Skip to content

Commit

Permalink
Add FEATURES.md and DEPRECATIONS.md (sigstore#1429)
Browse files Browse the repository at this point in the history
Signed-off-by: Priya Wadhwa <priya@chainguard.dev>
  • Loading branch information
priyawadhwa authored and Marc Hildenbrand committed Apr 19, 2022
1 parent 0e3371a commit 87425a3
Show file tree
Hide file tree
Showing 2 changed files with 46 additions and 0 deletions.
10 changes: 10 additions & 0 deletions DEPRECATIONS.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
# Deprecations

This doc lists deprecated features in `cosign`.
You can read more about Sigstore's deprecation policy [here](https://docs.sigstore.dev/api-stability)!

| **Feature Being Deprecated** | **API Stability Level** | **Earliest Date of Removal** |
|------------------------------|-------------------------|------------------------------|
| My feature | Experimental/Beta/GA | DD/MM/YY |
| | | |
| | | |
36 changes: 36 additions & 0 deletions FEATURES.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# Feature Stability

This doc covers feature stability in `cosign` as described in the [API Stability Policy](https://docs.sigstore.dev/api-stability) for Sigstore.

## Experimental
* Keyless signing using the `Fulcio` CA
* Storing signatures in a transparency log
* The `pkg/cosign/oci` client library

Some formats that cosign relies upon are not stable yet either:
* The SBOM specification for storing SBOMs in a container registry
* The In-Toto attestation format


## Beta
* All cosign subcommands, including flags and output


## General Availability

### Key Management

* fixed, text-based keys generated using `cosign generate-key-pair`
* cloud KMS-based keys generated using `cosign generate-key-pair -kms`
* keys generated on hardware tokens using the PIV interface using `cosign piv-tool`
* Kubernetes-secret based keys generated using `cosign generate-key-pair k8s://namespace/secretName`


### Artifact Types

* OCI and Docker Images
* Other artifacts that can be stored in a container registry, including:
* Tekton Bundles
* Helm Charts
* WASM modules
* Text files and other binary blobs, using `cosign sign-blob`

0 comments on commit 87425a3

Please sign in to comment.