Skip to main content
The canonical-card transparency log ships on a thin Postgres backend in v1. The row shape is intentionally Sigstore Rekor-compatible so the future migration to Rekor is a data move, not a schema rewrite. This page is forward-looking — it documents the migration plan so consumers can build against the v1 surface confident that the wire shape won’t break when the move happens. The migration itself is deferred to post-V1-GA.

​
Why migrate

The thin Postgres log is sufficient for Mnemom’s V1 scale (≤ 10K canonical recomposes per day). Sigstore Rekor brings:
  • Decoupling — the log lives outside Mnemom’s infrastructure; a Mnemom compromise can’t silently rewrite it.
  • Industry standard — Rekor is the Linux Foundation Sigstore project’s canonical transparency log. Consumers already trust it for software supply-chain attestations.
  • Community tooling — rekor-cli, cosign, and the Sigstore client libraries become first-class verification paths alongside mnemom verify-card.

​
Column mapping

​
Entry kind

Rekor entries use a kind discriminator. The closest fit for an AAP attestation is DSSE (Dead Simple Signing Envelope, SLSA spec). The DSSE wrapper around the JWS looks like:
Rekor’s dsse entry kind accepts this shape directly.

​
Migration steps (post-V1-GA)

  1. Stand up the Rekor instance. Choose between the public Sigstore instance or self-hosted. The public instance has no SLA; self-hosted gives Mnemom + customers operational control.
  2. Replay historic rows. Walk card_attestations in log_index ASC order; wrap each signed_attestation in a DSSE envelope; POST to /api/v1/log/entries. Rekor assigns its own LogIndex — store the mapping in a new rekor_index column on card_attestations.
  3. Dual-write window. For some number of weeks, every new compose-hook append writes both to Postgres + Rekor. Smoke-test that the two roots stay aligned.
  4. Cutover read paths. GET /v1/transparency/log/{id}/... starts returning the Rekor inclusion proof alongside (or instead of) the Postgres-derived proof. mnemom verify-card learns the --rekor flag for explicit Rekor-only verification.
  5. Retire the Postgres tree-build. Once Rekor reads are stable, drop the in-process Merkle reconstruction. The card_attestations Postgres table stays as a hot cache + a defense-in-depth ledger; Rekor becomes the authoritative source.

​
Consumer impact

The wire format of the attestation token itself does not change. Consumers verifying just the JWS continue to work; consumers wanting full transparency-log proofs gain an optional second source.

​
Timeline

Deferred to post-V1-GA. Until that migration ships, the Postgres log + S3-with-object-lock backup is the authoritative public log. The v1 schema documented at mnemom-contracts/transparency-log/v1.yaml is stable.

​
See also