Connector signer metadata (v1.0.0)

Scope. Defines the canonical, offline-friendly metadata for Excititor connectors that validate signed feeds (MSRC CSAF, Oracle OVAL, Ubuntu OVAL, StellaOps mirror OpenVEX). The file is consumed by WebService/Worker composition roots and by Offline Kits to pin trust material deterministically.

Location & format.

• Schema: docs/modules/excititor/schemas/connector-signer-metadata.schema.json (JSON Schema 2020‑12).
• Sample: docs/modules/excititor/samples/connector-signer-metadata-sample.json (aligns with schema).
• Expected production artifact: NDJSON or JSON stamped per release; store in offline kits alongside connector bundles.

Required fields (summary)

• schemaVersion — must be 1.0.0.
• generatedAt — ISO-8601 UTC timestamp for the metadata file.
• connectors[] — one entry per connector:
  • connectorId — stable slug, e.g., excititor-msrc-csaf.
  • provider { name, slug } — human label and slug.
  • issuerTier — tier-0, tier-1, tier-2, or untrusted (aligns with trust weighting).
  • signers[] — one per signing path; each has usage (csaf|oval|openvex|bulk-meta|attestation) and fingerprints[] (algorithm + format + value). Optional keyLocator and certificateChain for offline key retrieval.
  • bundle — reference to the sealed bundle containing the feed/signing material (kind: oci-referrer|oci-tag|file|tuf, plus uri, optional digest, publishedAt).
  • Optional validFrom, validTo, revoked, notes for rollover and incident handling.

Rollover / migration guidance

1. Author the metadata using the schema and place the JSON next to connector bundles in the offline kit (out/connectors/<provider>/signer-metadata.json).
2. Validate with dotnet tool run njsonschema validate connector-signer-metadata.schema.json connector-signer-metadata.json (or ajv validate).
3. Wire connector code to load the file on startup (Worker + WebService) and pin signers per connectorId; reject feeds whose fingerprints are absent or marked revoked=true or out of validFrom/To range.
   • Connectors look for STELLAOPS_CONNECTOR_SIGNER_METADATA_PATH (absolute/relative) and enrich provenance metadata automatically when present.
4. Rollover keys by appending a new signers entry and setting a future validFrom; keep the previous signer until all mirrors have caught up. Use issuerTier downgrades to quarantine while keeping history.
5. Mirror references: store the referenced bundles/keys under OCI tags or TUF targets already shipped in the offline kit so no live network is required.
6. Record decisions in sprint Decisions & Risks when changing trust tiers or fingerpints; update this doc if formats change.

Sample entries (non-production)

See docs/modules/excititor/samples/connector-signer-metadata-sample.json for MSRC, Oracle, Ubuntu, and StellaOps example entries. These fingerprints are illustrative only; replace with real values before shipping.

Consumer expectations

• Deterministic: sort connectors alphabetically before persistence; avoid clock-based defaults.
• Offline-first: all keyLocator/bundle.uri values must resolve inside the air-gap kit (OCI/TUF/file).
• Observability: emit a structured warning when metadata is missing or stale (>7 days) and fail closed for missing signers.