Open santosomar opened 9 months ago
Attestation has many meanings depending on the context. for instance, in the word of confidential computing, attestation is the proof of property of a system to a third party. IETF also has a definition in the context of its RATS architecture: https://www.ietf.org/archive/id/draft-ietf-rats-architecture-22.html
with that being said, attestations may be correct and appropriate since the attestation is a proof. Authenticity is proving who you are, and integrity is protecting the data from unauthorized changes. Both may be achieved by a singular function (such as verifying the signature and the resulting digest) but they are not always executed together (even though they should be).
I suggest replacing the term "attestation" with "authenticity." This change is recommended for the following reasons:
This issue was first raised in the previous AI BOM repository at https://github.com/manifest-cyber/ai-bom , but that repo was deleted.