Container Registry and Software Supply Chain Platform  ·  View 20 of 33  ·  4 · Runtime

Air-Gapped Verification

An enforcement point with the artifact, its evidence and the trust roots decides without calling the platform.

Editable source SVG draw.io All views
Edge kube-apiserver Edge Admission Controller Local Registry Offline Evidence Bundle Offline Trust Store 1. AdmissionReview · Pod 2. resolve locally 3. sha256:9f3c… 4. attestations for digest 5. DSSE + Rekor SET 6. trust roots 7. Fulcio root + log key 8. verify chain offline 9. verify inclusion proof 10. check revocation list age 11. DENY: roots over 30 d 12. ALLOW · offline path Air-Gapped Verification — Deciding Without the Platform No call leaves the site. Verification needs the artifact, its evidence, the inclusion proof and the trust roots. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • Verification is offline-capable by design: the artifact, its signature, the inclusion proof and the trust roots are sufficient
  • The Rekor signed entry timestamp is verified against a cached log key, so the transparency log need not be reachable
  • Trust roots are valid for 30 days offline; past that the site denies rather than trusting stale roots

Why this constrains question 3

  • Keyless certificates make offline verification harder, not impossible — the chain still verifies against a cached Fulcio root
  • The air-gapped release path uses a long-lived HSM key precisely because certificate freshness cannot be checked there
  • Superseded trust roots stay verifiable for the 7-year attestation retention period

Risks

  • Revocation propagation to an air-gapped site is bounded by the transport interval, not by the 5-minute target
  • The revocation list age is checked and denied on, which converts a silent trust failure into a visible one
◀  Advisory-Driven Re-Evaluation All views Promotion, Demotion and Retention  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises20-offline-verification-sequence