sigstore_rekor: clarify inclusion_promise requirement

Signed-off-by: William Woodruff <[email protected]>
sigstore · Aug 9, 2024 · 3b39d52 · 3b39d52
1 parent f2a5e8d
commit 3b39d52
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/protos/sigstore_rekor.proto b/protos/sigstore_rekor.proto
@@ -104,8 +104,10 @@ message TransparencyLogEntry {
         int64 integrated_time = 4 [(google.api.field_behavior) = REQUIRED];
         // The inclusion promise/signed entry timestamp from the log.
         // Required for v0.1 bundles, and MUST be verified.
-        // Optional for >= v0.2 bundles, and SHOULD be verified when present.
-        // Also may be used as a signed timestamp.
+        // Optional for >= v0.2 bundles if another source of signed time
+        // is present.
+        // MUST be verified if no other source of signed time is present,
+        // and SHOULD be verified otherwise.
         InclusionPromise inclusion_promise = 5;
         // The inclusion proof can be used for offline or online verification
         // that the entry was appended to the log, and that the log has not been