Signing event: sign/root-v10

[sigstore-bot]

Processing signing event sign/root-v10, please wait.

[sigstore-bot]

Current signing event state

Event sign/root-v10 (commit 6d3280f)

❌ root

Role root is unsigned and not yet verified
Still missing signatures from @joshuagl, @jku, @mnm678, @kommendorkapten
Signers can sign these changes by running tuf-on-ci-sign sign/root-v10

[jku]

I think we've seen now that the version bump signing events work.

How about bumping the root expiry to 6 months instead of 3?

[kommendorkapten]

How about bumping the root expiry to 6 months instead of 3?

Agreed.

[sigstore-bot]

Current signing event state

Event sign/root-v10 (commit b38702e)

❌ root

Role root is not yet verified. It is signed by 1/2 (1/2) signers (@jku).
Still missing signatures from @joshuagl, @mnm678, @kommendorkapten
Signers can sign these changes by running tuf-on-ci-sign sign/root-v10

[jku]

Changed the root expiry period to 182 days. Feel free to sign when you have time (30 days until expiry so no rush).

[jku]

I will include sigstore/root-signing#1339 here as well:

• start signing timestamp every day

[sigstore-bot]

Current signing event state

Event sign/root-v10 (commit 163c6d5)

❌ root

Role root is not yet verified. It is signed by 1/2 (1/2) signers (@jku).
Still missing signatures from @kommendorkapten, @mnm678, @joshuagl
Signers can sign these changes by running tuf-on-ci-sign sign/root-v10

[jku]

the tuf-on-ci-sign output isn't perfect: it does not notify signer that timestamp signing period changes: theupdateframework/tuf-on-ci#432

[sigstore-bot]

Current signing event state

Event sign/root-v10 (commit 058e358)

✅ root

Role root is verified and signed by 2/2 (2/2) signers (@jku, @kommendorkapten).
Still missing signatures from @mnm678, @joshuagl
Signers can sign these changes by running tuf-on-ci-sign sign/root-v10

Signing event is successful

Threshold of signatures has been reached: this signing event can be reviewed and merged.

[jku]

Documenting all of the changes just in case it's not clear:

• root goes from expiry period of 91 days to 182 days
• timestamp goes from signing period of 4 days to 6 days -- effectively meaning online signing happens ~ every day

The first one brings root-signing-staging in line with production root-signing. The second one is basically a test before we decide if we want to do this same change in production root-signing

I'm planning to merge today.