# Trust root for SBOM attestation verification (attestation spec sections 5
# and 8), consumed both by `bompage build --allowed-signers` (see
# .gitlab-ci.yml) and by `bompage verify` / `ssh-keygen -Y verify` for anyone
# checking a downloaded SBOM (see docs/verify.md in the bompage package repo).
#
# Format: one line per trusted key, OpenSSH `allowed_signers`:
#   <principal> namespaces="<ns1>,<ns2>" <key-type> <base64-key>
#
# This project fixes the push principal to `bompage-push` and the same key
# signs both attestations (namespace sbom.bompage) and commits (namespace
# git), so a real entry looks like:
#
#   bompage-push namespaces="sbom.bompage,git" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...
#
# Bootstrap:
#   1. ssh-keygen -q -t ed25519 -N '' -C bompage-push -f bompage-push
#   2. Add the line above with the contents of bompage-push.pub.
#   3. Store the PRIVATE key (bompage-push, no extension) as a masked,
#      protected CI/CD variable (e.g. BOMPAGE_SIGN_KEY) -- never commit it.
#   4. Wire that variable name into push-report.yml's `bompage_sign_key_var`
#      input from every source pipeline.
#
# This file is the REAL trust root -- unlike its read-only copy the published
# site may serve for convenience, it lives in the central repository and is
# protected purely operationally, by no cryptographic mechanism of its own
# (attestation spec section 5.1): protect this branch, require an MR for any
# change under trust/, and list trust/ in CODEOWNERS. See deploy/README.md.
#
# Left empty (no key line below), every attestation verifies as `unknown`
# instead of `ok` -- signing stays entirely optional; the build never fails
# because of it.
