Attestation of definition validity

[matejcik]

I would like to start a discussion about how the above should like, i.e., what is a way for different parties to attest that they have reviewed a definition to be valid, and how to convey that trust to others.

One thing I would love to see is an ability for the smart contract author to attach their signature, in a way verifiable against the contract itself. Something something, the private key that signs the contract would also sign the definition?
Note that I know very little about how EVMs sign smart contracts, so someone else would need to fill out the details here.

As a first idea, I'm thinking a json file alongside the definition, for somecontract.json, have somecontract.sig.json that is a collection of "signature information" for somecontract.json.

Each "signature information" entry would have:

• required: algorithm specifier ("minisign", "gpg", "ethereum", ...?) It's not great to allow multiple different algorithms, but we should be good as long as we don't allow "null" right? :)
• required: signer cryptographic identity (typically a public key, but possibly also a contract address or something)
• required: digest being signed (of the "strict" version of the json) + signature of that digest
• optional: signer name
• optional: source of the public key (e.g. an URL on their own domain, as a semi-weak proof of identity of the key)
• optional: git commit of the file being signed (so that we can look at history, what has changed since the signature was produced)
• optional: url of the definition, possibly in a git repository (so that the .sig can be distributed independently?)
• optional: trust level (what trust levels would make sense?)

[jnicoulaud-ledger]

It does not cover all your points, but since Git/Github is used as the repository we could leverage it:

• commits are GPG signed
• we can produce build provenance attestations

It is then possible for a consumer to verify a descriptor has been produced on this repository, and furthermore by a specific entity identified by their GPG key.