From 5329e5d0d2477ab23d5320b372aa089448132b7e Mon Sep 17 00:00:00 2001 From: Ilya Kreymer Date: Thu, 27 Aug 2026 07:42:57 -0700 Subject: [PATCH 1/4] support specifying a custom timestamping (rfc3161) service url: - update to authsign 0.6.0 - default to digicert instead of freetsa as default - add customizable tsr_signing_url to chart - fixes #3602 --- chart/templates/signer.yaml | 6 +----- chart/values.yaml | 5 ++++- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/chart/templates/signer.yaml b/chart/templates/signer.yaml index b9d945afc9..37cacb79c2 100644 --- a/chart/templates/signer.yaml +++ b/chart/templates/signer.yaml @@ -43,11 +43,7 @@ stringData: # rfc3161 timestamp authority cert chain + timestamp urls # at least one required, if multiple, one is selected at random timestamping: - # time server cert chain (cert + ca cert) - # pkg:// url to load from python package data - - certfile: pkg://authsign.trusted/ts-chain.pem - url: http://freetsa.org/tsr # timeserver URL - + - url: {{ .Values.signer.tsr_signing_url | default "http://timestamp.digicert.com/" }} # timeserver URL # default trusted roots stored in authsign.trusted package # uncomment to override diff --git a/chart/values.yaml b/chart/values.yaml index 5abd71e493..1f10c1ec3b 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -574,12 +574,15 @@ ingress_class: nginx # optionally enable signer signer: enabled: false - image: webrecorder/authsign:0.5.2 + image: webrecorder/authsign:0.6.0 # host: # cert_email: "test@example.com # image_pull_policy: "IfNotPresent" # auth_token: + # optional: set to use a custom timestamping service + # tsr_signing_url: http://timestamp.digicert.com/ + signer_cpu: "5m" signer_memory: "50Mi" From be3f649cdb137e1b25230eccc57a6758cc65ef86 Mon Sep 17 00:00:00 2001 From: Ilya Kreymer Date: Fri, 28 Aug 2026 18:29:40 -0700 Subject: [PATCH 2/4] use 0.6.0b2 for now --- chart/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chart/values.yaml b/chart/values.yaml index 1f10c1ec3b..e89760a201 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -574,7 +574,7 @@ ingress_class: nginx # optionally enable signer signer: enabled: false - image: webrecorder/authsign:0.6.0 + image: webrecorder/authsign:0.6.0b2 # host: # cert_email: "test@example.com # image_pull_policy: "IfNotPresent" From 511b3f86da8ade588064181a712724fb67b72506 Mon Sep 17 00:00:00 2001 From: Ilya Kreymer Date: Tue, 1 Sep 2026 22:05:23 -0700 Subject: [PATCH 3/4] Update to authsign 0.6.0b3 --- chart/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chart/values.yaml b/chart/values.yaml index e89760a201..1cd5207189 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -574,7 +574,7 @@ ingress_class: nginx # optionally enable signer signer: enabled: false - image: webrecorder/authsign:0.6.0b2 + image: webrecorder/authsign:0.6.0b3 # host: # cert_email: "test@example.com # image_pull_policy: "IfNotPresent" From f0658cf82d7bb32e6aa604a0fecf90311ee98b7a Mon Sep 17 00:00:00 2001 From: Ilya Kreymer Date: Thu, 10 Sep 2026 19:12:12 -0700 Subject: [PATCH 4/4] Apply suggestion from @ikreymer --- chart/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chart/values.yaml b/chart/values.yaml index 1cd5207189..c900ddfd6b 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -574,7 +574,7 @@ ingress_class: nginx # optionally enable signer signer: enabled: false - image: webrecorder/authsign:0.6.0b3 + image: webrecorder/authsign:0.6.1 # host: # cert_email: "test@example.com # image_pull_policy: "IfNotPresent"