docs: document TUF design decisions

sigstore / root-signing-staging

Staging TUF repository for Sigstore trust root

https://tuf-repo-cdn.sigstage.dev/

Apache License 2.0

3 stars 6 forks source link

docs: document TUF design decisions #129

Open jku opened 4 months ago

jku commented 4 months ago

Description

The current signers, thresholds etc will be documented by the system automatically from tuf-on-ci 0.10 onwards but we should include a note in README about the design decisions:

why have N signers for root
why root expiry is X but targets is Y
same for timestamp and snapshot
why there is only a single online key