Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

More precise wording in SumDB claimant model #2928

Merged
merged 2 commits into from
Mar 7, 2023
Merged

More precise wording in SumDB claimant model #2928

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
11914b2
More precise wording in SumDB claimant model
mhutchinson Mar 7, 2023
5d26c3e
s/GoLang/Go/
mhutchinson Mar 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/claimantmodel/Logs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,4 +87,4 @@ The signature on each individual Statement<sup>DOMAIN</sup> can be omitted if bo
* Claimant<sup>DOMAIN</sup> and Claimant<sup>LOG</sup> are the same actor; and
* Every actor that is Believer<sup>DOMAIN</sup> is also Believer<sup>LOG</sup>

The signature on the Checkpoint effectively transitively signs each of the Claims within the log. This is what the [GoLang SumDB](https://blog.golang.org/module-mirror-launch) does. The Claim here is “*I, ${SumDB}, will return only $hash as the checksum for $module at $version*”. This is falsifiable; correct behaviour can be verified by confirming that no two entries in the log have the same module & version, but different checksums.
The signature on the Checkpoint effectively transitively signs each of the Claims within the log. This is what the [Go SumDB](https://blog.golang.org/module-mirror-launch) does. The Claim here is “*I, ${SumDB}, commit to $hash as the checksum for $module at $version*”. This is falsifiable; correct behaviour can be verified by confirming that no two entries committed to by the log have the same module & version, but different checksums.