# Trust root for SBOM attestation verification (attestation spec sections 5
# and 8), consumed both by `bompage build --allowed-signers` (see
# .gitlab-ci.yml) and by `bompage verify` / `ssh-keygen -Y verify` for anyone
# checking a downloaded SBOM (see docs/verify.md in the bompage package repo).
#
# Format: one line per trusted key, OpenSSH `allowed_signers`:
#   <principal> namespaces="<ns1>,<ns2>" <key-type> <base64-key>
#
# This project fixes the push principal to `bompage-push` and the same key
# signs both attestations (namespace sbom.bompage) and commits (namespace
# git), so a real entry looks like:
#
#   bompage-push namespaces="sbom.bompage,git" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...
#
# Bootstrap:
#   1. ssh-keygen -q -t ed25519 -N '' -C bompage-push -f bompage-push
#   2. Add the line above with the contents of bompage-push.pub.
#   3. Store the PRIVATE key (bompage-push, no extension) as a masked,
#      protected CI/CD variable named exactly BOMPAGE_SIGN_KEY, in every
#      source pipeline that should sign its pushes -- never commit it.
#      `bompage push` (the `bompage-push` job of the
#      gitlab.com/op_so/components/pages/bompage component) reads that
#      variable from the environment on its own; no extra wiring needed.
#
# This file is the REAL trust root -- unlike its read-only copy the published
# site may serve for convenience, it lives in the central repository and is
# protected purely operationally, by no cryptographic mechanism of its own
# (attestation spec section 5.1): protect this branch, require an MR for any
# change under trust/, and list trust/ in CODEOWNERS. See deploy/README.md.
#
# Left empty (no key line below), every attestation verifies as `unknown`
# instead of `ok` -- signing stays entirely optional; the build never fails
# because of it.
