Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Fix blockchain question in FAQ #295

Merged
merged 2 commits into from
Mar 11, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions content/en/about/faq.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,12 @@
weight: 35
---

This FAQ is intended to go as in depth as possible for anyone using sigstore.

Check failure on line 9 in content/en/about/faq.md

View workflow job for this annotation

GitHub Actions / markdownlint

Trailing spaces

content/en/about/faq.md:9:78 MD009/no-trailing-spaces Trailing spaces [Expected: 0 or 2; Actual: 1] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md009.md

## General

### What security checks do you use internally?

Check failure on line 14 in content/en/about/faq.md

View workflow job for this annotation

GitHub Actions / markdownlint

Trailing spaces

content/en/about/faq.md:14:1 MD009/no-trailing-spaces Trailing spaces [Expected: 0 or 2; Actual: 1] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md009.md
We’ve adopted a security disclosures and response policy to make sure we can responsibly handle critical issues. We have an initial Security Response Committee, who for each vulnerability reported will coordinate to create the fix and release, and communicate the process. You can read the [full policy on GitHub](https://github.com/sigstore/.github/blob/main/SECURITY.md).

### How does Sigstore integrate in-toto?
Expand Down Expand Up @@ -121,17 +121,17 @@
by default an ephemeral key is generated for each commit. There are a
few options to help automating the authentication process:

- Setting the [`connectorID`](/signing/gitsign/#configuration) value can be set to

Check failure on line 124 in content/en/about/faq.md

View workflow job for this annotation

GitHub Actions / markdownlint

Unordered list style

content/en/about/faq.md:124:1 MD004/ul-style Unordered list style [Expected: asterisk; Actual: dash] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md004.md
automatically select the desired provider for Dex-backed OIDC providers
(including the public Sigstore instance at `oauth.sigstore.dev`). While this
still requires a browser window to open, this does not require an extra click
to select the provider.
- Starting in v0.2.0, Gitsign has experimental support for key caching to allow

Check failure on line 129 in content/en/about/faq.md

View workflow job for this annotation

GitHub Actions / markdownlint

Unordered list style

content/en/about/faq.md:129:1 MD004/ul-style Unordered list style [Expected: asterisk; Actual: dash] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md004.md
users to reuse ephemeral keys for the lifetime of the Fulcio certificate. If
you are interested in learning more, check out the
[`gitsign-credential-cache` README](https://github.com/sigstore/gitsign/tree/main/cmd/gitsign-credential-cache).


Check failure on line 134 in content/en/about/faq.md

View workflow job for this annotation

GitHub Actions / markdownlint

Multiple consecutive blank lines

content/en/about/faq.md:134 MD012/no-multiple-blanks Multiple consecutive blank lines [Expected: 1; Actual: 2] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md012.md
## Rekor

### Is the transparency log monitored?
Expand All @@ -146,16 +146,12 @@

There's no need for a distributed source of transparency as there can be multiple points of transparency which only adds more sources of security guarantee, not fewer. An entity can post to as many Rekor logs as they want and inform users of where they post. We do encourage folks to use common public instances, but we don't seek to enforce this. We do plan to look to produce a gossip protocol, for those that desire a more decentralised model (if there's demand).

### How do I verify downloaded code?

Public blockchains often end up using a centralized entry point for canonicalization and authentication. Consensus algorithms can be susceptible to majority attacks, and transparency logs are more mature and capable for what we aim to build with sigstore.

### Why use a Merkle Tree/Transparency log?

- Rekor's back end is [Trillian](https://github.com/google/trillian)

Check failure on line 151 in content/en/about/faq.md

View workflow job for this annotation

GitHub Actions / markdownlint

Unordered list style

content/en/about/faq.md:151:1 MD004/ul-style Unordered list style [Expected: asterisk; Actual: dash] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md004.md
- Trillian is an open source community under active development

Check failure on line 152 in content/en/about/faq.md

View workflow job for this annotation

GitHub Actions / markdownlint

Unordered list style

content/en/about/faq.md:152:1 MD004/ul-style Unordered list style [Expected: asterisk; Actual: dash] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md004.md
- Trilian is deployed by Google, CloudFlare (nimbus), Let's Encrypt for certificate transparency, so it already is considered production grade

Check failure on line 153 in content/en/about/faq.md

View workflow job for this annotation

GitHub Actions / markdownlint

Unordered list style

content/en/about/faq.md:153:1 MD004/ul-style Unordered list style [Expected: asterisk; Actual: dash] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md004.md

### Can I get Rekor to work with my X format, framework standard?

- Yes. Using pluggable types you can create your own manifest layout and send it to Rekor. Head over to [pluggable types]({{< relref "logging/pluggable-types">}})

Check failure on line 157 in content/en/about/faq.md

View workflow job for this annotation

GitHub Actions / markdownlint

Unordered list style

content/en/about/faq.md:157:1 MD004/ul-style Unordered list style [Expected: asterisk; Actual: dash] https://github.com/DavidAnson/markdownlint/blob/v0.29.0/doc/md004.md
Loading