Update log policy for CT operator provided metadata - #72
Conversation
| * a list of people authorized to represent the log operator when communicating | ||
| with the Chrome team. | ||
| with the Chrome team, and | ||
| * a publicly accessible JSON object conforming to this [schema](), referred to |
There was a problem hiding this comment.
could've sworn I fixed that. Done.
| * The initial set of Accepted Root Certificates of the logs. | ||
| * Whether the logs will reject submissions for expired or revoked certificates. | ||
| * A description of any rate limiting policies applied to the logs. | ||
| logs by adding to their operator JSON a new publicly accessible JSON object |
There was a problem hiding this comment.
nit: "object, one per log, conforming..."
| logs by adding to their operator JSON a new publicly accessible JSON object | ||
| conforming to this [schema](log_schema_v4.json), referred to as a "log JSON". | ||
| The log JSON should contain all of the information about the new log that is being | ||
| added. |
There was a problem hiding this comment.
I think this last sentence can be dropped.
| possible, Chrome's requirements are equivalent between static-ct-api and RFC | ||
| 6962 logs, however, static-ct-api logs must not specify a MMD greater than 1 | ||
| minute. | ||
| minute and RFC 6962 logs must not specify a MMD greater than 1 hour. |
There was a problem hiding this comment.
I'm keen to make a change like this, but perhaps let's keep the PR narrowly scoped for now and omit this change.
(I also think moving to an MMD of 4 hours for 6962 logs may be necessary initially, but that'd still be a huge improvement over status quo.)
(If this wasn't intended as a policy change, the MMD for 6962 logs is traditionally 24 hours, and I'm happy to have it say 24 hours for now instead.)
There was a problem hiding this comment.
Switched to 4 hours as discussed.
| operator bug on the [Chromium Issue | ||
| Tracker](https://issues.chromium.org/issues?q=status:open%20componentid:1456813) | ||
| in which they requested log Inclusion. | ||
| Tracker](https://issues.chromium.org/issues?q=status:open%20componentid:1456813). |
There was a problem hiding this comment.
can we scope this obligation to just those logs not added via operator json? i.e. logs added before Nov 1, 2026?
I want to make sure no one thinks they have to update us manually each time they make a change to the json files.
There was a problem hiding this comment.
Explicitly excluded changes to JSON objects
| possible, Chrome's requirements are equivalent between static-ct-api and RFC | ||
| 6962 logs, however, static-ct-api logs must not specify a MMD greater than 1 | ||
| minute and RFC 6962 logs must not specify a MMD greater than 1 hour. | ||
| minute and RFC 6962 logs must not specify a MMD greater than 4 hour. |
2 participants
Policy updates to require CT operator-provided metadata in the form of one operator JSON object and multiple log objects.
Policy allows for more than one operator JSON object but at the discretion of the Chrome CT team and encourages this to be in the low single digits.