Update bundle.md (#360)

* Update bundle.md Update payload information in the dsse type Signed-off-by: Appu <[email protected]> * Update bundle.md Signed-off-by: Appu <[email protected]> --------- Signed-off-by: Appu <[email protected]>
sigstore · Jan 15, 2025 · 65f17c3 · 65f17c3
1 parent ad31e90
commit 65f17c3
Showing 1 changed file with 3 additions and 6 deletions.
diff --git a/content/en/about/bundle.md b/content/en/about/bundle.md
@@ -6,7 +6,7 @@ title: Sigstore Bundle Format
 weight: 4
 ---
 
-Last updated October 31, 2024
+Last updated January 14, 2025
 
 Version 0.3.2
 
@@ -136,15 +136,12 @@ artifact at verification time.
 
 #### DSSE
 
-A DSSE envelope can contain arbitrary payloads. Currently Sigstore clients only process the
-payload type `"application/vnd.in-toto+json"`. Verifiers must verify that the payload type is a
-supported and expected type. DSSE envelopes contained in a Sigstore Bundle must only contain a
-single signature (the DSSE spec allows multiple).
+The DSSE envelope in a Sigstore Bundle must conform to the [in-toto Envelope layer specification](https://github.com/in-toto/attestation/blob/main/spec/v1/envelope.md) where `payloadType` is `"application/vnd.in-toto+json"` and the payload is an [in-toto statement](https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md). DSSE envelopes in a Sigstore Bundle must also contain only a single signature (the DSSE spec allows multiple).
 
 ```json
 "dsseEnvelope": {
   {
-    "payload": "<Base64(JSON_PAYLOAD)>",
+    "payload": "<Base64(JSON_IN_TOTO_STATEMENT)>",
     "payloadType": "application/vnd.in-toto+json",
     "signatures": [{
       "keyid": "<KEY_ID>",