diff --git a/RELEASING.md b/RELEASING.md index 406219e..cf2a706 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -214,10 +214,10 @@ passing evidence record for each target. The frozen Chat production source `edd4728792321771496df58bfc0e6122908a96ec` is exercised by the compatible schema-v2 producer at -`c4332b07969966fbf1d5fbfb0ea7231b896a8fc6`. Its source lock was pinned by -reachable authority commit `a76137207d44db7ac83e0e19f07ec6913fb62230` +`ada542f731ea1b65dd4e6de94ab7dc28b0551740`. Its source lock was pinned by +reachable authority commit `25b3bc6883954aff21d2108f49aa7be6a08ccef0` to executable harness behavior revision -`d4a5df371af271aa5d9d030d27c3820c92d76128`. +`50ad59966d9ebdae3a97459bc21670e461bd6dd9`. Its protected workflow requires an exact SDK `validator_revision`, uses protected environment ID `20863036831`, validates the three static platform artifacts in diff --git a/conformance/client-v1-cross-repository-lock.json b/conformance/client-v1-cross-repository-lock.json index e782b2c..050eec9 100644 --- a/conformance/client-v1-cross-repository-lock.json +++ b/conformance/client-v1-cross-repository-lock.json @@ -165,8 +165,8 @@ "evidenceProducer": { "status": "compatible", "repository": "OpenCoven/chat", - "commit": "c4332b07969966fbf1d5fbfb0ea7231b896a8fc6", - "tree": "49d85359d73f00a3dad46c31187b0cb8f096ff6f", + "commit": "ada542f731ea1b65dd4e6de94ab7dc28b0551740", + "tree": "975de93ac84b0436d381f5e427627f98aaa3dd0a", "packageManifest": { "path": "package.json", "size": 4044, @@ -175,8 +175,8 @@ "harness": { "path": "scripts/phase1-conformance.mjs", "version": "2.0.0", - "size": 199227, - "sha256": "fc232db10c270ec92fcd700ad44e213c04abee01492c9804f82643b4513b2199" + "size": 199944, + "sha256": "67ba91257a71c36c7d91ef01796c5a348d106e40b4a6f1ef59fde6980a5ba584" }, "command": "test:phase1-conformance", "recordSchemaVersion": 2, @@ -184,7 +184,7 @@ "name": "client-v1 conformance", "path": ".github/workflows/client-v1-conformance.yml", "size": 463033, - "sha256": "6f1a362be64f1bb0a6bac5980ac4acb87af7fed525a33d55ace9d111b9238fe3", + "sha256": "e76c4361fb94c0b9525680f2aac176ca377174665b0323b5aefaf219fa452d02", "job": "platform-conformance", "jobNameTemplate": "platform-conformance ({platform})", "aggregationJob": "aggregate-conformance", @@ -219,11 +219,11 @@ ], "downloadArtifactAction": "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c", "attestationAction": "actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8", - "windowsBootstrapScriptSha256": "3af26f8e6ad32e6cf667f211ccd3b70372e80bfb5fa98507067c5e005890e88b", + "windowsBootstrapScriptSha256": "d9572f970962a3eb24e0fa307b65578a7722eda902b59af8b268b03d83537a43", "validatorRevisionScriptSha256": "9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9", "phase1RevisionsScriptSha256": "507ce777b643d97154472eb23135f7965fd55cf0fcedcec30e93b23e6472d225", "linuxKeyringSetupScriptSha256": "7b1ff87ab5d2230950632560230899cc450458a800a630c2788b53be8b13d200", - "unixSupervisorPreparationScriptSha256": "f12db533b2734b1c69559bc665cb4b9c763789ccec14e86761d69e398e0222e7", + "unixSupervisorPreparationScriptSha256": "019a8570d1d16ab896a56a08b446978f0e9d8ddd7daee274e3f1747a56192b5e", "unixToolPathSource": { "path": "scripts/executable-resolution.mjs", "size": 9154, @@ -249,8 +249,8 @@ ] }, "signerWorkflow": "OpenCoven/chat/.github/workflows/client-v1-conformance.yml", - "signerDigest": "c4332b07969966fbf1d5fbfb0ea7231b896a8fc6", - "sourceDigest": "c4332b07969966fbf1d5fbfb0ea7231b896a8fc6", + "signerDigest": "ada542f731ea1b65dd4e6de94ab7dc28b0551740", + "sourceDigest": "ada542f731ea1b65dd4e6de94ab7dc28b0551740", "predicateType": "https://slsa.dev/provenance/v1", "denySelfHostedRunners": true } diff --git a/docs/workflows/client-v1-cross-repository-conformance.md b/docs/workflows/client-v1-cross-repository-conformance.md index 49e8889..2dfb2d8 100644 --- a/docs/workflows/client-v1-cross-repository-conformance.md +++ b/docs/workflows/client-v1-cross-repository-conformance.md @@ -28,10 +28,10 @@ There is no passing aggregate in this repository yet. The frozen Chat production source remains `edd4728792321771496df58bfc0e6122908a96ec`; the compatible evidence producer is the pinned `refs/heads/main` commit -`c4332b07969966fbf1d5fbfb0ea7231b896a8fc6`. Its source lock was pinned by -reachable authority commit `a76137207d44db7ac83e0e19f07ec6913fb62230` +`ada542f731ea1b65dd4e6de94ab7dc28b0551740`. Its source lock was pinned by +reachable authority commit `25b3bc6883954aff21d2108f49aa7be6a08ccef0` to executable harness behavior revision -`d4a5df371af271aa5d9d030d27c3820c92d76128`. +`50ad59966d9ebdae3a97459bc21670e461bd6dd9`. The frozen workflow separates platform production, exact SDK validation, provenance attestation, and aggregation. Its lock records the validation and attestation job identities, the three static artifact names and record paths, @@ -275,7 +275,7 @@ aggregation job has no permissions and can only confirm successful completion of the protected matrix; it cannot generate, upload, attest, or replace a platform record. This structural template is exercised synthetically in tests only. The committed lock marks the reachable Chat producer at -`c4332b07969966fbf1d5fbfb0ea7231b896a8fc6` compatible with the reviewed +`ada542f731ea1b65dd4e6de94ab7dc28b0551740` compatible with the reviewed schema-v2 workflow bytes. Release readiness remains blocked until this SDK validator merges, `CLIENT_V1_CONFORMANCE_VALIDATOR_REVISION` is rotated to the merged revision, and all three protected platform records and their GitHub diff --git a/scripts/github-conformance-evidence.mjs b/scripts/github-conformance-evidence.mjs index 6c103de..c7b5da6 100644 --- a/scripts/github-conformance-evidence.mjs +++ b/scripts/github-conformance-evidence.mjs @@ -45,11 +45,11 @@ const WINDOWS_SUPERVISOR_ARTIFACT = 'phase1-process-supervisor-win32-x64'; const WINDOWS_SUPERVISOR_JOB_NAME = 'build-windows-supervisor'; const WINDOWS_SUPERVISOR_RUNNER_LABELS = ['macos-latest']; const REVIEWED_WINDOWS_BOOTSTRAP_SCRIPT_SHA256 = - '3af26f8e6ad32e6cf667f211ccd3b70372e80bfb5fa98507067c5e005890e88b'; + 'd9572f970962a3eb24e0fa307b65578a7722eda902b59af8b268b03d83537a43'; const REVIEWED_WINDOWS_CHILD_BOOTSTRAP_SHA256 = - 'ed93898f4cdfafa16a63053d1abb48bd55de3654efa0a1999bfb977a45e9ba5f'; + '67f01cab92aef55dac0c07bf9e9aa68f3402379fc58854bb8ab5cdced22d6db9'; const REVIEWED_UNIX_SUPERVISOR_PREPARATION_SCRIPT_SHA256 = - 'f12db533b2734b1c69559bc665cb4b9c763789ccec14e86761d69e398e0222e7'; + '019a8570d1d16ab896a56a08b446978f0e9d8ddd7daee274e3f1747a56192b5e'; const REVIEWED_UNIX_PRODUCTION_SCRIPT_SHA256 = '043066be50d0c3fa66f7151224242734cb2e9f39ffa9cf1c6f8106ab88c75a02'; const REVIEWED_UNIX_SUPERVISOR_SOURCE_BINDING = diff --git a/tests/conformance-contract.spec.ts b/tests/conformance-contract.spec.ts index 3387c28..c0dc87d 100644 --- a/tests/conformance-contract.spec.ts +++ b/tests/conformance-contract.spec.ts @@ -215,13 +215,13 @@ describe('cross-repository conformance contract entrypoints', () => { 'utf8', ); expect(workflowDocument).toContain( - 'c4332b07969966fbf1d5fbfb0ea7231b896a8fc6', + 'ada542f731ea1b65dd4e6de94ab7dc28b0551740', ); expect(workflowDocument).toContain( - 'a76137207d44db7ac83e0e19f07ec6913fb62230', + '25b3bc6883954aff21d2108f49aa7be6a08ccef0', ); expect(workflowDocument).toContain( - 'd4a5df371af271aa5d9d030d27c3820c92d76128', + '50ad59966d9ebdae3a97459bc21670e461bd6dd9', ); expect(workflowDocument).toContain('validator_revision'); expect(workflowDocument).toContain('20863036831'); diff --git a/tests/conformance-gaps.spec.ts b/tests/conformance-gaps.spec.ts index d6c1b20..e3d8617 100644 --- a/tests/conformance-gaps.spec.ts +++ b/tests/conformance-gaps.spec.ts @@ -52,15 +52,15 @@ const schemaPath = resolve( ); const windowsBootstrapFixturePath = resolve( workspaceRoot, - 'tests/fixtures/chat-c4332b-windows-bootstrap.ps1.br', + 'tests/fixtures/chat-ada542-windows-bootstrap.ps1.br', ); const protectedWorkflowFixturePath = resolve( workspaceRoot, - 'tests/fixtures/chat-c4332b-client-v1-conformance.yml.br', + 'tests/fixtures/chat-ada542-client-v1-conformance.yml.br', ); const unixSupervisorPreparationFixturePath = resolve( workspaceRoot, - 'tests/fixtures/chat-c4332b-unix-supervisor-preparation.sh.br', + 'tests/fixtures/chat-ada542-unix-supervisor-preparation.sh.br', ); const windowsSupervisorTestFixturePath = resolve( workspaceRoot, @@ -1744,8 +1744,8 @@ describe('unresolved SDK #38 conformance gaps', () => { expect(lock.evidenceProducer).toEqual({ status: 'compatible', repository: 'OpenCoven/chat', - commit: 'c4332b07969966fbf1d5fbfb0ea7231b896a8fc6', - tree: '49d85359d73f00a3dad46c31187b0cb8f096ff6f', + commit: 'ada542f731ea1b65dd4e6de94ab7dc28b0551740', + tree: '975de93ac84b0436d381f5e427627f98aaa3dd0a', packageManifest: { path: 'package.json', size: 4_044, @@ -1755,9 +1755,9 @@ describe('unresolved SDK #38 conformance gaps', () => { harness: { path: 'scripts/phase1-conformance.mjs', version: '2.0.0', - size: 199_227, + size: 199_944, sha256: - 'fc232db10c270ec92fcd700ad44e213c04abee01492c9804f82643b4513b2199', + '67ba91257a71c36c7d91ef01796c5a348d106e40b4a6f1ef59fde6980a5ba584', }, command: 'test:phase1-conformance', recordSchemaVersion: 2, @@ -1766,7 +1766,7 @@ describe('unresolved SDK #38 conformance gaps', () => { path: '.github/workflows/client-v1-conformance.yml', size: 463_033, sha256: - '6f1a362be64f1bb0a6bac5980ac4acb87af7fed525a33d55ace9d111b9238fe3', + 'e76c4361fb94c0b9525680f2aac176ca377174665b0323b5aefaf219fa452d02', job: 'platform-conformance', jobNameTemplate: 'platform-conformance ({platform})', aggregationJob: 'aggregate-conformance', @@ -1785,7 +1785,7 @@ describe('unresolved SDK #38 conformance gaps', () => { downloadArtifactAction: DOWNLOAD_ARTIFACT_ACTION, attestationAction: ATTEST_BUILD_PROVENANCE_ACTION, windowsBootstrapScriptSha256: - '3af26f8e6ad32e6cf667f211ccd3b70372e80bfb5fa98507067c5e005890e88b', + 'd9572f970962a3eb24e0fa307b65578a7722eda902b59af8b268b03d83537a43', validatorRevisionScriptSha256: '9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9', phase1RevisionsScriptSha256: @@ -1793,7 +1793,7 @@ describe('unresolved SDK #38 conformance gaps', () => { linuxKeyringSetupScriptSha256: '7b1ff87ab5d2230950632560230899cc450458a800a630c2788b53be8b13d200', unixSupervisorPreparationScriptSha256: - 'f12db533b2734b1c69559bc665cb4b9c763789ccec14e86761d69e398e0222e7', + '019a8570d1d16ab896a56a08b446978f0e9d8ddd7daee274e3f1747a56192b5e', unixToolPathSource: { path: 'scripts/executable-resolution.mjs', size: 9_154, @@ -1822,8 +1822,8 @@ describe('unresolved SDK #38 conformance gaps', () => { }, signerWorkflow: 'OpenCoven/chat/.github/workflows/client-v1-conformance.yml', - signerDigest: 'c4332b07969966fbf1d5fbfb0ea7231b896a8fc6', - sourceDigest: 'c4332b07969966fbf1d5fbfb0ea7231b896a8fc6', + signerDigest: 'ada542f731ea1b65dd4e6de94ab7dc28b0551740', + sourceDigest: 'ada542f731ea1b65dd4e6de94ab7dc28b0551740', predicateType: 'https://slsa.dev/provenance/v1', denySelfHostedRunners: true, }, @@ -1851,7 +1851,7 @@ describe('unresolved SDK #38 conformance gaps', () => { producer.workflow.windowsBootstrapScriptSha256, ); expect(sha256(TEST_WINDOWS_CHILD_BOOTSTRAP)).toBe( - 'ed93898f4cdfafa16a63053d1abb48bd55de3654efa0a1999bfb977a45e9ba5f', + '67f01cab92aef55dac0c07bf9e9aa68f3402379fc58854bb8ab5cdced22d6db9', ); expect(() => verifyProtectedWorkflow( diff --git a/tests/fixtures/chat-ada542-client-v1-conformance.yml.br b/tests/fixtures/chat-ada542-client-v1-conformance.yml.br new file mode 100644 index 0000000..b03c892 Binary files /dev/null and b/tests/fixtures/chat-ada542-client-v1-conformance.yml.br differ diff --git a/tests/fixtures/chat-ada542-unix-supervisor-preparation.sh.br b/tests/fixtures/chat-ada542-unix-supervisor-preparation.sh.br new file mode 100644 index 0000000..7ff93f1 Binary files /dev/null and b/tests/fixtures/chat-ada542-unix-supervisor-preparation.sh.br differ diff --git a/tests/fixtures/chat-ada542-windows-bootstrap.ps1.br b/tests/fixtures/chat-ada542-windows-bootstrap.ps1.br new file mode 100644 index 0000000..eaf9fd0 Binary files /dev/null and b/tests/fixtures/chat-ada542-windows-bootstrap.ps1.br differ diff --git a/tests/fixtures/chat-c4332b-client-v1-conformance.yml.br b/tests/fixtures/chat-c4332b-client-v1-conformance.yml.br deleted file mode 100644 index 4827696..0000000 Binary files a/tests/fixtures/chat-c4332b-client-v1-conformance.yml.br and /dev/null differ diff --git a/tests/fixtures/chat-c4332b-unix-supervisor-preparation.sh.br b/tests/fixtures/chat-c4332b-unix-supervisor-preparation.sh.br deleted file mode 100644 index 24c6ba9..0000000 Binary files a/tests/fixtures/chat-c4332b-unix-supervisor-preparation.sh.br and /dev/null differ diff --git a/tests/fixtures/chat-c4332b-windows-bootstrap.ps1.br b/tests/fixtures/chat-c4332b-windows-bootstrap.ps1.br deleted file mode 100644 index 05aaf77..0000000 Binary files a/tests/fixtures/chat-c4332b-windows-bootstrap.ps1.br and /dev/null differ