docs: clarify wording in spec about usage of certificate chain (#2152)

Signed-off-by: Asra Ali <asraa@google.com> Signed-off-by: Asra Ali <asraa@google.com>
sigstore · Aug 12, 2022 · b8bf057 · b8bf057
1 parent 86c6a35
commit b8bf057
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/specs/SIGNATURE_SPEC.md b/specs/SIGNATURE_SPEC.md
@@ -65,6 +65,8 @@ Ej6T/GLK6XJSB28haSPRWB7k
   This OPTIONAL property contains a PEM-encoded, DER-formatted, ASN.1 x509 certificate chain.
   The `certificate` property MUST be present if this property is present.
   This chain MAY be used by implementations to verify the `certificate` property.
+  Clients MUST validate that any certificates in the chain that are self-signed
+  or are expected to be trust anchors with an out-of-band mechanism.
 
   Example `chain`: