forked from sigstore/cosign
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add FEATURES.md and DEPRECATIONS.md (sigstore#1429)
Signed-off-by: Priya Wadhwa <priya@chainguard.dev>
- Loading branch information
1 parent
0e3371a
commit 87425a3
Showing
2 changed files
with
46 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
# Deprecations | ||
|
||
This doc lists deprecated features in `cosign`. | ||
You can read more about Sigstore's deprecation policy [here](https://docs.sigstore.dev/api-stability)! | ||
|
||
| **Feature Being Deprecated** | **API Stability Level** | **Earliest Date of Removal** | | ||
|------------------------------|-------------------------|------------------------------| | ||
| My feature | Experimental/Beta/GA | DD/MM/YY | | ||
| | | | | ||
| | | | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
# Feature Stability | ||
|
||
This doc covers feature stability in `cosign` as described in the [API Stability Policy](https://docs.sigstore.dev/api-stability) for Sigstore. | ||
|
||
## Experimental | ||
* Keyless signing using the `Fulcio` CA | ||
* Storing signatures in a transparency log | ||
* The `pkg/cosign/oci` client library | ||
|
||
Some formats that cosign relies upon are not stable yet either: | ||
* The SBOM specification for storing SBOMs in a container registry | ||
* The In-Toto attestation format | ||
|
||
|
||
## Beta | ||
* All cosign subcommands, including flags and output | ||
|
||
|
||
## General Availability | ||
|
||
### Key Management | ||
|
||
* fixed, text-based keys generated using `cosign generate-key-pair` | ||
* cloud KMS-based keys generated using `cosign generate-key-pair -kms` | ||
* keys generated on hardware tokens using the PIV interface using `cosign piv-tool` | ||
* Kubernetes-secret based keys generated using `cosign generate-key-pair k8s://namespace/secretName` | ||
|
||
|
||
### Artifact Types | ||
|
||
* OCI and Docker Images | ||
* Other artifacts that can be stored in a container registry, including: | ||
* Tekton Bundles | ||
* Helm Charts | ||
* WASM modules | ||
* Text files and other binary blobs, using `cosign sign-blob` |