Skip to content

Commit

Permalink
Add description of meta-artifact downsides for artifact movement
Browse files Browse the repository at this point in the history
Signed-off-by: Marina Moore <mnm678@gmail.com>
  • Loading branch information
mnm678 committed Jun 8, 2021
1 parent 3d31406 commit 08647d2
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion key-revocation.md
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ A final option is to use a combination of the first and third techniques to achi

This method allows signers to have relatively long lived keys, to simplify their workflow and avoid needing to resign the artifacts themselves, while enabling timely revoking of the signing key or a single artifact signature.

For efficiency, a meta-artifact can be created and maintained, containing references to a collection currently signed artifacts. And the short lived signature can be created for this single artifact, rather than every artifact individually.
For efficiency, a meta-artifact can be created and maintained, containing references to a collection currently signed artifacts. And the short lived signature can be created for this single artifact, rather than every artifact individually. This meta-artifact would need to be updated whenever the collection of artifacts changes and parsed when validating any artifact.

Pros:
* Allows key revocation at any time
Expand Down

0 comments on commit 08647d2

Please sign in to comment.