Repository Specification

The following gives a statement of intent for the repository across ALL milestones:

We wish to create a store of identities and audits for the Daml Package Manager project. The identities will be used to identify auditors and publishers in the infrastructure we are designing as a part of this proposal. They should be managed in a way that gives assurances that each identity is who they say they are. This will allow users to decide which auditors they trust statements from. The identity store shouldn’t make any guarantees about the security of artefacts generated by identities; this decision will be made by the users themselves. Any assurances surrounding an identity will be backed up with evidence, and a clear policy will determine whether this evidence is sufficient. This evidence will then be stored in the repository git tree. A security policy will be enforced by gittuf, which will log all commit activity in an append-only log. An elected committee will vote on decisions, which will also be auditable via gittuf.

Identities

An identity in the repository is exactly one GPG key. Thus an organisation authoring packages must sign these packages with their single organisation key. Likewise an auditing organisation must sign their audits with their key.

Audits

An audit should classify a particular Daml artefact as safe or unsafe. This classification should be signed and dated by an identity in the repository.