{"id":18402433,"url":"https://github.com/filosottile/sunlight","last_synced_at":"2025-04-05T07:03:01.377Z","repository":{"id":214811200,"uuid":"737347651","full_name":"FiloSottile/sunlight","owner":"FiloSottile","description":"A Certificate Transparency log implementation and monitoring API designed for scalability, ease of operation, and reduced cost.","archived":false,"fork":false,"pushed_at":"2025-03-21T12:10:33.000Z","size":537,"stargazers_count":138,"open_issues_count":4,"forks_count":9,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-03-29T06:02:35.728Z","etag":null,"topics":["certificate-transparency","tlog"],"latest_commit_sha":null,"homepage":"https://sunlight.dev","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"isc","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/FiloSottile.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"custom":"https://filippo.io/maintenance#funding"}},"created_at":"2023-12-30T17:47:57.000Z","updated_at":"2025-03-28T02:30:17.000Z","dependencies_parsed_at":null,"dependency_job_id":"164403f3-e73b-4614-a3b6-3583ab42562d","html_url":"https://github.com/FiloSottile/sunlight","commit_stats":null,"previous_names":["filosottile/sunlight"],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FiloSottile%2Fsunlight","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FiloSottile%2Fsunlight/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FiloSottile%2Fsunlight/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FiloSottile%2Fsunlight/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/FiloSottile","download_url":"https://codeload.github.com/FiloSottile/sunlight/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247299831,"owners_count":20916190,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certificate-transparency","tlog"],"created_at":"2024-11-06T02:42:29.257Z","updated_at":"2025-04-05T07:03:01.351Z","avatar_url":"https://github.com/FiloSottile.png","language":"Go","funding_links":["https://filippo.io/maintenance#funding"],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n    \u003cpicture\u003e\n        \u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://github.com/C2SP/C2SP/assets/1225294/0cd04af2-e84d-4f48-b42e-ed430354e563\"\u003e\n        \u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://github.com/C2SP/C2SP/assets/1225294/0f239db0-7100-4bba-8608-bd4dc4134409\"\u003e\n        \u003cimg alt=\"The Sunlight logo, a bench under a tree in stylized black ink, cast against a large yellow sun, with the text Sunlight underneath\" width=\"250\" src=\"https://github.com/C2SP/C2SP/assets/1225294/0f239db0-7100-4bba-8608-bd4dc4134409\"\u003e\n    \u003c/picture\u003e\n\u003c/p\u003e\n\nSunlight is a Certificate Transparency log implementation and monitoring API\ndesigned for scalability, ease of operation, and reduced cost.\n\nAdditional resources, including test logs, a formal specification of the\nmonitoring API, and a comprehensive design document which explores the\nmotivating tradeoffs are available at [sunlight.dev](https://sunlight.dev).\n\nSunlight is based on the original Certificate Transparency design, on the Go\nChecksum Database developed with Russ Cox, and on the feedback of many\nindividuals in the WebPKI community, and in particular of the Sigsum, Google\nTrustFabric, and ISRG teams. Sunlight's development was sponsored by Let's\nEncrypt.\n\n## Operating a Sunlight log\n\nA Sunlight instance is a single Go process, serving one or more CT logs,\nconfigured with a YAML file. Config options are documented in detail [on the\nConfig struct][Config].\n\n[Config]: https://github.com/search?q=repo%3AFiloSottile%2Fsunlight+symbol%3AConfig+path%3Acmd%2Fsunlight\u0026type=code\n\nThere are three data storage locations with different properties involved in\noperating a Sunlight instance:\n\n  * A global \"lock backend\" which provides a compare-and-swap primitive, where only\n    the signed tree head of each log is stored, to prevent accidental operational\n    mistakes such as running two Sunlight instances against the same\n    configuration from causing a fatal log split.\n\n    This backend will always store trivial amounts of data, but it's important\n    that a single global table/bucket/location is used.\n\n    Currently, DynamoDB, Tigris (S3-like API with ETag support), and local\n    SQLite are supported.\n\n  * A per-log object store bucket, where the public tiles, checkpoints, and\n    issuers are uploaded. Monitors can fetch the tree contents directly\n    from these buckets.\n\n    You should account for between 5GB and 10GB per million certificates, or\n    between 5TB and 10TB for a six months shard at current (~75/s) submission\n    rates.\n\n    We recommend enabling S3 Object Versioning (see\n    [#11](https://github.com/FiloSottile/sunlight/issues/11)) or overwriting\n    protection (automatically enabled client-side on Tigris).\n\n    Currently, S3 and S3-compatible APIs are supported.\n\n  * A per-log deduplication cache, to return existing SCTs for previously\n    submitted (pre-)certificates.\n\n    Note that this can be a best-effort lookup, and it's ok to rollback a few\n    entries on a regular basis, or even lose the cache in an emergency. The only\n    consequence is that existing entries might be resubmitted, growing the size\n    of the log.\n\n    You should account for approximately 50MB per million certificates, or\n    approximately 50GB for a six months shard at current (~75/s) submission\n    rates.\n\n    This is a local SQLite database, and it's designed to be backed up with\n    Litestream.\n\nPrometheus metrics are exposed *publicly* at `/metrics`. Logs are written to\nstderr in human-readable format, and to stdout in JSON format.\n\nA private HTTP debug server is also started on a random port on localhost. It\nserves the net/http/pprof endpoints, as well as `/debug/logson` and\n`/debug/logsoff` which enable and disable debug logging, respectively.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffilosottile%2Fsunlight","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffilosottile%2Fsunlight","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffilosottile%2Fsunlight/lists"}