I think the term "Endorser" is used too loosely throughout. For example, Section 2 says: “In pure RATS terms, an aggregator is still an Endorser or a Reference Value Provider - or, more likely, both.” Is an aggregator an "Endorser" or an "Endorsement Provider"? Given an endorsement is a "secure statement", referring to an aggregator as an "Endorser" does not seem right.

[thomas-fossati]

[thomas-fossati]

We expect the aggregator to sign the coserv object, thereby taking responsibility for any endorsements and reference values contained in the result. In other words, they are producing a "secure statement” about the attester's actual and expected state. So, at a high level, I don't think we're talking rubbish.

That said, there are effectively two slightly different cases:

1. The client doesn’t ask for source artefacts ("shallow trust”). In this case, the aggregator is the sole source of authority for the specific endorsements/reference values — it's a “pure" endorser in the client's eyes.
2. The client asks for source artefacts (“deep trust"). In this case, the client can independently verify the statement made by the aggregator against what the upstream endorser/reference value provider said. However, the aggregator is still trusted to provide complete and up-to-date source artefacts, so I don't think the aggregator's ability to produce “trusted & secure statements" about the attester's actual and expected state is significantly reduced to justify changing its label.

[paulhowardarm]

RFC9334 defines "Endorser" as follows:

A role performed by an entity (typically a manufacturer)
whose Endorsements may help Verifiers appraise the authenticity of
Evidence and infer further capabilities of the Attester.

So it's "typically" a manufacturer, but not necessarily.

CoSERV's interpretation of "Endorser" is "any conveyer of endorsements to the verifier", which is admittedly a broader interpretation, but I don't think it's out of line with RFC9334.

There isn't a term in RFC9334 for a component that mirrors or replicates things from upstream originators. So a CoSERV aggregator that mirrors endorsements from a manufacturer is still an "Endorser" from CoSERV's perspective.

In the latest security considerations, there's a subsection on aggregators, which tries to make it clear that the aggregator is not necessarily a direct trust authority for endorsements. That authority can be a separate entity (e.g. a cert root that is independent of the aggregator).

But CoSERV is also very generic and flexible. We're really trying to create a single API and conveyance language for any entity in the supply chain, including "primary" endorsers (that are indeed manufacturers and hence direct trust authorities for things like hardware).

[paulhowardarm]

@carl-wallace to review the RATS endorsements documentation and see whether there's any action still to take on this issue.