...
Users do not need to know or learn any details about this procedure.
How:
1.The whole authenticating workflow show as followingproposal authenticating of final report :
1a. OPNFV generates the key pairs for each release
2b. Dovetail uses this key and hash value of the dovetail tool to build a binary signature tool
3c. Users begin to run the dovetail tool, the dovetail tool will generate the report in memory, and then use the signature tool to check the integrity of dovetail tool, then sign the report
4d. Dovetail tool saves the report to a report file
5e. Users then can upload report and signature to the reviewer
6f. Reviewer can get a public key from OPNFV to extract digest from signature
7g. Then reviewer can validate the integrity of the report
.png?version=2&modificationDate=1484901671000&cacheVersion=1&api=v2)
2. proposal for container security:
Temporary test results in container can be modified as well, we can improve this by following:
1) the upstream project to do authentication on themselves
2) setup a database, and the database is dedicated for dovetail results, people with no permit can not access the database
3) use the REST API of FUNCTEST/YARDSTICK with SSL to make sure that these results are just existing in secured transportation and saved to db, and then no one can touch them.
.png?version=1&modificationDate=1486520261000&cacheVersion=1&api=v2)