Transparency Log Witness Deployment Plan (DEVOPS-ATTEST-74-001)

Goals

Deploy and monitor a Sigstore-compatible witness for Rekor v1/v2 logs (and air-gap mirrors).
Provide offline-ready configs and evidence (hashes, DSSE attestations) for bootstrap packs.

Environments: staging → prod (online), sealed/offline mirror (optional, read-only).
Witness duties: verify inclusion proofs, publish checkpoints/signed STHs, expose metrics and health.

Witness binary (sigstore/witness or equivalent) in a hardened container:
- Non-root user, read-only rootfs, seccomp/AppArmor defaults.
- TLS with mTLS between witness and collector; optional OIDC for admin endpoints.
Inputs:
- Rekor base URL(s) + public keys.
- Mirror CAR path + signature (for air-gap).
Outputs:
- Signed checkpoints (STH) rotated hourly; stored in object storage + DSSE manifest.
- Metrics: Prometheus /metrics endpoint (request latency, verify failures, checkpoint age).
- Logs: JSON, structured, no PII.

Build/pull witness image (pin digest); generate SBOM + cosign attestations.
Create config:
- rekor_urls: prod/staging
- rekor_keys: PEMs
- checkpoint_interval: 1h
- mirror_path (optional): /data/rekor-mirror.car
- signer: KMS ref or file key (sealed-mode uses file key from bootstrap pack)
Helm/Compose template:
- read-only rootfs, drop NET_RAW, memory/cpu limits
- PVC for checkpoints (/var/lib/witness/checkpoints)
- Service exposing HTTPS + /metrics
CI:
- Lint chart
- Run e2e: start Rekor test instance, run witness, verify checkpoint written, verify metrics non-zero.
- Publish image SBOM/attestations and chart checksums.
Monitoring/alerts:
- witness_verify_failures_total > 0 over 5m
- witness_checkpoint_age_seconds > 5400
- witness_backfill_queue_depth (if supported) above threshold