com> * server impersonation Signed-off-by: Noah Stride <noah.stride@goteleport.com> * should -> SHOULD Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Clarify token presentation Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove additional 'use' Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Update mandatory pop - prohibit authorization Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove "uses these" duplication Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Clarify grammar re pop lifespan Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remark on complexity of pop cache for recipients Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Signpost to appendix b for kid difference Signed-off-by: Noah Stride <noah.stride@goteleport.com> --------- Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Prohibit inclusion of `aud` claim (#372) Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Expand WIT-SVID Token Presentation section Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add banners Signed-off-by: Noah Stride <noah.stride@goteleport.com> * remove experimental banner from proto Signed-off-by: Noah Stride <noah.stride@goteleport.com> --------- Signed-off-by: Noah Stride <noah.stride@goteleport.com>

remove experimental banner from proto Signed-off-by: Noah Stride <noah.stride@goteleport.com>

WIT-SVID Workload API Profile (#327) * Add draft of proto for WIT-SVID Workload API Signed-off-by: Noah Stride <noah.stride@goteleport.com> * First draft of WIT-SVID profile in the SPIFFE Workload API specification Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove TODO from WITSVIDRequest message Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove remark regarding trust bundles from FetchWITSVID RPC Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add initial draft of pagination support Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Move "Default Identity" section out of X509-SVID Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Revert "Add initial draft of pagination support" This reverts commit 713f75e3465d545b99003fbd7c24f71d57f64685. Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Correct header markdown Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add warning headers Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add support for `spiffe_id` field to WIT SVID profile Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Fix ToC Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Merge WIT profile into the workloadapi.proto Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Require inclusion of `kid` in WIT trust bundle Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Wrap line consistently with rest of document Signed-off-by: Noah Stride <noah.stride@goteleport.com> * SPAG Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Make sure proto comments align in doc and .proto Signed-off-by: Noah Stride <noah.stride@goteleport.com> --------- Signed-off-by: Noah Stride <noah.stride@goteleport.com>

2026-06-16

SPIFFE Broker API & Endpoint (#340) * first attempt on broker API & endpoint Signed-off-by: Arndt <17650715+arndt-s@users.noreply.github.com> Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * work in comments Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * use int32 for pid and remove other unnecessary changes Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * add CRL back to X509SVIDResponse to be consistent with Workload API Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * small fixes Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * clean up docs, change error responses Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * use Any for extensions, add other platform references Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * add state machine Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Jason Costello <jason@cofide.io> Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * fix implementor->implementer Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * allow network accessibility, prevent local references to be used across the network Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * strip to minimum to speed up implementations Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * add proto package, rename service & rpcs to make it more clear what's streaming and what isn't Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * add Kubernetes POD UID reference Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * Broker API: Introduce SVIDs for KubernetesObjectReference Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Broker API: Replace WorkloadKubernetesPodUIDReference with KubernetesObjectReference Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Broker API: Remove multiple references Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Broker API: Change Kubernetes resource field into a composite field Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Broker API: Rephrase node-local traffic restriction for TCP endpoint Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Broker API: Remove opinion about spiffe ID format for KubernetesObjectReference Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Broker API: Place Kubernetes object name fields together Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * Broker API: Improve KubernetesObjectReference field and message names Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> * work in feedback Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * overall review & improvement. Fixed typos, more clarify, aligned with format of other specs, fixed toc. Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * add small text about broker jittering Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * fix type urls Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * use consistent wrapping Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * remove section about SubjectAccessReview - this is implementation specific and doesn't belong into the spec Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * Make extensibility more clear between section 2 and 3.1.4 Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * make it more clear that keys are only ASN.1 DER encoded and not PEM Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * Apply suggestions from Noah Co-authored-by: Noah Stride <noah@noahstride.co.uk> Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * add banner Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * add classifier for monitoring references Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> * clarify remote KubernetesObjectReferences and that the Broker API can be only be used with a single CP Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> --------- Signed-off-by: Arndt <17650715+arndt-s@users.noreply.github.com> Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com> Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com> Co-authored-by: Jason Costello <jason@cofide.io> Co-authored-by: Matheus Pimenta <matheuscscp@gmail.com> Co-authored-by: Noah Stride <noah@noahstride.co.uk>

2026-06-12

add clarification that keys & bundles are not PEM encoded (#401) Signed-off-by: arndt-s <17650715+arndt-s@users.noreply.github.com>

2026-01-08

Merge branch 'main' into draft-wit-svid

2025-11-14

WIT-SVID Workload API Profile (#327) * Add draft of proto for WIT-SVID Workload API Signed-off-by: Noah Stride <noah.stride@goteleport.com> * First draft of WIT-SVID profile in the SPIFFE Workload API specification Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove TODO from WITSVIDRequest message Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Remove remark regarding trust bundles from FetchWITSVID RPC Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add initial draft of pagination support Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Move "Default Identity" section out of X509-SVID Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Revert "Add initial draft of pagination support" This reverts commit 713f75e3465d545b99003fbd7c24f71d57f64685. Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Correct header markdown Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add warning headers Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Add support for `spiffe_id` field to WIT SVID profile Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Fix ToC Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Merge WIT profile into the workloadapi.proto Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Require inclusion of `kid` in WIT trust bundle Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Wrap line consistently with rest of document Signed-off-by: Noah Stride <noah.stride@goteleport.com> * SPAG Signed-off-by: Noah Stride <noah.stride@goteleport.com> * Make sure proto comments align in doc and .proto Signed-off-by: Noah Stride <noah.stride@goteleport.com> --------- Signed-off-by: Noah Stride <noah.stride@goteleport.com>

2025-05-29

fix typo (#341)

The documentation is generated from this commit.

2021-07-22

Merge branch 'main' into svid-labels

2021-07-01

Update svid label/hint text in workload api Provide explicit examples of how to use Mandate value uniqueness Change name to hint Further constrain maximum size, make it clearer Signed-off-by: Evan Gilman <egilman@vmware.com>

2021-05-27

Address PR comments Signed-off-by: Andrew Harding <aharding@vmware.com>

Address PR comments Signed-off-by: Andrew Harding <aharding@vmware.com>

Provide extra details on claims processing Signed-off-by: Andrew Harding <aharding@vmware.com>

2021-05-13

update workload proto file Signed-off-by: Brian Martin <bri365@gmail.com>

update workload proto file Signed-off-by: Brian Martin <bri365@gmail.com>

2021-05-06

Superficial proto comment cleanup (#176) Signed-off-by: Andrew Harding <aharding@vmware.com>

Update Workload API spec with JWT-SVID Profile (#144) This PR adds the JWT-SVID Profile to the Workload API specification. Most of the JWT-SVID text came from a draft proposal created by @evan2645. There have been some small tweaks, mostly adapting the language based on the recent addition of FetchX509Bundles, which closely mirrors the FetchJWTBundles RPC. I also took the opportunity to create a canonical, complete definition of the Workload API gRPC Service definition. Consequently some of the service definition text in the spec has been adjusted. In addition, the change: - Moves common phrasing to a profile-agnostic Client and Server behavior section. - Introduces a consistent framing for the profile definition and RPC details. Signed-off-by: Andrew Harding <aharding@vmware.com>