Description
There is currently ambiguity regarding when the Sigstore public good privacy statement should be presented to users and how that should be determined.
Currently, the following users are prompted:
- ALL keyless signers using the interactive OIDC authentication flow (see
internal/auth/auth.go), even if using non-public-good services.
- Signers who do not use a signing config (provided either from TUF or manually) and do not set
--tlog-upload=false (see the call to signcommon.ShouldUploadToTlog in sign and sign-blob).
Key-based signers using public-good services via a signing config are unprompted.
For the sake of consistency, this issue proposes either:
- removing the privacy statement, or
- prompting all signers using a public-good service.
Description
There is currently ambiguity regarding when the Sigstore public good privacy statement should be presented to users and how that should be determined.
Currently, the following users are prompted:
internal/auth/auth.go), even if using non-public-good services.--tlog-upload=false(see the call tosigncommon.ShouldUploadToTloginsignandsign-blob).ko.SigningConfig.Key-based signers using public-good services via a signing config are unprompted.
For the sake of consistency, this issue proposes either: