Attestor Transparency Controls

Owner Surfaces

• Trust & Signing route: /setup/trust-signing/transparency
• Ops handoff route: /ops/operations/feeds-airgap?tab=airgap-bundles
• Backend APIs: /api/v1/transparency/* and /api/v1/attestations*

Operator Workflows

• Trust administrators create external Rekor-compatible targets with endpoint, trust-root reference, secret reference, required crypto profile, and operator label metadata.
• Connected sync starts as dry-run. Live sync requires explicit egress-window acknowledgement and is unavailable when Console offline mode is active.
• Manual exchange uses the same package mechanism as other air-gap workflows: create a signed schedule package, move it through controlled media, create a relay import package, validate it on the sealed site, then apply only after validation passes for the current package digest.
• Package file downloads decode backend contentBase64 into file bytes without modifying signed file contents. The browser never asks for private keys, bearer tokens, registry credentials, or external-log credentials.

Receipt Display Rules

• localTransparencyReceipt is shown as Local transparency receipt.
• externalMirrorReceipts[] are additive and use:
  • External mirror receipt
  • External mirror pending
  • External mirror failed
• Empty external receipts do not degrade local transparency success.
• Pending or failed external mirrors do not render as local transparency failures.

Verification

Focused tests cover:

• target list, target mutation routes, sync run route, manual exchange package routes, import validation, and attestation receipt route;
• Trust & Signing target table loaded/empty/disabled/failed states;
• live sync acknowledgement and offline-mode refusal;
• manual validate/apply separation, validate failure, apply failure, idempotent apply, and package file preservation;
• Ops air-gap handoff link into the Transparency tab.