Skip to content

Commit 417ef6e

Browse files
author
Tracy Miranda
committed
Updates based on review feedback
1 parent 80ef20f commit 417ef6e

File tree

1 file changed

+8
-11
lines changed

1 file changed

+8
-11
lines changed

sigstore-public-deployment-spec.md

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Sigstore Public Deployment
22

33

4-
This document describes the technical and policy decisions for the public deployment of Sigstore, specifically focusing on the Fulcio and Rekor deployment for the public good instance. The [Spec: Fulcio](https://github.com/sigstore/architecture-docs/blob/main/fulcio-spec.md) and [Spec: Rekor](https://docs.google.com/document/u/0/d/1NQUBSL9R64_vPxUEgVKGb0p81_7BVZ7PQuI078WFn-g/edit) documents leave many implementation choices, such as authentication and log entry formats, to the discretion of implementers. This document outlidetails the specific implementation choices made for Sigstore's public deployment that go beyond the requirements in the specification. Additionally, this document details the use of TUF for distributing roots of trust, and includes links to deployment respositories and resources.
4+
This document describes the technical and policy decisions for the public deployment of Sigstore, specifically focusing on the Fulcio and Rekor deployment for the public good instance. The [Spec: Fulcio](https://github.com/sigstore/architecture-docs/blob/main/fulcio-spec.md) and [Spec: Rekor](https://docs.google.com/document/u/0/d/1NQUBSL9R64_vPxUEgVKGb0p81_7BVZ7PQuI078WFn-g/edit) documents leave many implementation choices, such as authentication and log entry formats, to the discretion of implementers. This document describes the specific implementation choices made for Sigstore's public deployment that go beyond the requirements in the specification. Additionally, this document details the use of TUF for distributing roots of trust, and includes links to deployment respositories and resources.
55

66
## 1. Introduction
77

@@ -29,8 +29,7 @@ Fulcio embeds information about the identity of a requester into the SubjectAlte
2929

3030
These certificates have a validity period of 10 minutes, beginning at the time of issuance.
3131

32-
* [Fulcio certification specification](https://github.com/sigstore/fulcio/blob/main/docs/certificate-specification.md)
33-
* General OIDs
32+
* [Fulcio certification specification](https://github.com/sigstore/fulcio/blob/main/docs/certificate-specification.md)
3433

3534
### 2.2 Authentication
3635

@@ -62,9 +61,10 @@ Dex:
6261

6362
**Workflow Authentication**
6463

65-
* GitHub
66-
* GitLab
64+
* GitHub Actions
65+
* GitLab CI
6766
* BuildKite
67+
* CodeFresh
6868

6969
See the [Fulcio OIDC documentation](https://github.com/sigstore/fulcio/blob/main/docs/oidc.md) for additional details.
7070

@@ -78,9 +78,9 @@ Rekor implements a transparency service. There is a public good deployment of Re
7878

7979
### 3.1 Pluggable Types
8080

81-
The transparency service has what is termed a ‘pluggable type’ system. A pluggable type, is a custom schema for entries stored in the transparency log. Schemas can be in multiple formats (json|yaml|xml).
81+
The transparency service has what is termed a ‘pluggable type’ system. A pluggable type is a custom schema for entries stored in the transparency log. Schemas can be in multiple formats (json|yaml|xml).
8282

83-
The current list of supported types can be found in the [Rekor project](https://github.com/sigstore/rekor/tree/main/pkg/types). Information about adding new pluggable types can be found in the [Rekor documentation.](https://docs.sigstore.dev/docs/logging/pluggable-types/)
83+
The current list of supported types can be found in the [Rekor project](https://github.com/sigstore/rekor/tree/main/pkg/types). Information about adding new pluggable types can be found in the [Rekor documentation.](https://docs.sigstore.dev/logging/pluggable-types/)
8484

8585
See the transparency service ([Spec: Rekor](https://docs.google.com/document/u/0/d/1NQUBSL9R64_vPxUEgVKGb0p81_7BVZ7PQuI078WFn-g/edit)) document for additional information.
8686

@@ -93,10 +93,7 @@ Rekor is backed by a transparency log, inspired by the one in Certificate Transp
9393
* Signature Algorithm: ECDSA (NIST P-256).
9494
* Public Key: change over time
9595
* Log ID: need an OID
96-
* Maximum Merge Delay: Rekor only returns after the merge is complete
97-
* Maximum Chain Length: 10
98-
* STH Frequency Count: N/A
99-
* Final STH: N/A
96+
* Maximum Merge Delay: Rekor only returns after the merge is complete
10097

10198
### 3.3 Sharding
10299

0 commit comments

Comments
 (0)