bc4318ef97
- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism. - Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions. - Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests. - Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.
1.5 KiB
1.5 KiB
Key rotation
Purpose
- Rotate signing keys without invalidating historical DSSE proofs.
Principles
- Do not mutate old DSSE envelopes.
- Keep key history; revoke instead of delete.
- Publish key material to trust anchors and mirrors.
- Audit all key lifecycle events.
Key profiles (examples)
- default: SHA256-ED25519
- fips: SHA256-ECDSA-P256
- gost: GOST-R-34.10-2012
- sm2: SM2-P256
- pqc: ML-DSA-65
Rotation workflow
- Generate a new key in the configured keystore.
- Add the key to the trust anchor without removing old keys.
- Run a transition period where both keys verify.
- Revoke the old key with an effective date.
- Publish updated key material to attestation feeds or mirrors.
Trust anchors
- Scoped by PURL pattern and allowed predicate types.
- Store allowedKeyIds, revokedKeys, and keyHistory with timestamps.
Verification with key history
- Verify signatures using the key valid at the time of signing.
- Revoked keys remain valid for pre-revocation attestations.
Emergency revocation
- Revoke compromised keys immediately and publish updated anchors.
- Re-issue trust bundles and notify downstream verifiers.
Metrics and alerts
- signer_key_age_days
- signer_keys_active_total
- signer_keys_revoked_total
- signer_rotation_events_total
- signer_verification_key_lookups_total
- Alerts when keys near or exceed maximum age.
Related references
- security/crypto-and-trust.md
- provenance/attestation-workflow.md
- docs/operations/key-rotation-runbook.md