diff --git a/RELEASING.md b/RELEASING.md index 56f29e6..558130c 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -214,7 +214,7 @@ passing evidence record for each target. The frozen Chat production source `edd4728792321771496df58bfc0e6122908a96ec` is exercised by the compatible schema-v2 producer at -`4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72`. Its source lock was pinned by +`36df4cbded3c82d9ae09857847c42314deb34490`. Its source lock was pinned by reachable authority commit `a76137207d44db7ac83e0e19f07ec6913fb62230` to executable harness behavior revision `d4a5df371af271aa5d9d030d27c3820c92d76128`. diff --git a/conformance/client-v1-cross-repository-lock.json b/conformance/client-v1-cross-repository-lock.json index 01472be..985bb5a 100644 --- a/conformance/client-v1-cross-repository-lock.json +++ b/conformance/client-v1-cross-repository-lock.json @@ -165,8 +165,8 @@ "evidenceProducer": { "status": "compatible", "repository": "OpenCoven/chat", - "commit": "4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72", - "tree": "76bd46a67952219e3fa72aee2132b329f51b4d96", + "commit": "36df4cbded3c82d9ae09857847c42314deb34490", + "tree": "b461672769dc137e16f49e02dff8b94202029fca", "packageManifest": { "path": "package.json", "size": 4044, @@ -175,8 +175,8 @@ "harness": { "path": "scripts/phase1-conformance.mjs", "version": "2.0.0", - "size": 198878, - "sha256": "cafdb3dc02f878e8530d10fc882369aa0ad63cf9bf31e4406154a57c5ebb4f58" + "size": 199089, + "sha256": "d239fc8fcf06543064c355757422eada4c14df4a4bf94397268077de52f14dce" }, "command": "test:phase1-conformance", "recordSchemaVersion": 2, @@ -184,7 +184,7 @@ "name": "client-v1 conformance", "path": ".github/workflows/client-v1-conformance.yml", "size": 462746, - "sha256": "7d872ba59ac77204efdf893fc2e50aabe1fb4bdbae7be463a0f2c96a1ea3294a", + "sha256": "62ebc2c25e2ca996a4db109771f8b96f8f57bff2e5cbd131bf628be832644d18", "job": "platform-conformance", "jobNameTemplate": "platform-conformance ({platform})", "aggregationJob": "aggregate-conformance", @@ -219,11 +219,11 @@ ], "downloadArtifactAction": "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c", "attestationAction": "actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8", - "windowsBootstrapScriptSha256": "bb96b6aef894a9c9c5f5c2e54328ef9e4d8e0281c2661f01849c153910c3ac54", + "windowsBootstrapScriptSha256": "d6e3734ac279990691f12c55a2d93518989b8bb221f546b0a283ed77f7425e42", "validatorRevisionScriptSha256": "9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9", "phase1RevisionsScriptSha256": "507ce777b643d97154472eb23135f7965fd55cf0fcedcec30e93b23e6472d225", "linuxKeyringSetupScriptSha256": "7b1ff87ab5d2230950632560230899cc450458a800a630c2788b53be8b13d200", - "unixSupervisorPreparationScriptSha256": "657b2c3eb853ee011cc13aec2583eb5109fe889fa6a29d89dba24656121781f2", + "unixSupervisorPreparationScriptSha256": "5f96dab61d9d612f80ca9f99ae61a7a2eedb7f051237938d6088cb4a90c053b7", "unixToolPathSource": { "path": "scripts/executable-resolution.mjs", "size": 9154, @@ -249,8 +249,8 @@ ] }, "signerWorkflow": "OpenCoven/chat/.github/workflows/client-v1-conformance.yml", - "signerDigest": "4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72", - "sourceDigest": "4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72", + "signerDigest": "36df4cbded3c82d9ae09857847c42314deb34490", + "sourceDigest": "36df4cbded3c82d9ae09857847c42314deb34490", "predicateType": "https://slsa.dev/provenance/v1", "denySelfHostedRunners": true } diff --git a/docs/workflows/client-v1-cross-repository-conformance.md b/docs/workflows/client-v1-cross-repository-conformance.md index bb0e677..1eb6dff 100644 --- a/docs/workflows/client-v1-cross-repository-conformance.md +++ b/docs/workflows/client-v1-cross-repository-conformance.md @@ -28,7 +28,7 @@ There is no passing aggregate in this repository yet. The frozen Chat production source remains `edd4728792321771496df58bfc0e6122908a96ec`; the compatible evidence producer is the pinned `refs/heads/main` commit -`4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72`. Its source lock was pinned by +`36df4cbded3c82d9ae09857847c42314deb34490`. Its source lock was pinned by reachable authority commit `a76137207d44db7ac83e0e19f07ec6913fb62230` to executable harness behavior revision `d4a5df371af271aa5d9d030d27c3820c92d76128`. @@ -275,7 +275,7 @@ aggregation job has no permissions and can only confirm successful completion of the protected matrix; it cannot generate, upload, attest, or replace a platform record. This structural template is exercised synthetically in tests only. The committed lock marks the reachable Chat producer at -`4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72` compatible with the reviewed +`36df4cbded3c82d9ae09857847c42314deb34490` compatible with the reviewed schema-v2 workflow bytes. Release readiness remains blocked until this SDK validator merges, `CLIENT_V1_CONFORMANCE_VALIDATOR_REVISION` is rotated to the merged revision, and all three protected platform records and their GitHub diff --git a/scripts/github-conformance-evidence.mjs b/scripts/github-conformance-evidence.mjs index 3457969..cf69d22 100644 --- a/scripts/github-conformance-evidence.mjs +++ b/scripts/github-conformance-evidence.mjs @@ -45,15 +45,15 @@ const WINDOWS_SUPERVISOR_ARTIFACT = 'phase1-process-supervisor-win32-x64'; const WINDOWS_SUPERVISOR_JOB_NAME = 'build-windows-supervisor'; const WINDOWS_SUPERVISOR_RUNNER_LABELS = ['macos-latest']; const REVIEWED_WINDOWS_BOOTSTRAP_SCRIPT_SHA256 = - 'bb96b6aef894a9c9c5f5c2e54328ef9e4d8e0281c2661f01849c153910c3ac54'; + 'd6e3734ac279990691f12c55a2d93518989b8bb221f546b0a283ed77f7425e42'; const REVIEWED_WINDOWS_CHILD_BOOTSTRAP_SHA256 = - 'be69af3748ae677cb8b7fd4342a7e23b5c6be46cb0a46963137d79e0791789f9'; + 'f7bba77fdfa9b58c55e48e0d00706e5a598cd0409d1d44eec460654bce51573e'; const REVIEWED_UNIX_SUPERVISOR_PREPARATION_SCRIPT_SHA256 = - '657b2c3eb853ee011cc13aec2583eb5109fe889fa6a29d89dba24656121781f2'; + '5f96dab61d9d612f80ca9f99ae61a7a2eedb7f051237938d6088cb4a90c053b7'; const REVIEWED_UNIX_PRODUCTION_SCRIPT_SHA256 = '043066be50d0c3fa66f7151224242734cb2e9f39ffa9cf1c6f8106ab88c75a02'; const REVIEWED_UNIX_SUPERVISOR_SOURCE_BINDING = - "['scripts/unix-producer-supervisor.sh', [29087, 'd14f65fa32c82b33ecee6224dc79c86857c2d8d28965e3fb259578baf41d7a0d']]"; + "['scripts/unix-producer-supervisor.sh', [29289, '1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a']]"; const PLATFORM_STEP_CONTRACT = Object.freeze([ ['Bootstrap supervised Windows conformance', ['name', 'if', 'shell', 'env', 'run']], ['Require protected validator revision', ['name', 'if', 'shell', 'env', 'run']], diff --git a/tests/conformance-contract.spec.ts b/tests/conformance-contract.spec.ts index 7a42578..b186224 100644 --- a/tests/conformance-contract.spec.ts +++ b/tests/conformance-contract.spec.ts @@ -215,7 +215,7 @@ describe('cross-repository conformance contract entrypoints', () => { 'utf8', ); expect(workflowDocument).toContain( - '4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72', + '36df4cbded3c82d9ae09857847c42314deb34490', ); expect(workflowDocument).toContain( 'a76137207d44db7ac83e0e19f07ec6913fb62230', diff --git a/tests/conformance-gaps.spec.ts b/tests/conformance-gaps.spec.ts index c2b3387..de5f7f0 100644 --- a/tests/conformance-gaps.spec.ts +++ b/tests/conformance-gaps.spec.ts @@ -52,15 +52,15 @@ const schemaPath = resolve( ); const windowsBootstrapFixturePath = resolve( workspaceRoot, - 'tests/fixtures/chat-4a1a8c-windows-bootstrap.ps1.br', + 'tests/fixtures/chat-36df4c-windows-bootstrap.ps1.br', ); const protectedWorkflowFixturePath = resolve( workspaceRoot, - 'tests/fixtures/chat-4a1a8c-client-v1-conformance.yml.br', + 'tests/fixtures/chat-36df4c-client-v1-conformance.yml.br', ); const unixSupervisorPreparationFixturePath = resolve( workspaceRoot, - 'tests/fixtures/chat-4a1a8c-unix-supervisor-preparation.sh.br', + 'tests/fixtures/chat-36df4c-unix-supervisor-preparation.sh.br', ); const windowsSupervisorTestFixturePath = resolve( workspaceRoot, @@ -249,7 +249,7 @@ const TEST_WINDOWS_SESSION_ZERO_QUARANTINE = [ ' information.SessionId));', ].join('\n'); const TEST_UNIX_SUPERVISOR_SOURCE_BINDING = - "['scripts/unix-producer-supervisor.sh', [29087, 'd14f65fa32c82b33ecee6224dc79c86857c2d8d28965e3fb259578baf41d7a0d']]"; + "['scripts/unix-producer-supervisor.sh', [29289, '1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a']]"; const TEST_UNIX_SUPERVISOR_PREPARATION_COMMAND = brotliDecompressSync( readFileSync(unixSupervisorPreparationFixturePath), ).toString('utf8'); @@ -1744,8 +1744,8 @@ describe('unresolved SDK #38 conformance gaps', () => { expect(lock.evidenceProducer).toEqual({ status: 'compatible', repository: 'OpenCoven/chat', - commit: '4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72', - tree: '76bd46a67952219e3fa72aee2132b329f51b4d96', + commit: '36df4cbded3c82d9ae09857847c42314deb34490', + tree: 'b461672769dc137e16f49e02dff8b94202029fca', packageManifest: { path: 'package.json', size: 4_044, @@ -1755,9 +1755,9 @@ describe('unresolved SDK #38 conformance gaps', () => { harness: { path: 'scripts/phase1-conformance.mjs', version: '2.0.0', - size: 198_878, + size: 199_089, sha256: - 'cafdb3dc02f878e8530d10fc882369aa0ad63cf9bf31e4406154a57c5ebb4f58', + 'd239fc8fcf06543064c355757422eada4c14df4a4bf94397268077de52f14dce', }, command: 'test:phase1-conformance', recordSchemaVersion: 2, @@ -1766,7 +1766,7 @@ describe('unresolved SDK #38 conformance gaps', () => { path: '.github/workflows/client-v1-conformance.yml', size: 462_746, sha256: - '7d872ba59ac77204efdf893fc2e50aabe1fb4bdbae7be463a0f2c96a1ea3294a', + '62ebc2c25e2ca996a4db109771f8b96f8f57bff2e5cbd131bf628be832644d18', job: 'platform-conformance', jobNameTemplate: 'platform-conformance ({platform})', aggregationJob: 'aggregate-conformance', @@ -1785,7 +1785,7 @@ describe('unresolved SDK #38 conformance gaps', () => { downloadArtifactAction: DOWNLOAD_ARTIFACT_ACTION, attestationAction: ATTEST_BUILD_PROVENANCE_ACTION, windowsBootstrapScriptSha256: - 'bb96b6aef894a9c9c5f5c2e54328ef9e4d8e0281c2661f01849c153910c3ac54', + 'd6e3734ac279990691f12c55a2d93518989b8bb221f546b0a283ed77f7425e42', validatorRevisionScriptSha256: '9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9', phase1RevisionsScriptSha256: @@ -1793,7 +1793,7 @@ describe('unresolved SDK #38 conformance gaps', () => { linuxKeyringSetupScriptSha256: '7b1ff87ab5d2230950632560230899cc450458a800a630c2788b53be8b13d200', unixSupervisorPreparationScriptSha256: - '657b2c3eb853ee011cc13aec2583eb5109fe889fa6a29d89dba24656121781f2', + '5f96dab61d9d612f80ca9f99ae61a7a2eedb7f051237938d6088cb4a90c053b7', unixToolPathSource: { path: 'scripts/executable-resolution.mjs', size: 9_154, @@ -1822,8 +1822,8 @@ describe('unresolved SDK #38 conformance gaps', () => { }, signerWorkflow: 'OpenCoven/chat/.github/workflows/client-v1-conformance.yml', - signerDigest: '4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72', - sourceDigest: '4a1a8c690fc50607b1b3d2a71a7baaf6bbb7db72', + signerDigest: '36df4cbded3c82d9ae09857847c42314deb34490', + sourceDigest: '36df4cbded3c82d9ae09857847c42314deb34490', predicateType: 'https://slsa.dev/provenance/v1', denySelfHostedRunners: true, }, @@ -1851,7 +1851,7 @@ describe('unresolved SDK #38 conformance gaps', () => { producer.workflow.windowsBootstrapScriptSha256, ); expect(sha256(TEST_WINDOWS_CHILD_BOOTSTRAP)).toBe( - 'be69af3748ae677cb8b7fd4342a7e23b5c6be46cb0a46963137d79e0791789f9', + 'f7bba77fdfa9b58c55e48e0d00706e5a598cd0409d1d44eec460654bce51573e', ); expect(() => verifyProtectedWorkflow( @@ -3603,7 +3603,7 @@ describe('unresolved SDK #38 conformance gaps', () => { yamlLiteralRun(TEST_UNIX_SUPERVISOR_PREPARATION_COMMAND), yamlLiteralRun( TEST_UNIX_SUPERVISOR_PREPARATION_COMMAND.replace( - 'd14f65fa32c82b33ecee6224dc79c86857c2d8d28965e3fb259578baf41d7a0d', + '1a83eb8495b671a9d490a26a8ce23745cdded680aa2b896142883acfde19064a', '0'.repeat(64), ), ), diff --git a/tests/fixtures/chat-36df4c-client-v1-conformance.yml.br b/tests/fixtures/chat-36df4c-client-v1-conformance.yml.br new file mode 100644 index 0000000..0752660 Binary files /dev/null and b/tests/fixtures/chat-36df4c-client-v1-conformance.yml.br differ diff --git a/tests/fixtures/chat-36df4c-unix-supervisor-preparation.sh.br b/tests/fixtures/chat-36df4c-unix-supervisor-preparation.sh.br new file mode 100644 index 0000000..031c9a0 Binary files /dev/null and b/tests/fixtures/chat-36df4c-unix-supervisor-preparation.sh.br differ diff --git a/tests/fixtures/chat-36df4c-windows-bootstrap.ps1.br b/tests/fixtures/chat-36df4c-windows-bootstrap.ps1.br new file mode 100644 index 0000000..b230980 Binary files /dev/null and b/tests/fixtures/chat-36df4c-windows-bootstrap.ps1.br differ diff --git a/tests/fixtures/chat-4a1a8c-client-v1-conformance.yml.br b/tests/fixtures/chat-4a1a8c-client-v1-conformance.yml.br deleted file mode 100644 index fd14570..0000000 Binary files a/tests/fixtures/chat-4a1a8c-client-v1-conformance.yml.br and /dev/null differ diff --git a/tests/fixtures/chat-4a1a8c-unix-supervisor-preparation.sh.br b/tests/fixtures/chat-4a1a8c-unix-supervisor-preparation.sh.br deleted file mode 100644 index a1dfadb..0000000 Binary files a/tests/fixtures/chat-4a1a8c-unix-supervisor-preparation.sh.br and /dev/null differ diff --git a/tests/fixtures/chat-4a1a8c-windows-bootstrap.ps1.br b/tests/fixtures/chat-4a1a8c-windows-bootstrap.ps1.br deleted file mode 100644 index 0009a59..0000000 Binary files a/tests/fixtures/chat-4a1a8c-windows-bootstrap.ps1.br and /dev/null differ