Close #1251: Allow no transparency-log entries - #1252
Open
anthonydahanne wants to merge 5 commits into
Open
Conversation
anthonydahanne
force-pushed
the
issue-1251-keylessverifier-private
branch
from
July 24, 2026 16:25
768542d to
4450784
Compare
loosebazooka
left a comment
loosebazooka
left a comment
Member
There was a problem hiding this comment.
I think this mostly looks alright. Would be nice to reduce the verbosity on the code comments.
anthonydahanne
added a commit
to anthonydahanne/sigstore-java
that referenced
this pull request
Jul 24, 2026
* Add support for verifying bundles without transparency-log entries, relying on signed RFC 3161 timestamps. Signed-off-by: Anthony Dahanne <anthony.dahanne@gmail.com>
* bundles without transparency log entries Signed-off-by: Anthony Dahanne <anthony.dahanne@gmail.com>
Signed-off-by: Anthony Dahanne <anthony.dahanne@gmail.com>
anthonydahanne
force-pushed
the
issue-1251-keylessverifier-private
branch
from
July 27, 2026 16:32
75bdd89 to
8de4432
Compare
anthonydahanne
marked this pull request as ready for review
July 27, 2026 16:32
anthonydahanne
added a commit
to anthonydahanne/sigstore-java
that referenced
this pull request
Jul 28, 2026
* Only when there are no CT Logs (private deployment) we can skip SCT verification
* Only when there are no CT Logs (private deployment) we can skip SCT verification Signed-off-by: Anthony Dahanne <anthony.dahanne@gmail.com>
anthonydahanne
force-pushed
the
issue-1251-keylessverifier-private
branch
from
July 28, 2026 15:55
bc70a8f to
50de35f
Compare
loosebazooka
left a comment
loosebazooka
left a comment
Member
There was a problem hiding this comment.
sorry one final pass I think. But otherwise looks good
anthonydahanne
added a commit
to anthonydahanne/sigstore-java
that referenced
this pull request
Jul 29, 2026
* no need for zipped file * remve un needed method
* no need for zipped file * remve un needed method Signed-off-by: Anthony Dahanne <anthony.dahanne@gmail.com>
anthonydahanne
force-pushed
the
issue-1251-keylessverifier-private
branch
from
July 29, 2026 20:58
019f7bc to
400f676
Compare
Author
|
hopefully this is good this time 🤞 - some reformatting stuff I don't really like, but hey, linter is always right 😅 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Solves #1251
Release Note
VerificationOptions.allowNonTransparencyLogVerification()(defaultfalse): when enabled,KeylessVerifierverifies bundles that contain no transparency-log entry, relying on a signed RFC 3161 timestamp for trusted time. A transparency-log entry that is present is still fully verified — the option only relaxes the requirement that one exists.--allow-non-transparency-logflag to thesigstore-cli verifycommand exposing the same option.Documentation
Verifying a bundle that has no transparency-log entry (e.g. a GitHub artifact attestation from a private repository, signed by GitHub's non-public-good Sigstore instance) now works by opting in:
VerificationOptions.builder().allowNonTransparencyLogVerification(true).build(), with a trusted root supplied viaKeylessVerifier.builder().trustedRootProvider(...).sigstore-cli verify <artifact> --bundle <bundle> --trusted-root <root> --allow-non-transparency-log --certificate-identity <san> --certificate-oidc-issuer <issuer>.The bundle must still carry a valid RFC 3161 timestamp, and enabling the option reduces assurance (no transparency-log monitorability), so it should only be used for instances that intentionally do not publish to a log. Covered by the new Javadoc on the option and the CLI
--helpNo separate docs.sigstore.dev change is required, but happy to open one if preferred.