Add comment that integration time is only trustworthy with an SET (#442)

sigstore · Dec 10, 2024 · ad0a758 · ad0a758
1 parent 0bb3807
commit ad0a758
Show file tree

Hide file tree

Showing 10 changed files with 20 additions and 6 deletions.
diff --git a/gen/jsonschema/schemas/Bundle.schema.json b/gen/jsonschema/schemas/Bundle.schema.json
@@ -314,7 +314,7 @@
                 },
                 "integratedTime": {
                     "type": "string",
-                    "description": "The UNIX timestamp from the log when the entry was persisted."
+                    "description": "The UNIX timestamp from the log when the entry was persisted. The integration time MUST NOT be trusted if inclusion_promise is omitted."
                 },
                 "inclusionPromise": {
                     "$ref": "#/definitions/dev.sigstore.rekor.v1.InclusionPromise",

diff --git a/gen/jsonschema/schemas/Input.schema.json b/gen/jsonschema/schemas/Input.schema.json
@@ -507,7 +507,7 @@
                 },
                 "integratedTime": {
                     "type": "string",
-                    "description": "The UNIX timestamp from the log when the entry was persisted."
+                    "description": "The UNIX timestamp from the log when the entry was persisted. The integration time MUST NOT be trusted if inclusion_promise is omitted."
                 },
                 "inclusionPromise": {
                     "$ref": "#/definitions/dev.sigstore.rekor.v1.InclusionPromise",

diff --git a/gen/jsonschema/schemas/TransparencyLogEntry.schema.json b/gen/jsonschema/schemas/TransparencyLogEntry.schema.json
@@ -20,7 +20,7 @@
                 },
                 "integratedTime": {
                     "type": "string",
-                    "description": "The UNIX timestamp from the log when the entry was persisted."
+                    "description": "The UNIX timestamp from the log when the entry was persisted. The integration time MUST NOT be trusted if inclusion_promise is omitted."
                 },
                 "inclusionPromise": {
                     "$ref": "#/definitions/dev.sigstore.rekor.v1.InclusionPromise",

diff --git a/gen/jsonschema/schemas/VerificationMaterial.schema.json b/gen/jsonschema/schemas/VerificationMaterial.schema.json
@@ -231,7 +231,7 @@
                 },
                 "integratedTime": {
                     "type": "string",
-                    "description": "The UNIX timestamp from the log when the entry was persisted."
+                    "description": "The UNIX timestamp from the log when the entry was persisted. The integration time MUST NOT be trusted if inclusion_promise is omitted."
                 },
                 "inclusionPromise": {
                     "$ref": "#/definitions/dev.sigstore.rekor.v1.InclusionPromise",

diff --git a/gen/pb-go/rekor/v1/sigstore_rekor.pb.go b/gen/pb-go/rekor/v1/sigstore_rekor.pb.go
diff --git a/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/rekor/v1/__init__.py b/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/rekor/v1/__init__.py
diff --git a/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.rekor.v1.rs b/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.rekor.v1.rs
@@ -127,6 +127,8 @@ pub struct TransparencyLogEntry {
     #[prost(message, optional, tag = "3")]
     pub kind_version: ::core::option::Option<KindVersion>,
     /// The UNIX timestamp from the log when the entry was persisted.
+    /// The integration time MUST NOT be trusted if inclusion_promise
+    /// is omitted.
     #[prost(int64, tag = "4")]
     pub integrated_time: i64,
     /// The inclusion promise/signed entry timestamp from the log.

diff --git a/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin b/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin
diff --git a/gen/pb-typescript/src/__generated__/sigstore_rekor.ts b/gen/pb-typescript/src/__generated__/sigstore_rekor.ts
diff --git a/protos/sigstore_rekor.proto b/protos/sigstore_rekor.proto
@@ -101,6 +101,8 @@ message TransparencyLogEntry {
         // verification.
         KindVersion kind_version = 3 [(google.api.field_behavior) = REQUIRED];
         // The UNIX timestamp from the log when the entry was persisted.
+        // The integration time MUST NOT be trusted if inclusion_promise
+        // is omitted.
         int64 integrated_time = 4 [(google.api.field_behavior) = REQUIRED];
         // The inclusion promise/signed entry timestamp from the log.
         // Required for v0.1 bundles, and MUST be verified.