# Releases and the log

No enclave build gets keys until it's signed by two of three release keys and has been public in the transparency log for its waiting period.

Source: https://seal.zone/docs/releases

Every enclave and key guardian build passes this gate before it gets keys. A bad build is still possible, but only in public.

## The gate

### Built reproducibly from a commit

Anyone who builds the same [public commit](https://github.com/sealzone/seal) gets the same [fingerprint](https://seal.zone/docs/attestation#the-fingerprint).

### Signed by two of three release keys

One person with one key can't ship anything.

### Published in the transparency log

The log at `log.seal.zone` can only be added to, so a release can't be quietly removed or edited.

### Countersigned by witnesses

Two of three witnesses countersign the log, so it can't show you a different history. Their timestamps are the clock for the next step.

### Public for the whole waiting period

Seal can't fake the clock to shorten it.

Your SDK checks the same gate on every connection.

Seal upgrades the replica it runs for you. Yours move when you run `seal deploy upgrade`.

## The transparency page

The [transparency page](https://seal.zone/transparency) checks the log in your browser. It shows the latest checkpoint, the rules in force, every release and the keys it checks against.

It can't prove a fingerprint came from its commit. Rebuild to check that.

## Rules in force

Every key guardian and SDK applies these rules from the log:

- Firmware floors per chip family
- Revoked releases
- Revoked release keys
- Minimum enclave key versions

Witnesses refuse a log whose rules loosen, so nobody, Seal included, can undo one.

## Co-signing releases yourself

Turn on co-signing on the Admins page. A new release then gets your tenant's keys only after your admins approve it:

```shell
seal release approve <fingerprint> --key-file admin.key
```

Repeat `--key-file` to meet your threshold. Until then, that release can't serve you. Turning it off is widening, so it waits out your [pending window](https://seal.zone/docs/changes#the-pending-window).

**Preview values.**

The waiting period is 5 minutes, the three witnesses run inside the log's process from one seed, and the release keys are a preview set. So today the countersignatures are Seal vouching for itself. All three change before launch.