@kungfu-tech/buildchain 3.0.2 → 3.0.3-alpha.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/actions/report-buildchain-issue/README.md +1 -1
- package/contracts/buildchain-v2-residuals-v1.json +191 -0
- package/dist/site/buildchain-contract.json +58 -35
- package/dist/site/buildchain-site.json +33 -33
- package/dist/site/controller-registry.json +24 -3
- package/dist/site/kfd-claims.json +11 -6
- package/dist/site/kfd-upstream-aggregate.json +1 -1
- package/dist/site/manual-registry.json +7 -7
- package/dist/site/node-api-registry.json +6 -6
- package/dist/site/page-registry.json +22 -22
- package/dist/site/public-surface-audit.json +10 -5
- package/dist/site/publication-registry.json +4 -4
- package/dist/site/site-manifest.json +11 -11
- package/dist/site/workflow-registry.json +8 -3
- package/docs/auditable-demo.md +19 -1
- package/docs/consumer-issue-reporting.md +1 -1
- package/docs/dev-alpha-candidate-patrol.md +24 -10
- package/docs/github-governance-authority.md +23 -30
- package/docs/observed-evidence-patrol.md +28 -12
- package/docs/release-governance.md +8 -1
- package/docs/reusable-build-surface.md +124 -64
- package/docs/shifu-gate-profiles.md +7 -1
- package/docs/versioning.md +41 -21
- package/docs/web-surface-deployments.md +20 -1
- package/package.json +1 -1
- package/packages/core/artifact-signing.js +1 -0
- package/packages/core/buildchain-contract.js +1 -0
- package/packages/core/controller-evidence.js +2 -0
- package/packages/core/github-governance-authority.js +25 -17
- package/packages/core/publication-control-plane-audit.js +28 -0
- package/packages/core/release-passport.js +36 -27
- package/packages/core/stable-release-gate.js +4 -1
- package/scripts/artifact-signing-delegation.mjs +268 -0
- package/scripts/audit-github-governance.mjs +32 -13
- package/scripts/audit-publication-control-plane.mjs +17 -8
- package/scripts/auditable-demo.mjs +147 -2
- package/scripts/buildchain-patrol.mjs +1 -1
- package/scripts/check-inventory.mjs +1 -0
- package/scripts/dev-alpha-candidate-patrol.mjs +20 -0
- package/scripts/dispatch-artifact-signing-authority.mjs +7 -1
- package/scripts/finalize-native-artifact-signing-result.mjs +114 -31
- package/scripts/gate-profile-core.mjs +6 -1
- package/scripts/inspect-artifact-signing-requests.mjs +45 -14
- package/scripts/observed-evidence.mjs +151 -33
- package/scripts/reconcile-github-governance.mjs +8 -1
- package/scripts/resolve-artifact-signing-upload-route.mjs +55 -0
- package/scripts/run-candidate-body-prefix-renderer.mjs +187 -0
- package/scripts/runtime-ref-core.mjs +13 -2
- package/scripts/seal-artifact-signing-requests.mjs +51 -6
- package/scripts/stable-candidate-qualification.mjs +8 -0
- package/scripts/verify-artifact-signing-results.mjs +26 -1
- package/scripts/web-surface-production-decision.mjs +19 -3
|
@@ -25,7 +25,7 @@ organization.
|
|
|
25
25
|
token: ${{ steps.buildchain-issue-token.outputs.token }}
|
|
26
26
|
summary: "Reusable build failed before artifact finalization"
|
|
27
27
|
failure-code: reusable-build-failed
|
|
28
|
-
buildchain-ref: ${{ inputs.buildchain-ref || '
|
|
28
|
+
buildchain-ref: ${{ inputs.buildchain-ref || 'v3' }}
|
|
29
29
|
diagnostics-path: .buildchain/artifacts/diagnostics.json
|
|
30
30
|
```
|
|
31
31
|
|
|
@@ -0,0 +1,191 @@
|
|
|
1
|
+
{
|
|
2
|
+
"contract": "buildchain.v2-residual-inventory/v1",
|
|
3
|
+
"scope": ".github/workflows on the current default branch",
|
|
4
|
+
"policy": {
|
|
5
|
+
"runtimeDefault": "v3",
|
|
6
|
+
"dogfoodRuntimeDefault": "v3-alpha",
|
|
7
|
+
"unclassifiedV2TokensAllowed": false
|
|
8
|
+
},
|
|
9
|
+
"entries": [
|
|
10
|
+
{
|
|
11
|
+
"path": ".github/workflows/.build.yml",
|
|
12
|
+
"token": "BUILDCHAIN_DEFAULT_REF: v2",
|
|
13
|
+
"expectedOccurrences": 1,
|
|
14
|
+
"classification": "public-contract-compatibility-fallback",
|
|
15
|
+
"callerStatus": "fallback-only-when-workflow-shell-ref-is-unavailable",
|
|
16
|
+
"owner": "buildchain-maintainers",
|
|
17
|
+
"sunsetCondition": "Change only at a governed major contract boundary after consumer migration."
|
|
18
|
+
},
|
|
19
|
+
{
|
|
20
|
+
"path": ".github/workflows/.build.yml",
|
|
21
|
+
"token": "BUILDCHAIN_DEFAULT_REF || \"v2\"",
|
|
22
|
+
"expectedOccurrences": 1,
|
|
23
|
+
"classification": "public-contract-compatibility-fallback",
|
|
24
|
+
"callerStatus": "fallback-only-when-workflow-shell-ref-is-unavailable",
|
|
25
|
+
"owner": "buildchain-maintainers",
|
|
26
|
+
"sunsetCondition": "Change only at a governed major contract boundary after consumer migration."
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"path": ".github/workflows/.bump-minor-version.yml",
|
|
30
|
+
"token": "kungfu-systems/buildchain/actions/bump-version@v2",
|
|
31
|
+
"expectedOccurrences": 1,
|
|
32
|
+
"classification": "legacy-compatibility-action",
|
|
33
|
+
"callerStatus": "legacy-reusable",
|
|
34
|
+
"owner": "buildchain-maintainers",
|
|
35
|
+
"sunsetCondition": "Remove after every known caller migrates to the lifecycle version command."
|
|
36
|
+
},
|
|
37
|
+
{
|
|
38
|
+
"path": ".github/workflows/.release-candidate-promote.yml",
|
|
39
|
+
"token": "actions/create-github-app-token@v2",
|
|
40
|
+
"expectedOccurrences": 1,
|
|
41
|
+
"classification": "third-party-action-version",
|
|
42
|
+
"callerStatus": "active",
|
|
43
|
+
"owner": "actions/create-github-app-token maintainers",
|
|
44
|
+
"sunsetCondition": "Upgrade through normal dependency review when a compatible successor is adopted."
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"path": ".github/workflows/.release-docker.yml",
|
|
48
|
+
"token": "workflows v2 Docker release path is retired",
|
|
49
|
+
"expectedOccurrences": 1,
|
|
50
|
+
"classification": "retired-path-tombstone",
|
|
51
|
+
"callerStatus": "fail-closed",
|
|
52
|
+
"owner": "buildchain-maintainers",
|
|
53
|
+
"sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
|
|
54
|
+
},
|
|
55
|
+
{
|
|
56
|
+
"path": ".github/workflows/.release-elastic-beanstalk.yml",
|
|
57
|
+
"token": "workflows v2 Elastic Beanstalk release path is retired",
|
|
58
|
+
"expectedOccurrences": 1,
|
|
59
|
+
"classification": "retired-path-tombstone",
|
|
60
|
+
"callerStatus": "fail-closed",
|
|
61
|
+
"owner": "buildchain-maintainers",
|
|
62
|
+
"sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"path": ".github/workflows/.release-new-version.yml",
|
|
66
|
+
"token": "default: \"v2\"",
|
|
67
|
+
"expectedOccurrences": 1,
|
|
68
|
+
"classification": "retired-input-tombstone",
|
|
69
|
+
"callerStatus": "fail-closed-unused-input",
|
|
70
|
+
"owner": "buildchain-maintainers",
|
|
71
|
+
"sunsetCondition": "Remove with the retired workflow input compatibility surface."
|
|
72
|
+
},
|
|
73
|
+
{
|
|
74
|
+
"path": ".github/workflows/.release-verify.yml",
|
|
75
|
+
"token": "workflows v2",
|
|
76
|
+
"expectedOccurrences": 3,
|
|
77
|
+
"classification": "retired-path-tombstone",
|
|
78
|
+
"callerStatus": "fail-closed",
|
|
79
|
+
"owner": "buildchain-maintainers",
|
|
80
|
+
"sunsetCondition": "Remove each message with its corresponding retired input or path."
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"path": ".github/workflows/.sam-release.yml",
|
|
84
|
+
"token": "workflows v2 SAM release path is retired",
|
|
85
|
+
"expectedOccurrences": 1,
|
|
86
|
+
"classification": "retired-path-tombstone",
|
|
87
|
+
"callerStatus": "fail-closed",
|
|
88
|
+
"owner": "buildchain-maintainers",
|
|
89
|
+
"sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
|
|
90
|
+
},
|
|
91
|
+
{
|
|
92
|
+
"path": ".github/workflows/.sam-verify.yml",
|
|
93
|
+
"token": "kungfu-systems/buildchain/actions/bump-version@v2",
|
|
94
|
+
"expectedOccurrences": 3,
|
|
95
|
+
"classification": "legacy-compatibility-action",
|
|
96
|
+
"callerStatus": "legacy-reusable",
|
|
97
|
+
"owner": "buildchain-maintainers",
|
|
98
|
+
"sunsetCondition": "Remove after SAM consumers migrate to the lifecycle version command."
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"path": ".github/workflows/.sam-verify.yml",
|
|
102
|
+
"token": "aws-actions/setup-sam@v2",
|
|
103
|
+
"expectedOccurrences": 1,
|
|
104
|
+
"classification": "third-party-action-version",
|
|
105
|
+
"callerStatus": "legacy-reusable",
|
|
106
|
+
"owner": "aws-actions/setup-sam maintainers",
|
|
107
|
+
"sunsetCondition": "Upgrade through normal dependency review when a compatible successor is adopted."
|
|
108
|
+
},
|
|
109
|
+
{
|
|
110
|
+
"path": ".github/workflows/.sync-release-page.yml",
|
|
111
|
+
"token": "retired in workflows v2",
|
|
112
|
+
"expectedOccurrences": 1,
|
|
113
|
+
"classification": "retired-path-tombstone",
|
|
114
|
+
"callerStatus": "fail-closed",
|
|
115
|
+
"owner": "buildchain-maintainers",
|
|
116
|
+
"sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"path": ".github/workflows/.web-surface.yml",
|
|
120
|
+
"token": "BUILDCHAIN_DEFAULT_REF: v2",
|
|
121
|
+
"expectedOccurrences": 1,
|
|
122
|
+
"classification": "public-contract-compatibility-fallback",
|
|
123
|
+
"callerStatus": "fallback-only-when-workflow-shell-ref-is-unavailable",
|
|
124
|
+
"owner": "buildchain-maintainers",
|
|
125
|
+
"sunsetCondition": "Change only at a governed major contract boundary after consumer migration."
|
|
126
|
+
},
|
|
127
|
+
{
|
|
128
|
+
"path": ".github/workflows/.web-surface.yml",
|
|
129
|
+
"token": "BUILDCHAIN_DEFAULT_REF || \"v2\"",
|
|
130
|
+
"expectedOccurrences": 1,
|
|
131
|
+
"classification": "public-contract-compatibility-fallback",
|
|
132
|
+
"callerStatus": "fallback-only-when-workflow-shell-ref-is-unavailable",
|
|
133
|
+
"owner": "buildchain-maintainers",
|
|
134
|
+
"sunsetCondition": "Change only at a governed major contract boundary after consumer migration."
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"path": ".github/workflows/.wheel-release.yml",
|
|
138
|
+
"token": "workflows v2 wheel release path is retired",
|
|
139
|
+
"expectedOccurrences": 1,
|
|
140
|
+
"classification": "retired-path-tombstone",
|
|
141
|
+
"callerStatus": "fail-closed",
|
|
142
|
+
"owner": "buildchain-maintainers",
|
|
143
|
+
"sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
|
|
144
|
+
},
|
|
145
|
+
{
|
|
146
|
+
"path": ".github/workflows/.wheel-verify.yml",
|
|
147
|
+
"token": "kungfu-systems/buildchain/actions/publish-prebuilt@v2",
|
|
148
|
+
"expectedOccurrences": 1,
|
|
149
|
+
"classification": "legacy-compatibility-action",
|
|
150
|
+
"callerStatus": "legacy-reusable",
|
|
151
|
+
"owner": "buildchain-maintainers",
|
|
152
|
+
"sunsetCondition": "Remove after wheel consumers migrate to the publication authority path."
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"path": ".github/workflows/.wheel-verify.yml",
|
|
156
|
+
"token": "kungfu-systems/buildchain/actions/bump-version@v2",
|
|
157
|
+
"expectedOccurrences": 3,
|
|
158
|
+
"classification": "legacy-compatibility-action",
|
|
159
|
+
"callerStatus": "legacy-reusable",
|
|
160
|
+
"owner": "buildchain-maintainers",
|
|
161
|
+
"sunsetCondition": "Remove after wheel consumers migrate to the lifecycle version command."
|
|
162
|
+
},
|
|
163
|
+
{
|
|
164
|
+
"path": ".github/workflows/binary-distribution.yml",
|
|
165
|
+
"token": "v2.2.0-alpha.0",
|
|
166
|
+
"expectedOccurrences": 1,
|
|
167
|
+
"classification": "artifact-version-example",
|
|
168
|
+
"callerStatus": "manual-input",
|
|
169
|
+
"owner": "buildchain-maintainers",
|
|
170
|
+
"sunsetCondition": "Replace when the binary-distribution manual default is refreshed independently of runtime routing."
|
|
171
|
+
},
|
|
172
|
+
{
|
|
173
|
+
"path": ".github/workflows/candidate-lab.yml",
|
|
174
|
+
"token": "default: \"v2\"",
|
|
175
|
+
"expectedOccurrences": 1,
|
|
176
|
+
"classification": "legacy-compatibility-ref",
|
|
177
|
+
"callerStatus": "manual-no-publish-report-only",
|
|
178
|
+
"owner": "buildchain-maintainers",
|
|
179
|
+
"sunsetCondition": "Remove after the legacy workflows comparison lane is formally retired."
|
|
180
|
+
},
|
|
181
|
+
{
|
|
182
|
+
"path": ".github/workflows/schedule-purge-artifacts.yml",
|
|
183
|
+
"token": "not shipped in buildchain v2",
|
|
184
|
+
"expectedOccurrences": 1,
|
|
185
|
+
"classification": "retired-path-tombstone",
|
|
186
|
+
"callerStatus": "fail-closed",
|
|
187
|
+
"owner": "buildchain-maintainers",
|
|
188
|
+
"sunsetCondition": "Remove only after the compatibility workflow entry itself is removed."
|
|
189
|
+
}
|
|
190
|
+
]
|
|
191
|
+
}
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
"product": {
|
|
5
5
|
"name": "Buildchain",
|
|
6
6
|
"package": "@kungfu-tech/buildchain",
|
|
7
|
-
"version": "3.0.
|
|
7
|
+
"version": "3.0.3-alpha.0",
|
|
8
8
|
"repository": "https://github.com/kungfu-systems/buildchain"
|
|
9
9
|
},
|
|
10
10
|
"majorLine": "v3",
|
|
@@ -52,7 +52,7 @@
|
|
|
52
52
|
"retryable GitHub fallback fetches use a bounded attempt budget before exact source SHA and tree verification"
|
|
53
53
|
],
|
|
54
54
|
"breakingDigest": "sha256:a6a35370d6b0d0f46e1b2712dcc01961fe53c2febde95409a27a485c10a36650",
|
|
55
|
-
"auditDigest": "sha256:
|
|
55
|
+
"auditDigest": "sha256:1b5605bb904b59acfa4aef08467379c6a7446c00a83fbd1ee793e2c4e1053ffb"
|
|
56
56
|
},
|
|
57
57
|
{
|
|
58
58
|
"contractVersion": 1,
|
|
@@ -91,7 +91,7 @@
|
|
|
91
91
|
"alpha and stable channel selections use separate consumer contract locks by default"
|
|
92
92
|
],
|
|
93
93
|
"breakingDigest": "sha256:c4597dfa89e1a58f1023905092b849644f5c080abf150aeba9c7e1cd5ed43962",
|
|
94
|
-
"auditDigest": "sha256:
|
|
94
|
+
"auditDigest": "sha256:9fef5903c1127b697b5d2eec99e0b5e08fa9e40f8828b28649394f8fee0da2d5"
|
|
95
95
|
},
|
|
96
96
|
{
|
|
97
97
|
"contractVersion": 1,
|
|
@@ -217,7 +217,7 @@
|
|
|
217
217
|
"promotion reuses PR-stage release-candidate artifacts and does not run the heavy native build matrix"
|
|
218
218
|
],
|
|
219
219
|
"breakingDigest": "sha256:aa30f22e3af0a89841310bdbdc900844dd95a66974db173fa140a71bbd7e82c0",
|
|
220
|
-
"auditDigest": "sha256:
|
|
220
|
+
"auditDigest": "sha256:06609d66b1d52fb4a3f7a20832f401bc389e5018d2eb78fddf61aefec4b4ebdf"
|
|
221
221
|
},
|
|
222
222
|
{
|
|
223
223
|
"contractVersion": 1,
|
|
@@ -261,7 +261,7 @@
|
|
|
261
261
|
"channel-aware artifact host facts are checked against the deploy plan before adapter side effects"
|
|
262
262
|
],
|
|
263
263
|
"breakingDigest": "sha256:da569f90374e878948e3d5160ed9929338ce0572473ca8ee54867b0fe1aaeace",
|
|
264
|
-
"auditDigest": "sha256:
|
|
264
|
+
"auditDigest": "sha256:f0ff3395c25d10b4e93877c2fa5295101f0cadeaf15ece029be2be2e7adca111"
|
|
265
265
|
},
|
|
266
266
|
{
|
|
267
267
|
"contractVersion": 1,
|
|
@@ -319,7 +319,7 @@
|
|
|
319
319
|
"media qualification does not claim browser playback, responsive layout, reduced-motion behavior, accessibility, or production deployment"
|
|
320
320
|
],
|
|
321
321
|
"breakingDigest": "sha256:425f8d3d1ba205dd6fe35a20f1dc6dad7d7c563872283e3af79fea4d5c475692",
|
|
322
|
-
"auditDigest": "sha256:
|
|
322
|
+
"auditDigest": "sha256:5eb6e87c04cbffd9c52682498f9c81742a22482455629cac4881263164584bf0"
|
|
323
323
|
},
|
|
324
324
|
{
|
|
325
325
|
"contractVersion": 1,
|
|
@@ -506,7 +506,7 @@
|
|
|
506
506
|
"release-state SHA is recorded as a durable audit entrance"
|
|
507
507
|
],
|
|
508
508
|
"breakingDigest": "sha256:b627e1b2ece9b6049517a942c5139e342e6077cdd3d8962d61cef8481b1f70ad",
|
|
509
|
-
"auditDigest": "sha256:
|
|
509
|
+
"auditDigest": "sha256:46f9f5dd3c27da361b9b4dad88df6630d77d025e13a7c3711cc844ed598d449d"
|
|
510
510
|
},
|
|
511
511
|
{
|
|
512
512
|
"contractVersion": 1,
|
|
@@ -555,7 +555,7 @@
|
|
|
555
555
|
"prose-only public claims downgrade the release trust passport audit"
|
|
556
556
|
],
|
|
557
557
|
"breakingDigest": "sha256:f0b636eb925ddbf45ff1a8872454ab7b4dd98857cac12bb75217830130e62a16",
|
|
558
|
-
"auditDigest": "sha256:
|
|
558
|
+
"auditDigest": "sha256:46f9f5dd3c27da361b9b4dad88df6630d77d025e13a7c3711cc844ed598d449d"
|
|
559
559
|
},
|
|
560
560
|
{
|
|
561
561
|
"contractVersion": 1,
|
|
@@ -705,7 +705,7 @@
|
|
|
705
705
|
"manual entries carry source file digests so downstream sites and agents can detect stale hand-written documentation"
|
|
706
706
|
],
|
|
707
707
|
"breakingDigest": "sha256:7d0d2819e3a3e72989d9c57b5efe9d0bc0a79bc0f2c82a0c7b9d6c5a211a91f2",
|
|
708
|
-
"auditDigest": "sha256:
|
|
708
|
+
"auditDigest": "sha256:aafab6ffa75895b486e051e7ebc6a635834f27087e55b8d0f7bfc0c856921742"
|
|
709
709
|
},
|
|
710
710
|
{
|
|
711
711
|
"contractVersion": 1,
|
|
@@ -727,7 +727,7 @@
|
|
|
727
727
|
"agents can discover supported Node APIs without importing internal file paths"
|
|
728
728
|
],
|
|
729
729
|
"breakingDigest": "sha256:48f925608d3e2131d90936b07dc2a30341204cae3e6e785c0f77d61ad755c945",
|
|
730
|
-
"auditDigest": "sha256:
|
|
730
|
+
"auditDigest": "sha256:656216625d246623e963af0e3899859f8dbffe5eb56e6a105686b4451fd7a025"
|
|
731
731
|
},
|
|
732
732
|
{
|
|
733
733
|
"contractVersion": 1,
|
|
@@ -778,7 +778,7 @@
|
|
|
778
778
|
"controllerDescriptor": {
|
|
779
779
|
"contract": "buildchain.controller-descriptor/v1",
|
|
780
780
|
"digest": "sha256:373723a73d188194d389dee04c394d3b79cb0c016a370f2f5d0f60979a02ed48",
|
|
781
|
-
"registryDigest": "sha256:
|
|
781
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
782
782
|
"inputClassifications": {
|
|
783
783
|
"buildchain-ref": {
|
|
784
784
|
"classification": "included",
|
|
@@ -817,7 +817,7 @@
|
|
|
817
817
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
818
818
|
],
|
|
819
819
|
"breakingDigest": "sha256:d4bd0f2a1921bfed71a4d9104d45934555bde74a5c189f93ad79f37074c02b87",
|
|
820
|
-
"auditDigest": "sha256:
|
|
820
|
+
"auditDigest": "sha256:bb008ca3b34f02ad6ee7596eefd596d181d4f50b634c00aa80137c9e4e8da11c"
|
|
821
821
|
},
|
|
822
822
|
{
|
|
823
823
|
"contractVersion": 1,
|
|
@@ -842,12 +842,14 @@
|
|
|
842
842
|
"resolve-runtime",
|
|
843
843
|
"resolve-source",
|
|
844
844
|
"build",
|
|
845
|
+
"signing-finalization",
|
|
845
846
|
"verify",
|
|
846
847
|
"aggregate"
|
|
847
848
|
],
|
|
848
849
|
"capabilities": [
|
|
849
850
|
"source-lock",
|
|
850
851
|
"lifecycle-build",
|
|
852
|
+
"artifact-signing-finalization",
|
|
851
853
|
"credential-island",
|
|
852
854
|
"lifecycle-verify",
|
|
853
855
|
"artifact-admission"
|
|
@@ -869,6 +871,7 @@
|
|
|
869
871
|
"BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
|
|
870
872
|
"BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
|
|
871
873
|
"BUILDCHAIN_PROMOTION_TOKEN",
|
|
874
|
+
"artifact-compression-level",
|
|
872
875
|
"artifact-name",
|
|
873
876
|
"artifact-name-template",
|
|
874
877
|
"artifact-paths",
|
|
@@ -880,6 +883,7 @@
|
|
|
880
883
|
"artifact-relay-s3-role-arn",
|
|
881
884
|
"artifact-relay-s3-upload-role-arn",
|
|
882
885
|
"artifact-retention-days",
|
|
886
|
+
"artifact-signing-request-upload-no-proxy",
|
|
883
887
|
"artifact-transfer-mode",
|
|
884
888
|
"build-command",
|
|
885
889
|
"buildchain-contract-compatibility-policy",
|
|
@@ -944,8 +948,8 @@
|
|
|
944
948
|
],
|
|
945
949
|
"controllerDescriptor": {
|
|
946
950
|
"contract": "buildchain.controller-descriptor/v1",
|
|
947
|
-
"digest": "sha256:
|
|
948
|
-
"registryDigest": "sha256:
|
|
951
|
+
"digest": "sha256:c9c8c1493e95aecfc1a2ec092f9490c1e16b9a9cdc1e3673bf6bdd329baac523",
|
|
952
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
949
953
|
"inputClassifications": {
|
|
950
954
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
|
|
951
955
|
"classification": "redacted",
|
|
@@ -983,6 +987,10 @@
|
|
|
983
987
|
"classification": "redacted",
|
|
984
988
|
"source": "workflow-call-secret"
|
|
985
989
|
},
|
|
990
|
+
"artifact-compression-level": {
|
|
991
|
+
"classification": "included",
|
|
992
|
+
"source": "workflow-call-input"
|
|
993
|
+
},
|
|
986
994
|
"artifact-name": {
|
|
987
995
|
"classification": "included",
|
|
988
996
|
"source": "workflow-call-input"
|
|
@@ -1027,6 +1035,10 @@
|
|
|
1027
1035
|
"classification": "included",
|
|
1028
1036
|
"source": "workflow-call-input"
|
|
1029
1037
|
},
|
|
1038
|
+
"artifact-signing-request-upload-no-proxy": {
|
|
1039
|
+
"classification": "included",
|
|
1040
|
+
"source": "workflow-call-input"
|
|
1041
|
+
},
|
|
1030
1042
|
"artifact-transfer-mode": {
|
|
1031
1043
|
"classification": "included",
|
|
1032
1044
|
"source": "workflow-call-input"
|
|
@@ -1274,7 +1286,8 @@
|
|
|
1274
1286
|
}
|
|
1275
1287
|
},
|
|
1276
1288
|
"compatibleBreakingDigests": [
|
|
1277
|
-
"sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be"
|
|
1289
|
+
"sha256:e264a79f9f399038c2fcfd21e4168c68c2e1485ee5c651c02242a02b622ac2be",
|
|
1290
|
+
"sha256:30745921541e9b0f70475bb2178c2559f6aef248f6680670ccd44d8c5a69a6b1"
|
|
1278
1291
|
],
|
|
1279
1292
|
"guarantees": [
|
|
1280
1293
|
"plans bind exact consumer source SHA, exact Buildchain runtime SHA, and the runtime contract digest",
|
|
@@ -1282,8 +1295,8 @@
|
|
|
1282
1295
|
"redacted input values are never serialized and digest-only input values are never emitted in plaintext",
|
|
1283
1296
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
1284
1297
|
],
|
|
1285
|
-
"breakingDigest": "sha256:
|
|
1286
|
-
"auditDigest": "sha256:
|
|
1298
|
+
"breakingDigest": "sha256:6b8d38e92b2c67b5bc83fae0a3fd95bfa47582fbc176e6cdeebe7630a57534cb",
|
|
1299
|
+
"auditDigest": "sha256:1b5605bb904b59acfa4aef08467379c6a7446c00a83fbd1ee793e2c4e1053ffb"
|
|
1287
1300
|
},
|
|
1288
1301
|
{
|
|
1289
1302
|
"contractVersion": 1,
|
|
@@ -1330,6 +1343,7 @@
|
|
|
1330
1343
|
"BUILDCHAIN_MACOS_NOTARY_API_KEY_ID",
|
|
1331
1344
|
"BUILDCHAIN_MACOS_NOTARY_API_KEY_P8_BASE64",
|
|
1332
1345
|
"BUILDCHAIN_PROMOTION_TOKEN",
|
|
1346
|
+
"artifact-compression-level",
|
|
1333
1347
|
"artifact-name",
|
|
1334
1348
|
"artifact-name-template",
|
|
1335
1349
|
"artifact-paths",
|
|
@@ -1341,6 +1355,7 @@
|
|
|
1341
1355
|
"artifact-relay-s3-role-arn",
|
|
1342
1356
|
"artifact-relay-s3-upload-role-arn",
|
|
1343
1357
|
"artifact-retention-days",
|
|
1358
|
+
"artifact-signing-request-upload-no-proxy",
|
|
1344
1359
|
"artifact-transfer-mode",
|
|
1345
1360
|
"build-command",
|
|
1346
1361
|
"buildchain-alpha-contract-lock-path",
|
|
@@ -1408,8 +1423,8 @@
|
|
|
1408
1423
|
],
|
|
1409
1424
|
"controllerDescriptor": {
|
|
1410
1425
|
"contract": "buildchain.controller-descriptor/v1",
|
|
1411
|
-
"digest": "sha256:
|
|
1412
|
-
"registryDigest": "sha256:
|
|
1426
|
+
"digest": "sha256:eac228a4746684d61d9664e8bce63e20d4b1e7bea0afd8718c8584cef941a95d",
|
|
1427
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
1413
1428
|
"inputClassifications": {
|
|
1414
1429
|
"BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN": {
|
|
1415
1430
|
"classification": "redacted",
|
|
@@ -1447,6 +1462,10 @@
|
|
|
1447
1462
|
"classification": "redacted",
|
|
1448
1463
|
"source": "workflow-call-secret"
|
|
1449
1464
|
},
|
|
1465
|
+
"artifact-compression-level": {
|
|
1466
|
+
"classification": "included",
|
|
1467
|
+
"source": "workflow-call-input"
|
|
1468
|
+
},
|
|
1450
1469
|
"artifact-name": {
|
|
1451
1470
|
"classification": "included",
|
|
1452
1471
|
"source": "workflow-call-input"
|
|
@@ -1491,6 +1510,10 @@
|
|
|
1491
1510
|
"classification": "included",
|
|
1492
1511
|
"source": "workflow-call-input"
|
|
1493
1512
|
},
|
|
1513
|
+
"artifact-signing-request-upload-no-proxy": {
|
|
1514
|
+
"classification": "included",
|
|
1515
|
+
"source": "workflow-call-input"
|
|
1516
|
+
},
|
|
1494
1517
|
"artifact-transfer-mode": {
|
|
1495
1518
|
"classification": "included",
|
|
1496
1519
|
"source": "workflow-call-input"
|
|
@@ -1756,7 +1779,7 @@
|
|
|
1756
1779
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
1757
1780
|
],
|
|
1758
1781
|
"breakingDigest": "sha256:d40dd05d7e07473d4b2dc1b62fbb0ed6f06449b4d3a7c44a2e8014313e3c0273",
|
|
1759
|
-
"auditDigest": "sha256:
|
|
1782
|
+
"auditDigest": "sha256:9fef5903c1127b697b5d2eec99e0b5e08fa9e40f8828b28649394f8fee0da2d5"
|
|
1760
1783
|
},
|
|
1761
1784
|
{
|
|
1762
1785
|
"contractVersion": 1,
|
|
@@ -1826,7 +1849,7 @@
|
|
|
1826
1849
|
"controllerDescriptor": {
|
|
1827
1850
|
"contract": "buildchain.controller-descriptor/v1",
|
|
1828
1851
|
"digest": "sha256:8e42956a2c10fa109500e72b97994f06b3d22a19cc63a46f66410b2e81706e9d",
|
|
1829
|
-
"registryDigest": "sha256:
|
|
1852
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
1830
1853
|
"inputClassifications": {
|
|
1831
1854
|
"artifact-name": {
|
|
1832
1855
|
"classification": "included",
|
|
@@ -1957,7 +1980,7 @@
|
|
|
1957
1980
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
1958
1981
|
],
|
|
1959
1982
|
"breakingDigest": "sha256:5f1868478b7ccd9fb79aea76bc771289d2ca6bd2dccd1abf57575426f1eae5fb",
|
|
1960
|
-
"auditDigest": "sha256:
|
|
1983
|
+
"auditDigest": "sha256:b1da0c381cfa2d9ed8d39857b2ef12b1652f9c6be43e76a6944122de9b3f7481"
|
|
1961
1984
|
},
|
|
1962
1985
|
{
|
|
1963
1986
|
"contractVersion": 1,
|
|
@@ -2043,7 +2066,7 @@
|
|
|
2043
2066
|
"controllerDescriptor": {
|
|
2044
2067
|
"contract": "buildchain.controller-descriptor/v1",
|
|
2045
2068
|
"digest": "sha256:c5274b37f04d0054559fdc8698c51bd0f0d8ae470baf163e9caa7699aa970575",
|
|
2046
|
-
"registryDigest": "sha256:
|
|
2069
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
2047
2070
|
"inputClassifications": {
|
|
2048
2071
|
"artifact-path": {
|
|
2049
2072
|
"classification": "digest-only",
|
|
@@ -2222,7 +2245,7 @@
|
|
|
2222
2245
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
2223
2246
|
],
|
|
2224
2247
|
"breakingDigest": "sha256:f14825324a16b51c2e9ed708ebe64e1932e05b6d5e0866f83aea8439decb4a27",
|
|
2225
|
-
"auditDigest": "sha256:
|
|
2248
|
+
"auditDigest": "sha256:f0ff3395c25d10b4e93877c2fa5295101f0cadeaf15ece029be2be2e7adca111"
|
|
2226
2249
|
},
|
|
2227
2250
|
{
|
|
2228
2251
|
"contractVersion": 1,
|
|
@@ -2287,7 +2310,7 @@
|
|
|
2287
2310
|
"controllerDescriptor": {
|
|
2288
2311
|
"contract": "buildchain.controller-descriptor/v1",
|
|
2289
2312
|
"digest": "sha256:6b132790b9798e8a5dfbe095701d8e024c160a08bc7c4bd477ee79feef7a9cfd",
|
|
2290
|
-
"registryDigest": "sha256:
|
|
2313
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
2291
2314
|
"inputClassifications": {
|
|
2292
2315
|
"artifact-name": {
|
|
2293
2316
|
"classification": "included",
|
|
@@ -2382,7 +2405,7 @@
|
|
|
2382
2405
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
2383
2406
|
],
|
|
2384
2407
|
"breakingDigest": "sha256:3f76502666069c2727d23efcfdb08fb80f89ced1955a69e29f11525ae88aca1d",
|
|
2385
|
-
"auditDigest": "sha256:
|
|
2408
|
+
"auditDigest": "sha256:6aee4237514548a8aa48e175520127a941e8359fb373356927506101bbef57a0"
|
|
2386
2409
|
},
|
|
2387
2410
|
{
|
|
2388
2411
|
"contractVersion": 1,
|
|
@@ -2469,7 +2492,7 @@
|
|
|
2469
2492
|
"controllerDescriptor": {
|
|
2470
2493
|
"contract": "buildchain.controller-descriptor/v1",
|
|
2471
2494
|
"digest": "sha256:6d71409659fbf8543c7e520b0c493d8afe86bdf60286b860bb917f0041ebc173",
|
|
2472
|
-
"registryDigest": "sha256:
|
|
2495
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
2473
2496
|
"inputClassifications": {
|
|
2474
2497
|
"artifact-name": {
|
|
2475
2498
|
"classification": "included",
|
|
@@ -2632,7 +2655,7 @@
|
|
|
2632
2655
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
2633
2656
|
],
|
|
2634
2657
|
"breakingDigest": "sha256:0eb318df455ef9cb737a7c2515a2411b685d34ed0bde7b5f5b173a7a42513114",
|
|
2635
|
-
"auditDigest": "sha256:
|
|
2658
|
+
"auditDigest": "sha256:63ce6fcf05c4a3aaf9202003824e48d8229f122b9a4667dca560688cf38a79c4"
|
|
2636
2659
|
},
|
|
2637
2660
|
{
|
|
2638
2661
|
"contractVersion": 1,
|
|
@@ -2779,7 +2802,7 @@
|
|
|
2779
2802
|
"controllerDescriptor": {
|
|
2780
2803
|
"contract": "buildchain.controller-descriptor/v1",
|
|
2781
2804
|
"digest": "sha256:00baae93d9ed75129fdaed6fcc33285e515b8c7de84816831a39e660941dd7ae",
|
|
2782
|
-
"registryDigest": "sha256:
|
|
2805
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
2783
2806
|
"inputClassifications": {
|
|
2784
2807
|
"BUILDCHAIN_ISSUE_APP_ID": {
|
|
2785
2808
|
"classification": "redacted",
|
|
@@ -3182,7 +3205,7 @@
|
|
|
3182
3205
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
3183
3206
|
],
|
|
3184
3207
|
"breakingDigest": "sha256:015d8de793adbd4c539416be7d7512e18cc92097e629b0203fa06d2c183e98bd",
|
|
3185
|
-
"auditDigest": "sha256:
|
|
3208
|
+
"auditDigest": "sha256:06609d66b1d52fb4a3f7a20832f401bc389e5018d2eb78fddf61aefec4b4ebdf"
|
|
3186
3209
|
},
|
|
3187
3210
|
{
|
|
3188
3211
|
"contractVersion": 1,
|
|
@@ -3243,7 +3266,7 @@
|
|
|
3243
3266
|
"controllerDescriptor": {
|
|
3244
3267
|
"contract": "buildchain.controller-descriptor/v1",
|
|
3245
3268
|
"digest": "sha256:f97656a8df0758c8e404d5b7c387529256a1ec45d1748f8efb6847a3256b1216",
|
|
3246
|
-
"registryDigest": "sha256:
|
|
3269
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
3247
3270
|
"inputClassifications": {
|
|
3248
3271
|
"buildchain-ref": {
|
|
3249
3272
|
"classification": "included",
|
|
@@ -3322,7 +3345,7 @@
|
|
|
3322
3345
|
"missing receipts are non-qualifying and must not be represented as a successful controller run"
|
|
3323
3346
|
],
|
|
3324
3347
|
"breakingDigest": "sha256:d7a1f15990ce8bd13149474888232c7d4451dd2a49bebf4d4ce1336695da430e",
|
|
3325
|
-
"auditDigest": "sha256:
|
|
3348
|
+
"auditDigest": "sha256:9f53928e343e2895a64781f586a55decd6203055afaf8f26212342a000fd1ce4"
|
|
3326
3349
|
},
|
|
3327
3350
|
{
|
|
3328
3351
|
"contractVersion": 1,
|
|
@@ -3366,7 +3389,7 @@
|
|
|
3366
3389
|
"controllerDescriptor": {
|
|
3367
3390
|
"contract": "buildchain.controller-descriptor/v1",
|
|
3368
3391
|
"digest": "sha256:b6f53563c0adc859bc586c05fce560a5094d7d9666438d63c5fd3e1fc4774555",
|
|
3369
|
-
"registryDigest": "sha256:
|
|
3392
|
+
"registryDigest": "sha256:f18f3b706683ae34168ed582d0b51f2d7d2574d627dda4c7b667d01f86623331",
|
|
3370
3393
|
"inputClassifications": {}
|
|
3371
3394
|
},
|
|
3372
3395
|
"guarantees": [
|
|
@@ -3379,6 +3402,6 @@
|
|
|
3379
3402
|
"auditDigest": "sha256:e07a5db56a71bd0ac79c81f12619938055361bf0a0ed8e5891f88ca1c51f1c93"
|
|
3380
3403
|
}
|
|
3381
3404
|
],
|
|
3382
|
-
"compatibilityDigest": "sha256:
|
|
3383
|
-
"contractDigest": "sha256:
|
|
3405
|
+
"compatibilityDigest": "sha256:32a651504c57829085dc8863f0e41dee98eb60708ff6dec958c9c7e4b1010102",
|
|
3406
|
+
"contractDigest": "sha256:41501b9993621832a124f6ad5180e00b5b9b88435b70ad277cd842f1830aad2c"
|
|
3384
3407
|
}
|