Archer trust root

Archer signs its Evidence with short-lived certificates from its own Fulcio, timestamps them with its own timestamp authority, and logs every certificate in its public CT log. Verify Evidence against this trusted root.

• trusted_root.json: the root, the Fulcio and timestamp authority chains, and the CT log's key, for sigstore-go or cosign
• trusted_root.json.sig: the root key's signature over it (ECDSA P-384, SHA-384, base64)
• root.pem: the root certificate

Verify before you trust it

The root certificate's SHA-256 fingerprint:

1F:37:03:C1:62:80:E5:76:CE:83:9A:3B:C2:5C:02:E5:30:DE:58:1D:87:6B:D5:DD:39:9B:54:C3:8F:10:93:81

Compare it with one you obtained another way, such as the Archer repository's deploy/sigstore/public/root.pem. Then check the signature:

curl -sO https://trust.archerci.dev/root.pem
curl -sO https://trust.archerci.dev/trusted_root.json
curl -sO https://trust.archerci.dev/trusted_root.json.sig
openssl x509 -in root.pem -noout -fingerprint -sha256
openssl x509 -in root.pem -pubkey -noout > root.pub
openssl base64 -d -in trusted_root.json.sig -out trusted_root.json.der
openssl dgst -sha384 -verify root.pub -signature trusted_root.json.der trusted_root.json

The last command prints Verified OK. Archer's Evidence is signed by https://kubernetes.io/namespaces/archer/serviceaccounts/archer, with the issuer https://kubernetes.default.svc.cluster.local.