{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-29T01:09:39.613311Z",
  "record_id": "VXI-EXT-ICE05-SIGSTORE-BUNDLE-SINGLE-SIGNATURE-PROFILE-01-v1",
  "record_kind": "external_reference",
  "title": "Sigstore bundle DSSE single-signature profile",
  "system": "Sigstore",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a Sigstore bundle’s DSSE envelope establish a multi-signer quorum?",
  "near_questions": [
    "Can a Sigstore bundle contain quorum approval evidence?",
    "Does generic DSSE multi-signature support apply to Sigstore bundles?",
    "What signature count does the bundle profile permit?",
    "Which payload type is required by the Sigstore DSSE bundle profile?"
  ],
  "supported_claims": [
    {
      "claim": "The documented Sigstore bundle profile restricts its DSSE envelope to a single signature and an in-toto Statement payload type. Generic DSSE support for multiple signatures does not make a Sigstore bundle a threshold-approval proof.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Apply the specific bundle profile rather than generic DSSE possibilities. Obtain separate threshold-policy evidence before claiming multi-party approval.",
    "Buyer implementation, live runtime enforcement, settled payment, certification or permission to act are not established.",
    "No expanded capabilities or licences for existing INDEX executables."
  ],
  "public_summary": "The documented Sigstore bundle profile restricts its DSSE envelope to a single signature and an in-toto Statement payload type. Generic DSSE support for multiple signatures does not make a Sigstore bundle a threshold-approval proof.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Sigstore: Bundle specification",
    "source_url": "https://docs.sigstore.dev/about/bundle/",
    "checked_on": "2026-10-29",
    "candidate_record_id": "VXI-EXT-ICE05-SIGSTORE-BUNDLE-SINGLE-SIGNATURE-PROFILE-01-v1",
    "candidate_record_sha256": "e0cc3424ec468cfdc02fa06c4ab8aed1e88c43bd965ef13e73de3bb66c07b720",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The documented Sigstore bundle profile restricts its DSSE envelope to a single signature and an in-toto Statement payload type. Generic DSSE support for multiple signatures does not make a Sigstore bundle a threshold-approval proof.",
    "required_buyer_context": "Bundle media type/version; Envelope payload type; Signature count; Required approval policy. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-29",
    "claim_to_check": "Does a Sigstore bundle’s DSSE envelope establish a multi-signer quorum?",
    "documented_statement": {
      "status": "documented",
      "statement": "The documented Sigstore bundle profile restricts its DSSE envelope to a single signature and an in-toto Statement payload type. Generic DSSE support for multiple signatures does not make a Sigstore bundle a threshold-approval proof.",
      "source_ids": [
        "sigstore-bundle"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "Review sigstore bundle dsse single-signature profile before accepting the buyer claim. This decision separates the restrictive Sigstore serialization profile from generic DSSE signature-set handling; a collected bundle cannot silently inherit a quorum claim. This is a documentation-review judgment, not an observed deployment outcome.",
      "source_ids": [
        "sigstore-bundle"
      ]
    },
    "buyer_evidence_required": [
      "Bundle media type/version",
      "Envelope payload type",
      "Signature count",
      "Required approval policy"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Apply the specific bundle profile rather than generic DSSE possibilities. Obtain separate threshold-policy evidence before claiming multi-party approval."
    },
    "unknowns": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected."
    },
    "evidence_sources": [
      {
        "source_id": "sigstore-bundle",
        "url": "https://docs.sigstore.dev/about/bundle/",
        "final_url": "https://docs.sigstore.dev/about/bundle/",
        "captured_at_utc": "2026-10-29T00:50:20.783212+00:00",
        "status": 200,
        "content_type": "text/html; charset=UTF-8",
        "bytes": 71858,
        "sha256": "c603aafc93037854129c3c01efadde701c032ffc7dd4a53cd50e0d1ae2cf7ce7",
        "title": "Sigstore: Bundle specification",
        "hash_basis": "SHA-256 of captured HTTP response body bytes",
        "checked_on": "2026-10-29",
        "capture_status": 200,
        "claim_review_completed": true,
        "reviewed_sections": [
          "Message Signature",
          "DSSE"
        ],
        "version_context": "Sigstore bundle specification v0.3.2 as described by official documentation captured 2026-10-29; original response bytes and reviewed sections are pinned. Apply only the stated bundle profile.",
        "rights_review": "Original factual paraphrase and attributed source metadata only. Captured documentation and code remain private; no source prose, examples, images or vendor marks are redistributed. No licence to vendor software or buyer assurance is granted."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Source documentation supports only the stated boundary. Existing licensed checkers analyse supported supplied declarations; they do not query these providers, verify live systems, settle payments or certify compliance.",
    "paid_value": {
      "decision_context": "Review sigstore bundle dsse single-signature profile before accepting the buyer claim. This decision separates the restrictive Sigstore serialization profile from generic DSSE signature-set handling; a collected bundle cannot silently inherit a quorum claim.",
      "free": "Complete review, practical questions, source references and limitations; freely accessible and locally saveable.",
      "single_request": "Unavailable for this publication-only record; historical saved retrieval remains unchanged.",
      "evidence_receipt": "Unavailable for this publication-only record; no new paid retrieval entitlement.",
      "excluded": [
        "Fresh vendor research",
        "Live provider inspection",
        "Runtime enforcement or certification",
        "Expanded executable schemas or licences",
        "Native Coupa, Stripe Issuing, GitLab or Sigstore validation"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck the source and applicable API, account and configuration before current reliance. No monitoring or fresh research is included.",
      "specific_watch": "DSSE"
    },
    "buyer_relevance": "Review sigstore bundle dsse single-signature profile before accepting the buyer claim. This decision separates the restrictive Sigstore serialization profile from generic DSSE signature-set handling; a collected bundle cannot silently inherit a quorum claim.",
    "refusal_conditions": [
      "Apply the specific bundle profile rather than generic DSSE possibilities. Obtain separate threshold-policy evidence before claiming multi-party approval.",
      "Do not infer buyer deployment conformance or successful business outcomes from source documentation."
    ]
  },
  "niche": {
    "niche_id": "ice05-audit",
    "label": "Audit, Provenance & Evidence Accountability",
    "classification_id": "audit",
    "classification_label": "Audit, Provenance & Evidence Accountability",
    "topic_id": "audit",
    "buyer_intent": "Review sigstore bundle dsse single-signature profile before accepting the buyer claim. This decision separates the restrictive Sigstore serialization profile from generic DSSE signature-set handling; a collected bundle cannot silently inherit a quorum claim.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#sigstore-bundle-single-signature-profile",
  "machine_readable_record": "/varexis-index/records/sigstore-bundle-single-signature-profile.json"
}