PR edited

Author: stefan-wenig

docs/_data/changelog.yml

@@ -10,19 +10,19 @@
       version: 1.203.0
       breaking_changes:
         - text: |
-            SignService charts: Moved Application Insights connection string from `appSecrets.signService.applicationInsights.connectionString` to `appSecrets.shared.applicationInsights.connectionString`.
+            SignService charts: moved Application Insights connection string from `appSecrets.signService.applicationInsights.connectionString` to `appSecrets.shared.applicationInsights.connectionString`.
           issues: [SIGN-7578]
 - date: '2025-12-16'
   updates:
     application:
       version: 1.202.0
       breaking_changes:
         - text: |
-            Improved naming of "verify origin policy" on signing policy objects.
-            * Changed in REST API the property `verifyOrigin` to `verifyOriginPolicy` and `originVerification` to `originPolicyVerification` in the following routes:
+            REST API: improved naming of "verify origin policy" on signing policy objects.
+            * Changed the property `verifyOrigin` to `verifyOriginPolicy` and `originVerification` to `originPolicyVerification` in the following API routes:
               * `POST /v1/{organizationId}/Projects/{projectSlug}/SigningPolicies`
               * `POST /v1/{organizationId}/Projects/{projectSlug}/SigningPolicies/{signingPolicySlug}`
-            * Changed in REST API the property `verifiesOrigin` to `verifiesOriginPolicy` in the following routes:
+            * Changed the property `verifiesOrigin` to `verifiesOriginPolicy` in the following API routes:
               * `GET /v1/{organizationId}/Projects/{slug}`
               * `GET /v1/{organizationId}/Projects/{projectSlug}/SigningPolicies/{signingPolicySlug}`
           issues: [SIGN-8033, SIGN-8259]
@@ -32,24 +32,24 @@
           issues: [SIGN-8134, SIGN-8162]
       improvements:
         - text: |
-            ???
+            Artifact download permissions based on global roles: only some global roles are now eligible (used to be all explicit global roles). See [documentation](/users#permissions).
           issues: [SIGN-8171]
         - text: |
-            Improved the history view on the organization details page (added a few missing fields).
+            Improved the history view on the organization details page (missing fields added).
           issues: [SIGN-8172]
     self_hosted_installations:
       version: 1.202.0
       upgrade_information:
         - text: |-
-            All Windows containers switched from Windows Server 2019 to 2022 base images. Before starting the upgrade, ensure that your Kubernetes cluster has ready Windows Server 2022 worker nodes available.
+            All Windows containers switched from Windows Server 2019 to Server 2022 base images. Before starting the upgrade, ensure that your Kubernetes cluster has Windows Server 2022 worker nodes available and ready.
           issues: [SIGN-8113]
 - date: '2025-12-02'
   updates:
     application:
       version: 1.201.4
       new_features:
         - text: |-
-            Added support for the "DSSE (Dead Simple Signing Envelope)" signing format via [`<dsse-sign>`](/artifact-configuration/reference#dsse-sign).
+            Added support for [DSSE (Dead Simple Signing Envelope) signatures][`<dsse-sign>`](/artifact-configuration/reference#dsse-sign).
           issues: [SIGN-8132]
       bug_fixes:
         - text: |-
@@ -59,7 +59,7 @@
       version: 1.201.4
       improvements:
         - text: |-
-            Improved SignService reliability on temporary database outages.
+            Improved SignService reliability during temporary database outages.
           issues: [SIGN-8164]
 - date: '2025-11-27'
   updates:

docs/artifact-configuration/reference.md

@@ -200,12 +200,11 @@ Add the `-verbose` option to see the certificate.
 
 {%- include_relative render-ac-directive-table.inc directive="rpm-sign" -%}
 
-RPM is a versatile package management format used in many Linux distributions like Fedora, RedHat, or openSUSE. RPM files embed GPG signatures and therefore is only available for [signing policies](/projects#signing-policies) with a [GPG key](/managing-certificates#certificate-types) certificate.
+RPM is the package manager format for many Linux distributions including Fedora, RedHat, and openSUSE. RPM is based on GPG signatures and requires [signing policies](/projects#signing-policies) with a [GPG key](/managing-certificates#certificate-types) certificate.
 
 ##### Example
 
 ~~~ xml
-<?xml version="1.0" encoding="utf-8" ?>
 <artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
   <rpm-file>
     <rpm-sign />
@@ -215,9 +214,9 @@ RPM is a versatile package management format used in many Linux distributions li
 
 ##### Verification {#rpm-sign-verification}
 
-RPM package verification usually happens "under the hood" via package managers like [`dnf`](https://dnf.readthedocs.io/).
+Package verification is typically performed automatically by package management tools like yum and DNF.
 
-To manually verify `.rpm` files, use the following commands.
+To manually verify `.rpm` files, use the following commands:
 
 ~~~ bash
 rpm --import my_key.asc # Import, i.e. trust, the GPG public key

docs/users.md

@@ -154,7 +154,7 @@ Read permissions:
 * All users can view configuration information and metadata
 * Access to artifacts is restricted to users with read permissions for the signing request
 * Users have read permissions for a Signing Request if they have
-  * an appropriate global role: *Administrator*, *Global Reader*
+  * an appropriate global role: *Global Administrator*, *Project Administrator*, *Global Reader*, *Support User*
   * a role for the Project: *Reader*, *Configurator*
   * a role for the Signing Policy: *Submitter*, *Approver*