LOW-LAYER Signing

LOW-LAYER signs its releases with short-lived certificates, so that no long-term signing key has to be distributed or trusted. This address gives you what you need to verify those signatures.

Verifying a signature

Configure cosign once, for example at the start of your pipeline. It then finds the certificates and keys by itself.

cosign initialize \
  --mirror https://signing.low-layer.com \
  --root https://signing.low-layer.com/1.root.json \
  --root-checksum 778540f2a2a4a3bf4200d90da6ecac34d0da61cfabc2f324ca3f5c27a9c58f39

Compare the checksum with the one in the documentation of the trust root, which also shows a full verification. Signatures come with what you verify: the certificate, the timestamp and the proof that they are in the log are all inside the signature bundle.

Addresses and settings

TUF mirror	https://signing.low-layer.com
First root	https://signing.low-layer.com/1.root.json
First root SHA-256	`778540f2a2a4a3bf4200d90da6ecac34d0da61cfabc2f324ca3f5c27a9c58f39`
Freshness of the metadata	https://signing.low-layer.com/timestamp.json
`--certificate-oidc-issuer`	`https://git.low-layer.com`
`--certificate-identity-regexp`	`^https://git\.low-layer\.com/<group>/<project>//\.gitlab-ci\.yml@refs/tags/`
Other required flags	`--use-signed-timestamps --insecure-ignore-sct`
Log checkpoint	https://signing.low-layer.com/api/v2/checkpoint
Log tiles	`https://signing.low-layer.com/api/v2/tile/`
Source of the trust root	https://git.low-layer.com/community/sigstore-trust-root

What this address serves

A TUF repository: signed metadata and trusted_root.json, which holds the public certificates and keys of the signing services. TUF lets a client detect a tampered, outdated or expired file, so you do not have to trust this server.

Signing services

The certificate authority and the timestamp authority are private, and only LOW-LAYER build pipelines can write to the transparency log. In trusted_root.json, this address stands for these services. Verifying a signature does not contact them.

Transparency log

Every signature of a published release is recorded in an append-only log, so that anyone can review what was signed. Anyone can read it, in the tlog-tiles format, from /api/v2/checkpoint and /api/v2/tile/.

Contact

Report a vulnerability to security@low-layer.com. Anything else: contact@low-layer.com.