gen, protos: warning language

Signed-off-by: William Woodruff <[email protected]>
sigstore · Feb 5, 2024 · d3dc93c · d3dc93c
1 parent 71ab1ab
commit d3dc93c
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 0 deletions.
diff --git a/gen/pb-go/common/v1/sigstore_common.pb.go b/gen/pb-go/common/v1/sigstore_common.pb.go
diff --git a/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/common/v1/__init__.py b/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/common/v1/__init__.py
diff --git a/gen/pb-typescript/src/__generated__/sigstore_common.ts b/gen/pb-typescript/src/__generated__/sigstore_common.ts
diff --git a/protos/sigstore_common.proto b/protos/sigstore_common.proto
@@ -90,6 +90,14 @@ enum PublicKeyDetails {
         // These keys and signatures may be used by private Sigstore
         // deployments, but are not currently supported by the public
         // good instance.
+        //
+        // USER WARNING: LMS and LM-OTS are both stateful signature schemes.
+        // Using them correctly requires discretion and careful consideration
+        // to ensure that individual secret keys are not used more than once.
+        // In addition, LM-OTS is a single-use scheme, meaning that it
+        // MUST NOT be used for more than one signature per LM-OTS key.
+        // If you cannot maintain these invariants, you MUST NOT use these
+        // schemes.
         LMS_SHA256 = 14;
         LMOTS_SHA256 = 15;