Clairified that a DSSE envelope in a sigstore bundle MUST have exactl…

…y one signature (#318)

* Clairified that a DSSE envelope in a sigstore bundle MUST have exactly
one signature.

* Fixed a spelling error caught during review

gen/jsonschema/schemas/Bundle.schema.json

@@ -20,7 +20,7 @@
                 "dsseEnvelope": {
                     "$ref": "#/definitions/io.intoto.Envelope",
                     "additionalProperties": false,
-                    "description": "A DSSE envelope can contain arbitrary payloads. Verifiers must verify that the payload type is a supported and expected type. This is part of the DSSE protocol which is defined here: \u003chttps://github.com/secure-systems-lab/dsse/blob/master/protocol.md\u003e"
+                    "description": "A DSSE envelope can contain arbitrary payloads. Verifiers must verify that the payload type is a supported and expected type. This is part of the DSSE protocol which is defined here: \u003chttps://github.com/secure-systems-lab/dsse/blob/master/protocol.md\u003e DSSE envelopes in a bundle MUST have exactly one signture. This is a limitation from the DSSE spec, as it can contain multiple signatures. There are two primary reasons: 1. It simplfies the verification logic and policy 2. The bundle (currently) can only contain a single    instance of the required verification materials During verification a client MUST reject an envelope if the number of signatures is not equal to one."
                 }
             },
             "additionalProperties": false,

gen/jsonschema/schemas/Input.schema.json

@@ -53,7 +53,7 @@
                 "dsseEnvelope": {
                     "$ref": "#/definitions/io.intoto.Envelope",
                     "additionalProperties": false,
-                    "description": "A DSSE envelope can contain arbitrary payloads. Verifiers must verify that the payload type is a supported and expected type. This is part of the DSSE protocol which is defined here: \u003chttps://github.com/secure-systems-lab/dsse/blob/master/protocol.md\u003e"
+                    "description": "A DSSE envelope can contain arbitrary payloads. Verifiers must verify that the payload type is a supported and expected type. This is part of the DSSE protocol which is defined here: \u003chttps://github.com/secure-systems-lab/dsse/blob/master/protocol.md\u003e DSSE envelopes in a bundle MUST have exactly one signture. This is a limitation from the DSSE spec, as it can contain multiple signatures. There are two primary reasons: 1. It simplfies the verification logic and policy 2. The bundle (currently) can only contain a single    instance of the required verification materials During verification a client MUST reject an envelope if the number of signatures is not equal to one."
                 }
             },
             "additionalProperties": false,

gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.bundle.v1.rs

@@ -190,6 +190,14 @@ pub mod bundle {
         /// supported and expected type. This is part of the DSSE
         /// protocol which is defined here:
         /// <<https://github.com/secure-systems-lab/dsse/blob/master/protocol.md>>
+        /// DSSE envelopes in a bundle MUST have exactly one signture.
+        /// This is a limitation from the DSSE spec, as it can contain
+        /// multiple signatures. There are two primary reasons:
+        /// 1. It simplfies the verification logic and policy
+        /// 2. The bundle (currently) can only contain a single
+        ///     instance of the required verification materials
+        /// During verification a client MUST reject an envelope if
+        /// the number of signatures is not equal to one.
         #[prost(message, tag = "4")]
         DsseEnvelope(super::super::super::super::super::io::intoto::Envelope),
     }

protos/sigstore_bundle.proto

@@ -134,6 +134,14 @@ message Bundle {
                 // supported and expected type. This is part of the DSSE
                 // protocol which is defined here:
                 // <https://github.com/secure-systems-lab/dsse/blob/master/protocol.md>
+                // DSSE envelopes in a bundle MUST have exactly one signture.
+                // This is a limitation from the DSSE spec, as it can contain
+                // multiple signatures. There are two primary reasons:
+                // 1. It simplfies the verification logic and policy
+                // 2. The bundle (currently) can only contain a single
+                //    instance of the required verification materials
+                // During verification a client MUST reject an envelope if
+                // the number of signatures is not equal to one.
                 io.intoto.Envelope dsse_envelope = 4 [(google.api.field_behavior) = REQUIRED];
         }
         // Reserved for future additions of artifact types.