Authorities registry

Who publishes public records. A short list, on purpose.

Anyone can write internal CIR records. Public ones carry an issuer code that must be registered here, so a reader always knows who stands behind CIR-2026-0CERTFR-0001.

The registry

2 registered

Code Authority Signing key Contact

00 CIR ProjectRoot authority, default issuer for public recordsCIR-YYYY-00-NNNN no signing key none listed

0MLAB mlabVulnerabilities and threat intelligence published by mlab.shCIR-YYYY-0MLAB-NNNN 0151 539C E287 4816 6DD7 FEA4 7CE6 A877 BE61 E06Fexpires 2028-10-120MLAB.asc [email protected]

Code	Authority	Signing key	Contact
`00`	CIR ProjectRoot authority, default issuer for public records`CIR-YYYY-00-NNNN`	no signing key	none listed
`0MLAB`	mlabVulnerabilities and threat intelligence published by mlab.sh`CIR-YYYY-0MLAB-NNNN`	`0151 539C E287 4816 6DD7 FEA4 7CE6 A877 BE61 E06F`expires 2028-10-120MLAB.asc	[email protected]
Public key of 0MLAB `-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEas53TBYJKwYBBAHaRw8BAQdAI2zUW7bBDMNAnAy7bvo7Swf4D6OmhZEbX6yC Oiu1dwW0Im1sYWIgQ0lSIGF1dGhvcml0eSA8aGVsbG9AbWxhYi5zaD6ItQQTFgoA XRYhBAFRU5zih0gWbdf+pHzmqHe+YeBvBQJqzndMGxSAAAAAAAQADm1hbnUyLDIu NSsxLjEyLDAsMwIbAwUJA8JnAAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAK CRB85qh3vmHgb6z1AP9DE1pyAMe4GiwPe/3CT5ba9rIBOHZZCqKbce0lpD7+nwD/ SUe4PUDOo4RC7TzImaV6XoTVF4OkW5JC9vxe8SEjFwA= =5n3l -----END PGP PUBLIC KEY BLOCK-----`

Public key of 0MLAB

Rendered from authorities.yml, the file validators read, on every deploy. Each authority signs its public records with the OpenPGP key listed here; the fingerprint shown is checked against the key itself before the page is published.

Public or internal, decided by one character

Starts with 0: Public record. The code must be in the registry; validators reject one that is not. There is no separate "public" field: the code says it.
00: The root authority, the CIR project itself, and the default issuer for public records.
Signing key: Every other authority publishes the OpenPGP key it signs its records with: fingerprint, armored public key and, if it expires, its expiration date. Rotating or extending a key goes through a pull request too.
Anything else: Internal record, e.g. LAB, SNOW, P01. Managed freely by the organization, no registration, not globally unique.

Getting a code

Pick a code. 0 followed by 1 to 7 uppercase letters or digits, short and recognizable: 0CERTFR, not 0X7.
Publish your signing key. The OpenPGP key your public records will be signed with: its 40-character fingerprint, the armored public key, and key_expires if it has an expiration date. Both must match the key exactly.
Open a pull request on cirsec/spec that adds your entry to authorities.yml.
Review by the maintainers. Once merged, validators accept your public records and your entry appears on this page.

# authorities.yml
authorities:
  - code: "00"
    name: "CIR Project"
    contact: ""
    scope: "Root authority, default issuer for public records"
  # your entry
  - code: "0EXAMPLE"
    name: "Example CERT"
    contact: "[email protected]"
    scope: "Advisories for the example sector"
    fingerprint: "40 uppercase hex characters, no spaces"
    key_expires: "2028-10-12"
    public_key: |
      -----BEGIN PGP PUBLIC KEY BLOCK-----
      …
      -----END PGP PUBLIC KEY BLOCK-----