The specification
The rules, the wire formats and the schemas are published, so a party who does not trust ZIFFER can check a receipt without asking us anything.
The decision rules and the wire formats ZIFFER implements are public, at github.com/ziffer-hq/ziffer-spec. They are published because a receipt nobody can check is a claim, and the people who have to trust the format are the ones who did not write it.
The licence
The ZIFFER Specification Licence. It lets you read the specification, copy and redistribute it verbatim with the licence and copyright attached, and implement it in software that produces, consumes or verifies ZIFFER artifacts for use with the ZIFFER service, or that verifies a receipt it issued.
Three things it does not let you do: distribute a modified version of it as a specification or a standard; use the ZIFFER name other than to state truthfully that your software interoperates with ZIFFER or conforms to a named version; or operate a service that performs the decision function it describes, which is grading proposals against signed policy and issuing receipts.
What the repository holds
- ZIFFER-SPEC-001: the decision rules, the encodings, and the executor's verification checklist.
- ZIFFER-DEPLOY-001: the trust domains, key custody, and the deployment profiles.
- The schemas: the policy bundle files and the wire messages. Every type in the product is generated from these, so a hand-written type cannot become a second definition of the same object.
- The conformance cases: the test cases of the specification, each named with the rule it exercises.
- PROVENANCE.json: every published file with its hash, and the engine commit the set was generated from.
- release-key.pub: the public key that signs every release of the
ziffercommand line tool, published apart from the releases it verifies.
The repository is generated and takes no pull requests. Findings go to hello@ziffer.io.
What you can check without us
A receipt, against the published format and the public key you hold. That is the point of publishing the format: the check needs the receipt, the proposal bytes you already hold, and the public half of the signing identity. It does not need an account, a network call, or our agreement.
ZIFFER is a registered trademark of code75 SASU.