@kungfu-tech/buildchain 3.0.2-alpha.0 → 3.0.2-alpha.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -2
- package/actions/github-artifact-attestation/README.md +10 -0
- package/actions/promote-buildchain-ref/README.md +7 -0
- package/bin/buildchain.mjs +5 -0
- package/bin/internal/trust-release-cli.mjs +74 -3
- package/contracts/auditable-demo-media-profiles-v1.json +168 -0
- package/contracts/evidence/auditable-demo-web-delivery-v1.json +103 -0
- package/contracts/fixtures/auditable-demo-web-delivery-v1/complete-transcript.txt +2 -0
- package/contracts/fixtures/auditable-demo-web-delivery-v1/public-projection.json +16 -0
- package/contracts/fixtures/auditable-demo-web-delivery-v1/scene.json +12 -0
- package/dist/site/artifact-schemas.json +5 -1
- package/dist/site/buildchain-contract.json +133 -34
- package/dist/site/buildchain-site.json +159 -40
- package/dist/site/capability-registry.json +14 -13
- package/dist/site/cli-registry.json +12 -0
- package/dist/site/controller-registry.json +72 -4
- package/dist/site/kfd-claims.json +338 -20
- package/dist/site/kfd-upstream-aggregate.json +1 -1
- package/dist/site/manual-registry.json +24 -9
- package/dist/site/node-api-registry.json +89 -11
- package/dist/site/page-registry.json +135 -25
- package/dist/site/public-surface-audit.json +203 -21
- package/dist/site/publication-authority-registry.json +72 -2
- package/dist/site/publication-registry.json +4 -4
- package/dist/site/release-model.json +2 -1
- package/dist/site/release-passport-check-manifest.json +1 -0
- package/dist/site/release-provenance.json +6 -0
- package/dist/site/schemas/release-passport-v1.schema.json +6 -0
- package/dist/site/site-manifest.json +21 -13
- package/dist/site/workflow-registry.json +167 -13
- package/docs/MAP.md +5 -1
- package/docs/auditable-demo.md +55 -3
- package/docs/binary-distribution.md +7 -0
- package/docs/cli.md +9 -0
- package/docs/dev-alpha-candidate-patrol.md +111 -0
- package/docs/github-artifact-attestation.md +219 -0
- package/docs/release-governance.md +32 -0
- package/docs/release-passport.md +13 -0
- package/docs/reusable-build-surface.md +83 -61
- package/docs/runtime-train-validation.md +21 -0
- package/docs/versioning.md +1 -0
- package/package.json +8 -1
- package/packages/core/artifact-signing-result.js +228 -0
- package/packages/core/artifact-signing.js +412 -0
- package/packages/core/buildchain-config.js +58 -0
- package/packages/core/buildchain-contract.js +14 -0
- package/packages/core/buildchain-kfd-claims.js +5 -0
- package/packages/core/buildchain-publication-authority.js +3 -0
- package/packages/core/cache-evidence.js +288 -0
- package/packages/core/channel-candidate.js +186 -0
- package/packages/core/detached-artifact-signature.js +121 -0
- package/packages/core/diagnostics.js +276 -10
- package/packages/core/github-artifact-attestation.js +642 -0
- package/packages/core/github-governance-authority.js +77 -16
- package/packages/core/index.js +62 -0
- package/packages/core/publication-authority.js +1 -1
- package/packages/core/release-passport-contract.js +2 -0
- package/packages/core/release-passport.js +60 -3
- package/scripts/auditable-demo.mjs +520 -28
- package/scripts/build-contract-core.mjs +31 -0
- package/scripts/buildchain-channel-router.mjs +8 -2
- package/scripts/check-inventory.mjs +9 -0
- package/scripts/create-github-artifact-attestation-policy.mjs +62 -0
- package/scripts/dev-alpha-candidate-patrol.mjs +864 -0
- package/scripts/dispatch-artifact-signing-authority.mjs +152 -0
- package/scripts/finalize-native-artifact-signing-result.mjs +96 -0
- package/scripts/generate-channel-promotion-workflow.mjs +6 -0
- package/scripts/generate-site-bundle.mjs +20 -0
- package/scripts/import-artifact-signing-results.mjs +76 -0
- package/scripts/inspect-artifact-signing-requests.mjs +101 -0
- package/scripts/locked-source-checkout.mjs +48 -0
- package/scripts/materialize-artifact-signing-request.mjs +66 -0
- package/scripts/merge-artifact-signing-results.mjs +76 -0
- package/scripts/publish-github-artifact-attestation-evidence.mjs +201 -0
- package/scripts/reconcile-github-governance.mjs +158 -25
- package/scripts/release-candidate-resolver.mjs +12 -0
- package/scripts/release-line-policy.mjs +27 -0
- package/scripts/runtime-ref-core.mjs +10 -6
- package/scripts/seal-artifact-signing-requests.mjs +368 -0
- package/scripts/shifu-gate-profile.mjs +26 -20
- package/scripts/sign-detached-artifact-requests.mjs +237 -0
- package/scripts/stage-github-artifact-attestation-inputs.mjs +65 -0
- package/scripts/verify-artifact-signing-results.mjs +99 -0
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
"product": {
|
|
5
5
|
"name": "Buildchain",
|
|
6
6
|
"package": "@kungfu-tech/buildchain",
|
|
7
|
-
"version": "3.0.2-alpha.
|
|
7
|
+
"version": "3.0.2-alpha.10",
|
|
8
8
|
"repository": "https://github.com/kungfu-systems/buildchain"
|
|
9
9
|
},
|
|
10
10
|
"majorLine": "v3",
|
|
@@ -34,6 +34,8 @@
|
|
|
34
34
|
"runner-preset",
|
|
35
35
|
"platforms-json",
|
|
36
36
|
"release-candidate",
|
|
37
|
+
"github-artifact-attestation-subject-path",
|
|
38
|
+
"github-artifact-attestation-platform-id",
|
|
37
39
|
"artifact-transfer-mode",
|
|
38
40
|
"checkout-cache-mode",
|
|
39
41
|
"checkout-cache-fallback",
|
|
@@ -50,7 +52,7 @@
|
|
|
50
52
|
"retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
|
|
51
53
|
],
|
|
52
54
|
"breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
|
|
53
|
-
"auditDigest": "sha256:
|
|
55
|
+
"auditDigest": "sha256:5ada21e27d49afb2718bb687fa3dc17ffd1042665f3c00c18935ca4e46584fae"
|
|
54
56
|
},
|
|
55
57
|
{
|
|
56
58
|
"contractVersion": 1,
|
|
@@ -89,7 +91,7 @@
|
|
|
89
91
|
"alpha and stable channel selections use separate consumer contract locks by default"
|
|
90
92
|
],
|
|
91
93
|
"breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
|
|
92
|
-
"auditDigest": "sha256:
|
|
94
|
+
"auditDigest": "sha256:6f7a097f70558ddff5867e3aaf6be0a0a56eb1838232eebe3ec6e7d071591746"
|
|
93
95
|
},
|
|
94
96
|
{
|
|
95
97
|
"contractVersion": 1,
|
|
@@ -129,6 +131,9 @@
|
|
|
129
131
|
"release-passport-kfd-3-artifact-verify-command",
|
|
130
132
|
"release-passport-invariant-passport-jsons",
|
|
131
133
|
"release-passport-invariant-passport-command",
|
|
134
|
+
"github-artifact-attestation-policy-json",
|
|
135
|
+
"github-artifact-attestation-environment",
|
|
136
|
+
"github-artifact-attestation-retention-days",
|
|
132
137
|
"buildchain-contract-lock-path",
|
|
133
138
|
"buildchain-contract-drift-issue-mode",
|
|
134
139
|
"github-release",
|
|
@@ -170,7 +175,7 @@
|
|
|
170
175
|
"GitHub Release passport and evidence publication is delegated to promote-buildchain-ref after the semver release transaction completes"
|
|
171
176
|
],
|
|
172
177
|
"breakingDigest": "sha256:acd401cfc46450115a3763fd4b679d85f185e8757ebd52510d6262e1533df4cf",
|
|
173
|
-
"auditDigest": "sha256:
|
|
178
|
+
"auditDigest": "sha256:68f3ad7a1d880a26be48263d9d1d12c38ff89beb08e4f744509b1ca196a889c9"
|
|
174
179
|
},
|
|
175
180
|
{
|
|
176
181
|
"contractVersion": 1,
|
|
@@ -212,7 +217,7 @@
|
|
|
212
217
|
"promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
|
|
213
218
|
],
|
|
214
219
|
"breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
|
|
215
|
-
"auditDigest": "sha256:
|
|
220
|
+
"auditDigest": "sha256:54bf2db92237cad97da1dc740780330e6175b97352523db732c8650560f1a9fd"
|
|
216
221
|
},
|
|
217
222
|
{
|
|
218
223
|
"contractVersion": 1,
|
|
@@ -283,11 +288,14 @@
|
|
|
283
288
|
"media-artifact-id",
|
|
284
289
|
"media-artifact-digest",
|
|
285
290
|
"media-artifact-url",
|
|
286
|
-
"media-root"
|
|
291
|
+
"media-root",
|
|
292
|
+
"media-profile",
|
|
293
|
+
"media-qualification-root"
|
|
287
294
|
],
|
|
288
295
|
"breakingDefaults": {
|
|
289
296
|
"trustedEventRequired": true,
|
|
290
297
|
"renderMediaDefault": false,
|
|
298
|
+
"mediaProfileDefault": "archive-v1",
|
|
291
299
|
"artifactRetentionDaysDefault": 14,
|
|
292
300
|
"gatePolicy": "required-before-selective-render"
|
|
293
301
|
},
|
|
@@ -295,6 +303,7 @@
|
|
|
295
303
|
"buildchain-repository",
|
|
296
304
|
"source-ref",
|
|
297
305
|
"render-media",
|
|
306
|
+
"media-profile",
|
|
298
307
|
"artifact-retention-days",
|
|
299
308
|
"require-trusted-event"
|
|
300
309
|
],
|
|
@@ -303,10 +312,14 @@
|
|
|
303
312
|
"the checked-in consumer adapter runs from the exact consumer source with a disposable home and reduced environment",
|
|
304
313
|
"every invocation runs an immutable network-disabled renderer smoke before emitting a qualified Gate bundle",
|
|
305
314
|
"complete media rendering is optional and consumes only an exact passing Gate bundle",
|
|
306
|
-
"Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots"
|
|
307
|
-
|
|
308
|
-
|
|
309
|
-
|
|
315
|
+
"Gate and media bundles expose both GitHub Artifact archive coordinates and deterministic member roots",
|
|
316
|
+
"explicit web-delivery profiles independently verify codec, container, audio, dimensions, duration, byte budgets, rendition roles, and MP4 fast-start evidence",
|
|
317
|
+
"media receipts expose content-addressed rendition facts without requiring consumers to infer roles from filenames",
|
|
318
|
+
"Build Images owns encoding, Buildchain owns qualification and receipts, and site repositories own browser loading and accessibility behavior",
|
|
319
|
+
"media qualification does not claim browser playback, responsive layout, reduced-motion behavior, accessibility, or production deployment"
|
|
320
|
+
],
|
|
321
|
+
"breakingDigest": "sha256:425f8d3d1ba205dd6fe35a20f1dc6dad7d7c563872283e3af79fea4d5c475692",
|
|
322
|
+
"auditDigest": "sha256:d043897d3d2bd242a83a362fccac408b4bd38e1e2fb50e7cae6a2145a6c0bd51"
|
|
310
323
|
},
|
|
311
324
|
{
|
|
312
325
|
"contractVersion": 1,
|
|
@@ -340,6 +353,7 @@
|
|
|
340
353
|
"release-passport-kfd-3-artifact-verify-command",
|
|
341
354
|
"release-passport-invariant-passport-jsons",
|
|
342
355
|
"release-passport-invariant-passport-command",
|
|
356
|
+
"release-passport-github-artifact-attestation-policy-jsons",
|
|
343
357
|
"github-release",
|
|
344
358
|
"github-release-title",
|
|
345
359
|
"github-release-notes"
|
|
@@ -377,7 +391,7 @@
|
|
|
377
391
|
"sha256:a59f0910e6df842e7699139472e5dd69ac2fdd7f7213bf2cb346d1d622556874"
|
|
378
392
|
],
|
|
379
393
|
"breakingDigest": "sha256:6147c0a8d5c36bfaa6021871574e1fc28192a3f1b8cfdae4d24ef3059ac1ebda",
|
|
380
|
-
"auditDigest": "sha256:
|
|
394
|
+
"auditDigest": "sha256:d1a4803f908b87c66ab6e9a5dca935366192fbda0bd6c23d784c9e037afb89be"
|
|
381
395
|
},
|
|
382
396
|
{
|
|
383
397
|
"contractVersion": 1,
|
|
@@ -492,7 +506,7 @@
|
|
|
492
506
|
"release-state SHA is recorded as a durable audit entrance"
|
|
493
507
|
],
|
|
494
508
|
"breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
|
|
495
|
-
"auditDigest": "sha256:
|
|
509
|
+
"auditDigest": "sha256:aad90c2b39ce3fd7d2d4df5833f388c3090f5eeaecfd97d03276d375eed9459b"
|
|
496
510
|
},
|
|
497
511
|
{
|
|
498
512
|
"contractVersion": 1,
|
|
@@ -541,7 +555,7 @@
|
|
|
541
555
|
"prose-only public claims downgrade the release trust passport audit"
|
|
542
556
|
],
|
|
543
557
|
"breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
|
|
544
|
-
"auditDigest": "sha256:
|
|
558
|
+
"auditDigest": "sha256:aad90c2b39ce3fd7d2d4df5833f388c3090f5eeaecfd97d03276d375eed9459b"
|
|
545
559
|
},
|
|
546
560
|
{
|
|
547
561
|
"contractVersion": 1,
|
|
@@ -601,7 +615,7 @@
|
|
|
601
615
|
"README badge block checks and writes are generated from machine-readable repository facts"
|
|
602
616
|
],
|
|
603
617
|
"breakingDigest": "sha256:90a73892b2d6c214048448d5f45df75639bdf7b7e8fefd9c596e04b087407bcc",
|
|
604
|
-
"auditDigest": "sha256:
|
|
618
|
+
"auditDigest": "sha256:4afc2879c3ede97d4123ec2536209b57ecb077f658a09f748e5ae088b1c92bc8"
|
|
605
619
|
},
|
|
606
620
|
{
|
|
607
621
|
"contractVersion": 1,
|
|
@@ -691,7 +705,7 @@
|
|
|
691
705
|
"manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
|
|
692
706
|
],
|
|
693
707
|
"breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
|
|
694
|
-
"auditDigest": "sha256:
|
|
708
|
+
"auditDigest": "sha256:63522fa4397a62566c0f24de10d0fd91bf040c98410b5ccd1cdcf4b4d4756549"
|
|
695
709
|
},
|
|
696
710
|
{
|
|
697
711
|
"contractVersion": 1,
|
|
@@ -713,7 +727,7 @@
|
|
|
713
727
|
"agents can discover supported Node APIs without importing internal file paths"
|
|
714
728
|
],
|
|
715
729
|
"breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
|
|
716
|
-
"auditDigest": "sha256:
|
|
730
|
+
"auditDigest": "sha256:4d201b7021ab28d7999f6ce88b4aacae5eb57e187d220e10a1e3e5ae5544a7d8"
|
|
717
731
|
},
|
|
718
732
|
{
|
|
719
733
|
"contractVersion": 1,
|
|
@@ -764,7 +778,7 @@
|
|
|
764
778
|
"controllerDescriptor": {
|
|
765
779
|
"contract": "buildchain.controller-descriptor/v1",
|
|
766
780
|
"digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
|
|
767
|
-
"registryDigest": "sha256:
|
|
781
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
768
782
|
"inputClassifications": {
|
|
769
783
|
"buildchain-ref": {
|
|
770
784
|
"classification": "included",
|
|
@@ -854,6 +868,7 @@
|
|
|
854
868
|
"BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
|
|
855
869
|
"BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
|
|
856
870
|
"BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
|
|
871
|
+
"BUILDCHAIN_PROMOTION_TOKEN",
|
|
857
872
|
"artifact-name",
|
|
858
873
|
"artifact-name-template",
|
|
859
874
|
"artifact-paths",
|
|
@@ -872,6 +887,9 @@
|
|
|
872
887
|
"buildchain-contract-lock-path",
|
|
873
888
|
"buildchain-ref",
|
|
874
889
|
"buildchain-repository",
|
|
890
|
+
"cache-dependency-lock-root",
|
|
891
|
+
"cache-policy-root",
|
|
892
|
+
"cache-toolchain-root",
|
|
875
893
|
"cargo-registry-index",
|
|
876
894
|
"checkout-cache-fallback",
|
|
877
895
|
"checkout-cache-fetch-attempts",
|
|
@@ -888,6 +906,9 @@
|
|
|
888
906
|
"expected-artifacts-json",
|
|
889
907
|
"fail-fast",
|
|
890
908
|
"gate-profile-aggregate-json",
|
|
909
|
+
"github-artifact-attestation-platform-id",
|
|
910
|
+
"github-artifact-attestation-signer-sha",
|
|
911
|
+
"github-artifact-attestation-subject-path",
|
|
891
912
|
"install-command",
|
|
892
913
|
"kfd-agent-hub",
|
|
893
914
|
"lifecycle-timeout-minutes",
|
|
@@ -923,8 +944,8 @@
|
|
|
923
944
|
],
|
|
924
945
|
"controllerDescriptor": {
|
|
925
946
|
"contract": "buildchain.controller-descriptor/v1",
|
|
926
|
-
"digest": "sha256:
|
|
927
|
-
"registryDigest": "sha256:
|
|
947
|
+
"digest": "sha256:146718143cc50e48ac57154aade4a4b06a8df4e036708a150233098d3c1cb6f7",
|
|
948
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
928
949
|
"inputClassifications": {
|
|
929
950
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
|
|
930
951
|
"classification": "redacted",
|
|
@@ -958,6 +979,10 @@
|
|
|
958
979
|
"classification": "redacted",
|
|
959
980
|
"source": "workflow-call-secret"
|
|
960
981
|
},
|
|
982
|
+
"BUILDCHAIN_PROMOTION_TOKEN": {
|
|
983
|
+
"classification": "redacted",
|
|
984
|
+
"source": "workflow-call-secret"
|
|
985
|
+
},
|
|
961
986
|
"artifact-name": {
|
|
962
987
|
"classification": "included",
|
|
963
988
|
"source": "workflow-call-input"
|
|
@@ -1030,6 +1055,18 @@
|
|
|
1030
1055
|
"classification": "included",
|
|
1031
1056
|
"source": "workflow-call-input"
|
|
1032
1057
|
},
|
|
1058
|
+
"cache-dependency-lock-root": {
|
|
1059
|
+
"classification": "included",
|
|
1060
|
+
"source": "workflow-call-input"
|
|
1061
|
+
},
|
|
1062
|
+
"cache-policy-root": {
|
|
1063
|
+
"classification": "included",
|
|
1064
|
+
"source": "workflow-call-input"
|
|
1065
|
+
},
|
|
1066
|
+
"cache-toolchain-root": {
|
|
1067
|
+
"classification": "included",
|
|
1068
|
+
"source": "workflow-call-input"
|
|
1069
|
+
},
|
|
1033
1070
|
"cargo-registry-index": {
|
|
1034
1071
|
"classification": "digest-only",
|
|
1035
1072
|
"source": "workflow-call-input"
|
|
@@ -1094,6 +1131,18 @@
|
|
|
1094
1131
|
"classification": "digest-only",
|
|
1095
1132
|
"source": "workflow-call-input"
|
|
1096
1133
|
},
|
|
1134
|
+
"github-artifact-attestation-platform-id": {
|
|
1135
|
+
"classification": "included",
|
|
1136
|
+
"source": "workflow-call-input"
|
|
1137
|
+
},
|
|
1138
|
+
"github-artifact-attestation-signer-sha": {
|
|
1139
|
+
"classification": "included",
|
|
1140
|
+
"source": "workflow-call-input"
|
|
1141
|
+
},
|
|
1142
|
+
"github-artifact-attestation-subject-path": {
|
|
1143
|
+
"classification": "digest-only",
|
|
1144
|
+
"source": "workflow-call-input"
|
|
1145
|
+
},
|
|
1097
1146
|
"install-command": {
|
|
1098
1147
|
"classification": "digest-only",
|
|
1099
1148
|
"source": "workflow-call-input"
|
|
@@ -1234,7 +1283,7 @@
|
|
|
1234
1283
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
1235
1284
|
],
|
|
1236
1285
|
"breakingDigest": "sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1",
|
|
1237
|
-
"auditDigest": "sha256:
|
|
1286
|
+
"auditDigest": "sha256:5ada21e27d49afb2718bb687fa3dc17ffd1042665f3c00c18935ca4e46584fae"
|
|
1238
1287
|
},
|
|
1239
1288
|
{
|
|
1240
1289
|
"contractVersion": 1,
|
|
@@ -1280,6 +1329,7 @@
|
|
|
1280
1329
|
"BUILDCHAIN_MACOS_NOTARY_API_ISSUER",
|
|
1281
1330
|
"BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
|
|
1282
1331
|
"BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
|
|
1332
|
+
"BUILDCHAIN_PROMOTION_TOKEN",
|
|
1283
1333
|
"artifact-name",
|
|
1284
1334
|
"artifact-name-template",
|
|
1285
1335
|
"artifact-paths",
|
|
@@ -1301,6 +1351,9 @@
|
|
|
1301
1351
|
"buildchain-ref",
|
|
1302
1352
|
"buildchain-repository",
|
|
1303
1353
|
"buildchain-stable-contract-lock-path",
|
|
1354
|
+
"cache-dependency-lock-root",
|
|
1355
|
+
"cache-policy-root",
|
|
1356
|
+
"cache-toolchain-root",
|
|
1304
1357
|
"cargo-registry-index",
|
|
1305
1358
|
"checkout-cache-fallback",
|
|
1306
1359
|
"checkout-cache-fetch-attempts",
|
|
@@ -1317,6 +1370,9 @@
|
|
|
1317
1370
|
"expected-artifacts-json",
|
|
1318
1371
|
"fail-fast",
|
|
1319
1372
|
"gate-profile-aggregate-json",
|
|
1373
|
+
"github-artifact-attestation-platform-id",
|
|
1374
|
+
"github-artifact-attestation-signer-sha",
|
|
1375
|
+
"github-artifact-attestation-subject-path",
|
|
1320
1376
|
"install-command",
|
|
1321
1377
|
"kfd-agent-hub",
|
|
1322
1378
|
"lifecycle-timeout-minutes",
|
|
@@ -1352,8 +1408,8 @@
|
|
|
1352
1408
|
],
|
|
1353
1409
|
"controllerDescriptor": {
|
|
1354
1410
|
"contract": "buildchain.controller-descriptor/v1",
|
|
1355
|
-
"digest": "sha256:
|
|
1356
|
-
"registryDigest": "sha256:
|
|
1411
|
+
"digest": "sha256:55b3189412e7da7769a8de60bd1ba4cf52d726d8b79c0a720598e49742aa72a0",
|
|
1412
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
1357
1413
|
"inputClassifications": {
|
|
1358
1414
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
|
|
1359
1415
|
"classification": "redacted",
|
|
@@ -1387,6 +1443,10 @@
|
|
|
1387
1443
|
"classification": "redacted",
|
|
1388
1444
|
"source": "workflow-call-secret"
|
|
1389
1445
|
},
|
|
1446
|
+
"BUILDCHAIN_PROMOTION_TOKEN": {
|
|
1447
|
+
"classification": "redacted",
|
|
1448
|
+
"source": "workflow-call-secret"
|
|
1449
|
+
},
|
|
1390
1450
|
"artifact-name": {
|
|
1391
1451
|
"classification": "included",
|
|
1392
1452
|
"source": "workflow-call-input"
|
|
@@ -1471,6 +1531,18 @@
|
|
|
1471
1531
|
"classification": "digest-only",
|
|
1472
1532
|
"source": "workflow-call-input"
|
|
1473
1533
|
},
|
|
1534
|
+
"cache-dependency-lock-root": {
|
|
1535
|
+
"classification": "included",
|
|
1536
|
+
"source": "workflow-call-input"
|
|
1537
|
+
},
|
|
1538
|
+
"cache-policy-root": {
|
|
1539
|
+
"classification": "included",
|
|
1540
|
+
"source": "workflow-call-input"
|
|
1541
|
+
},
|
|
1542
|
+
"cache-toolchain-root": {
|
|
1543
|
+
"classification": "included",
|
|
1544
|
+
"source": "workflow-call-input"
|
|
1545
|
+
},
|
|
1474
1546
|
"cargo-registry-index": {
|
|
1475
1547
|
"classification": "digest-only",
|
|
1476
1548
|
"source": "workflow-call-input"
|
|
@@ -1535,6 +1607,18 @@
|
|
|
1535
1607
|
"classification": "digest-only",
|
|
1536
1608
|
"source": "workflow-call-input"
|
|
1537
1609
|
},
|
|
1610
|
+
"github-artifact-attestation-platform-id": {
|
|
1611
|
+
"classification": "included",
|
|
1612
|
+
"source": "workflow-call-input"
|
|
1613
|
+
},
|
|
1614
|
+
"github-artifact-attestation-signer-sha": {
|
|
1615
|
+
"classification": "included",
|
|
1616
|
+
"source": "workflow-call-input"
|
|
1617
|
+
},
|
|
1618
|
+
"github-artifact-attestation-subject-path": {
|
|
1619
|
+
"classification": "digest-only",
|
|
1620
|
+
"source": "workflow-call-input"
|
|
1621
|
+
},
|
|
1538
1622
|
"install-command": {
|
|
1539
1623
|
"classification": "digest-only",
|
|
1540
1624
|
"source": "workflow-call-input"
|
|
@@ -1672,7 +1756,7 @@
|
|
|
1672
1756
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
1673
1757
|
],
|
|
1674
1758
|
"breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
|
|
1675
|
-
"auditDigest": "sha256:
|
|
1759
|
+
"auditDigest": "sha256:6f7a097f70558ddff5867e3aaf6be0a0a56eb1838232eebe3ec6e7d071591746"
|
|
1676
1760
|
},
|
|
1677
1761
|
{
|
|
1678
1762
|
"contractVersion": 1,
|
|
@@ -1742,7 +1826,7 @@
|
|
|
1742
1826
|
"controllerDescriptor": {
|
|
1743
1827
|
"contract": "buildchain.controller-descriptor/v1",
|
|
1744
1828
|
"digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
|
|
1745
|
-
"registryDigest": "sha256:
|
|
1829
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
1746
1830
|
"inputClassifications": {
|
|
1747
1831
|
"artifact-name": {
|
|
1748
1832
|
"classification": "included",
|
|
@@ -1959,7 +2043,7 @@
|
|
|
1959
2043
|
"controllerDescriptor": {
|
|
1960
2044
|
"contract": "buildchain.controller-descriptor/v1",
|
|
1961
2045
|
"digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
|
|
1962
|
-
"registryDigest": "sha256:
|
|
2046
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
1963
2047
|
"inputClassifications": {
|
|
1964
2048
|
"artifact-path": {
|
|
1965
2049
|
"classification": "digest-only",
|
|
@@ -2203,7 +2287,7 @@
|
|
|
2203
2287
|
"controllerDescriptor": {
|
|
2204
2288
|
"contract": "buildchain.controller-descriptor/v1",
|
|
2205
2289
|
"digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
|
|
2206
|
-
"registryDigest": "sha256:
|
|
2290
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
2207
2291
|
"inputClassifications": {
|
|
2208
2292
|
"artifact-name": {
|
|
2209
2293
|
"classification": "included",
|
|
@@ -2385,7 +2469,7 @@
|
|
|
2385
2469
|
"controllerDescriptor": {
|
|
2386
2470
|
"contract": "buildchain.controller-descriptor/v1",
|
|
2387
2471
|
"digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
|
|
2388
|
-
"registryDigest": "sha256:
|
|
2472
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
2389
2473
|
"inputClassifications": {
|
|
2390
2474
|
"artifact-name": {
|
|
2391
2475
|
"classification": "included",
|
|
@@ -2616,6 +2700,9 @@
|
|
|
2616
2700
|
"buildchain-repository",
|
|
2617
2701
|
"channel",
|
|
2618
2702
|
"dry-run",
|
|
2703
|
+
"github-artifact-attestation-environment",
|
|
2704
|
+
"github-artifact-attestation-policy-json",
|
|
2705
|
+
"github-artifact-attestation-retention-days",
|
|
2619
2706
|
"github-governance-receipt-json",
|
|
2620
2707
|
"github-release",
|
|
2621
2708
|
"github-release-notes",
|
|
@@ -2691,8 +2778,8 @@
|
|
|
2691
2778
|
],
|
|
2692
2779
|
"controllerDescriptor": {
|
|
2693
2780
|
"contract": "buildchain.controller-descriptor/v1",
|
|
2694
|
-
"digest": "sha256:
|
|
2695
|
-
"registryDigest": "sha256:
|
|
2781
|
+
"digest": "sha256:00baae93d9ed75129fdaed6fcc33285e515b8c7de84816831a39e660941dd7ae",
|
|
2782
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
2696
2783
|
"inputClassifications": {
|
|
2697
2784
|
"BUILDCHAIN_ISSUE_APP_ID": {
|
|
2698
2785
|
"classification": "redacted",
|
|
@@ -2786,6 +2873,18 @@
|
|
|
2786
2873
|
"classification": "included",
|
|
2787
2874
|
"source": "workflow-call-input"
|
|
2788
2875
|
},
|
|
2876
|
+
"github-artifact-attestation-environment": {
|
|
2877
|
+
"classification": "digest-only",
|
|
2878
|
+
"source": "workflow-call-input"
|
|
2879
|
+
},
|
|
2880
|
+
"github-artifact-attestation-policy-json": {
|
|
2881
|
+
"classification": "digest-only",
|
|
2882
|
+
"source": "workflow-call-input"
|
|
2883
|
+
},
|
|
2884
|
+
"github-artifact-attestation-retention-days": {
|
|
2885
|
+
"classification": "included",
|
|
2886
|
+
"source": "workflow-call-input"
|
|
2887
|
+
},
|
|
2789
2888
|
"github-governance-receipt-json": {
|
|
2790
2889
|
"classification": "digest-only",
|
|
2791
2890
|
"source": "workflow-call-input"
|
|
@@ -3083,7 +3182,7 @@
|
|
|
3083
3182
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
3084
3183
|
],
|
|
3085
3184
|
"breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
|
|
3086
|
-
"auditDigest": "sha256:
|
|
3185
|
+
"auditDigest": "sha256:54bf2db92237cad97da1dc740780330e6175b97352523db732c8650560f1a9fd"
|
|
3087
3186
|
},
|
|
3088
3187
|
{
|
|
3089
3188
|
"contractVersion": 1,
|
|
@@ -3144,7 +3243,7 @@
|
|
|
3144
3243
|
"controllerDescriptor": {
|
|
3145
3244
|
"contract": "buildchain.controller-descriptor/v1",
|
|
3146
3245
|
"digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
|
|
3147
|
-
"registryDigest": "sha256:
|
|
3246
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
3148
3247
|
"inputClassifications": {
|
|
3149
3248
|
"buildchain-ref": {
|
|
3150
3249
|
"classification": "included",
|
|
@@ -3267,7 +3366,7 @@
|
|
|
3267
3366
|
"controllerDescriptor": {
|
|
3268
3367
|
"contract": "buildchain.controller-descriptor/v1",
|
|
3269
3368
|
"digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
|
|
3270
|
-
"registryDigest": "sha256:
|
|
3369
|
+
"registryDigest": "sha256:c637b908f2be506f3bd56a7e41995450c4d7011f3badc232712884e4fb7039b4",
|
|
3271
3370
|
"inputClassifications": {}
|
|
3272
3371
|
},
|
|
3273
3372
|
"guarantees": [
|
|
@@ -3280,6 +3379,6 @@
|
|
|
3280
3379
|
"auditDigest": "sha256:e07a5db56a71bd0ac79c81f12619938055361bf0a0ed8e5891f88ca1c51f1c93"
|
|
3281
3380
|
}
|
|
3282
3381
|
],
|
|
3283
|
-
"compatibilityDigest": "sha256:
|
|
3284
|
-
"contractDigest": "sha256:
|
|
3382
|
+
"compatibilityDigest": "sha256:9770baa99ba374e9dbd743ca9624a72137513b8c4e65af1fbf2160cb3ef51d9d",
|
|
3383
|
+
"contractDigest": "sha256:1fd7622e04ae83532fcc9e0f7a9fe43f86998caadd398f78f1460c9052bb591b"
|
|
3285
3384
|
}
|