diff --git a/RELEASING.md b/RELEASING.md index dd6d614..406219e 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -214,7 +214,7 @@ passing evidence record for each target. The frozen Chat production source `edd4728792321771496df58bfc0e6122908a96ec` is exercised by the compatible schema-v2 producer at -`6a6e0c366dae2a9e75c34192993184b45e988bf8`. Its source lock was pinned by +`c4332b07969966fbf1d5fbfb0ea7231b896a8fc6`. Its source lock was pinned by reachable authority commit `a76137207d44db7ac83e0e19f07ec6913fb62230` to executable harness behavior revision `d4a5df371af271aa5d9d030d27c3820c92d76128`. diff --git a/conformance/client-v1-cross-repository-lock.json b/conformance/client-v1-cross-repository-lock.json index cb268cb..e782b2c 100644 --- a/conformance/client-v1-cross-repository-lock.json +++ b/conformance/client-v1-cross-repository-lock.json @@ -165,8 +165,8 @@ "evidenceProducer": { "status": "compatible", "repository": "OpenCoven/chat", - "commit": "6a6e0c366dae2a9e75c34192993184b45e988bf8", - "tree": "a6ec939d9962fd3685953862f4f81038db1c64d4", + "commit": "c4332b07969966fbf1d5fbfb0ea7231b896a8fc6", + "tree": "49d85359d73f00a3dad46c31187b0cb8f096ff6f", "packageManifest": { "path": "package.json", "size": 4044, @@ -183,8 +183,8 @@ "workflow": { "name": "client-v1 conformance", "path": ".github/workflows/client-v1-conformance.yml", - "size": 462746, - "sha256": "5b0128410851ee26ce11f7cd3cf246373c049968a5c6cb0d754faa2ddb51926f", + "size": 463033, + "sha256": "6f1a362be64f1bb0a6bac5980ac4acb87af7fed525a33d55ace9d111b9238fe3", "job": "platform-conformance", "jobNameTemplate": "platform-conformance ({platform})", "aggregationJob": "aggregate-conformance", @@ -219,11 +219,11 @@ ], "downloadArtifactAction": "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c", "attestationAction": "actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8", - "windowsBootstrapScriptSha256": "ed42c728ba7d8121022a18364c20497335ce886f65030a6993b7977f3dea6ba6", + "windowsBootstrapScriptSha256": "3af26f8e6ad32e6cf667f211ccd3b70372e80bfb5fa98507067c5e005890e88b", "validatorRevisionScriptSha256": "9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9", "phase1RevisionsScriptSha256": "507ce777b643d97154472eb23135f7965fd55cf0fcedcec30e93b23e6472d225", "linuxKeyringSetupScriptSha256": "7b1ff87ab5d2230950632560230899cc450458a800a630c2788b53be8b13d200", - "unixSupervisorPreparationScriptSha256": "276982b76db02acbd7699412c726c99f7f72187d00d9cccf289ed9f6a30268b7", + "unixSupervisorPreparationScriptSha256": "f12db533b2734b1c69559bc665cb4b9c763789ccec14e86761d69e398e0222e7", "unixToolPathSource": { "path": "scripts/executable-resolution.mjs", "size": 9154, @@ -231,7 +231,7 @@ }, "unixToolPathScriptSha256": "72ddd8865c68c5dde15d08decb771914d903f752d4909a52d1a10440eaadf36e", "unixProductionScriptSha256": "043066be50d0c3fa66f7151224242734cb2e9f39ffa9cf1c6f8106ab88c75a02", - "unixValidationScriptSha256": "b0ce7139bdf365d420c7dde478282f117cce97c1bec63d07cd95b64057121a89", + "unixValidationScriptSha256": "51d1402febcbcf9e5b117bdbc3ee2123a68d5ec6f560af5e629b727e7eb7b7bf", "validationGuardScriptSha256": "9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9", "validationScriptSha256": "72a2c0810c535d4e3d5e2b0c76bfc1822dc43d54ee653bb034fb977125dbd734", "attestationScriptSha256": "24af6732396013e8c1f23404cf38b5332e5a276c034d530c80d02247cb2a7347", @@ -249,8 +249,8 @@ ] }, "signerWorkflow": "OpenCoven/chat/.github/workflows/client-v1-conformance.yml", - "signerDigest": "6a6e0c366dae2a9e75c34192993184b45e988bf8", - "sourceDigest": "6a6e0c366dae2a9e75c34192993184b45e988bf8", + "signerDigest": "c4332b07969966fbf1d5fbfb0ea7231b896a8fc6", + "sourceDigest": "c4332b07969966fbf1d5fbfb0ea7231b896a8fc6", "predicateType": "https://slsa.dev/provenance/v1", "denySelfHostedRunners": true } diff --git a/docs/workflows/client-v1-cross-repository-conformance.md b/docs/workflows/client-v1-cross-repository-conformance.md index 78249e6..49e8889 100644 --- a/docs/workflows/client-v1-cross-repository-conformance.md +++ b/docs/workflows/client-v1-cross-repository-conformance.md @@ -28,7 +28,7 @@ There is no passing aggregate in this repository yet. The frozen Chat production source remains `edd4728792321771496df58bfc0e6122908a96ec`; the compatible evidence producer is the pinned `refs/heads/main` commit -`6a6e0c366dae2a9e75c34192993184b45e988bf8`. Its source lock was pinned by +`c4332b07969966fbf1d5fbfb0ea7231b896a8fc6`. Its source lock was pinned by reachable authority commit `a76137207d44db7ac83e0e19f07ec6913fb62230` to executable harness behavior revision `d4a5df371af271aa5d9d030d27c3820c92d76128`. @@ -275,7 +275,7 @@ aggregation job has no permissions and can only confirm successful completion of the protected matrix; it cannot generate, upload, attest, or replace a platform record. This structural template is exercised synthetically in tests only. The committed lock marks the reachable Chat producer at -`6a6e0c366dae2a9e75c34192993184b45e988bf8` compatible with the reviewed +`c4332b07969966fbf1d5fbfb0ea7231b896a8fc6` compatible with the reviewed schema-v2 workflow bytes. Release readiness remains blocked until this SDK validator merges, `CLIENT_V1_CONFORMANCE_VALIDATOR_REVISION` is rotated to the merged revision, and all three protected platform records and their GitHub diff --git a/scripts/github-conformance-evidence.mjs b/scripts/github-conformance-evidence.mjs index fad5336..6c103de 100644 --- a/scripts/github-conformance-evidence.mjs +++ b/scripts/github-conformance-evidence.mjs @@ -45,11 +45,11 @@ const WINDOWS_SUPERVISOR_ARTIFACT = 'phase1-process-supervisor-win32-x64'; const WINDOWS_SUPERVISOR_JOB_NAME = 'build-windows-supervisor'; const WINDOWS_SUPERVISOR_RUNNER_LABELS = ['macos-latest']; const REVIEWED_WINDOWS_BOOTSTRAP_SCRIPT_SHA256 = - 'ed42c728ba7d8121022a18364c20497335ce886f65030a6993b7977f3dea6ba6'; + '3af26f8e6ad32e6cf667f211ccd3b70372e80bfb5fa98507067c5e005890e88b'; const REVIEWED_WINDOWS_CHILD_BOOTSTRAP_SHA256 = - '0aeb19aea662a690f49c9683ed74178dfb0e9ac7c4d3abd786aa4d6de18ccd11'; + 'ed93898f4cdfafa16a63053d1abb48bd55de3654efa0a1999bfb977a45e9ba5f'; const REVIEWED_UNIX_SUPERVISOR_PREPARATION_SCRIPT_SHA256 = - '276982b76db02acbd7699412c726c99f7f72187d00d9cccf289ed9f6a30268b7'; + 'f12db533b2734b1c69559bc665cb4b9c763789ccec14e86761d69e398e0222e7'; const REVIEWED_UNIX_PRODUCTION_SCRIPT_SHA256 = '043066be50d0c3fa66f7151224242734cb2e9f39ffa9cf1c6f8106ab88c75a02'; const REVIEWED_UNIX_SUPERVISOR_SOURCE_BINDING = diff --git a/tests/conformance-contract.spec.ts b/tests/conformance-contract.spec.ts index 39033dd..3387c28 100644 --- a/tests/conformance-contract.spec.ts +++ b/tests/conformance-contract.spec.ts @@ -215,7 +215,7 @@ describe('cross-repository conformance contract entrypoints', () => { 'utf8', ); expect(workflowDocument).toContain( - '6a6e0c366dae2a9e75c34192993184b45e988bf8', + 'c4332b07969966fbf1d5fbfb0ea7231b896a8fc6', ); expect(workflowDocument).toContain( 'a76137207d44db7ac83e0e19f07ec6913fb62230', diff --git a/tests/conformance-gaps.spec.ts b/tests/conformance-gaps.spec.ts index 1c4149b..d6c1b20 100644 --- a/tests/conformance-gaps.spec.ts +++ b/tests/conformance-gaps.spec.ts @@ -52,15 +52,15 @@ const schemaPath = resolve( ); const windowsBootstrapFixturePath = resolve( workspaceRoot, - 'tests/fixtures/chat-6a6e0c-windows-bootstrap.ps1.br', + 'tests/fixtures/chat-c4332b-windows-bootstrap.ps1.br', ); const protectedWorkflowFixturePath = resolve( workspaceRoot, - 'tests/fixtures/chat-6a6e0c-client-v1-conformance.yml.br', + 'tests/fixtures/chat-c4332b-client-v1-conformance.yml.br', ); const unixSupervisorPreparationFixturePath = resolve( workspaceRoot, - 'tests/fixtures/chat-6a6e0c-unix-supervisor-preparation.sh.br', + 'tests/fixtures/chat-c4332b-unix-supervisor-preparation.sh.br', ); const windowsSupervisorTestFixturePath = resolve( workspaceRoot, @@ -1744,8 +1744,8 @@ describe('unresolved SDK #38 conformance gaps', () => { expect(lock.evidenceProducer).toEqual({ status: 'compatible', repository: 'OpenCoven/chat', - commit: '6a6e0c366dae2a9e75c34192993184b45e988bf8', - tree: 'a6ec939d9962fd3685953862f4f81038db1c64d4', + commit: 'c4332b07969966fbf1d5fbfb0ea7231b896a8fc6', + tree: '49d85359d73f00a3dad46c31187b0cb8f096ff6f', packageManifest: { path: 'package.json', size: 4_044, @@ -1764,9 +1764,9 @@ describe('unresolved SDK #38 conformance gaps', () => { workflow: { name: 'client-v1 conformance', path: '.github/workflows/client-v1-conformance.yml', - size: 462_746, + size: 463_033, sha256: - '5b0128410851ee26ce11f7cd3cf246373c049968a5c6cb0d754faa2ddb51926f', + '6f1a362be64f1bb0a6bac5980ac4acb87af7fed525a33d55ace9d111b9238fe3', job: 'platform-conformance', jobNameTemplate: 'platform-conformance ({platform})', aggregationJob: 'aggregate-conformance', @@ -1785,7 +1785,7 @@ describe('unresolved SDK #38 conformance gaps', () => { downloadArtifactAction: DOWNLOAD_ARTIFACT_ACTION, attestationAction: ATTEST_BUILD_PROVENANCE_ACTION, windowsBootstrapScriptSha256: - 'ed42c728ba7d8121022a18364c20497335ce886f65030a6993b7977f3dea6ba6', + '3af26f8e6ad32e6cf667f211ccd3b70372e80bfb5fa98507067c5e005890e88b', validatorRevisionScriptSha256: '9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9', phase1RevisionsScriptSha256: @@ -1793,7 +1793,7 @@ describe('unresolved SDK #38 conformance gaps', () => { linuxKeyringSetupScriptSha256: '7b1ff87ab5d2230950632560230899cc450458a800a630c2788b53be8b13d200', unixSupervisorPreparationScriptSha256: - '276982b76db02acbd7699412c726c99f7f72187d00d9cccf289ed9f6a30268b7', + 'f12db533b2734b1c69559bc665cb4b9c763789ccec14e86761d69e398e0222e7', unixToolPathSource: { path: 'scripts/executable-resolution.mjs', size: 9_154, @@ -1805,7 +1805,7 @@ describe('unresolved SDK #38 conformance gaps', () => { unixProductionScriptSha256: '043066be50d0c3fa66f7151224242734cb2e9f39ffa9cf1c6f8106ab88c75a02', unixValidationScriptSha256: - 'b0ce7139bdf365d420c7dde478282f117cce97c1bec63d07cd95b64057121a89', + '51d1402febcbcf9e5b117bdbc3ee2123a68d5ec6f560af5e629b727e7eb7b7bf', validationGuardScriptSha256: '9abbfe73f19e47650321e6afb2c2a7db4facbf05a72db30241dfa94261cdcad9', validationScriptSha256: @@ -1822,8 +1822,8 @@ describe('unresolved SDK #38 conformance gaps', () => { }, signerWorkflow: 'OpenCoven/chat/.github/workflows/client-v1-conformance.yml', - signerDigest: '6a6e0c366dae2a9e75c34192993184b45e988bf8', - sourceDigest: '6a6e0c366dae2a9e75c34192993184b45e988bf8', + signerDigest: 'c4332b07969966fbf1d5fbfb0ea7231b896a8fc6', + sourceDigest: 'c4332b07969966fbf1d5fbfb0ea7231b896a8fc6', predicateType: 'https://slsa.dev/provenance/v1', denySelfHostedRunners: true, }, @@ -1851,7 +1851,7 @@ describe('unresolved SDK #38 conformance gaps', () => { producer.workflow.windowsBootstrapScriptSha256, ); expect(sha256(TEST_WINDOWS_CHILD_BOOTSTRAP)).toBe( - '0aeb19aea662a690f49c9683ed74178dfb0e9ac7c4d3abd786aa4d6de18ccd11', + 'ed93898f4cdfafa16a63053d1abb48bd55de3654efa0a1999bfb977a45e9ba5f', ); expect(() => verifyProtectedWorkflow( diff --git a/tests/fixtures/chat-6a6e0c-client-v1-conformance.yml.br b/tests/fixtures/chat-6a6e0c-client-v1-conformance.yml.br deleted file mode 100644 index f0cef70..0000000 Binary files a/tests/fixtures/chat-6a6e0c-client-v1-conformance.yml.br and /dev/null differ diff --git a/tests/fixtures/chat-6a6e0c-unix-supervisor-preparation.sh.br b/tests/fixtures/chat-6a6e0c-unix-supervisor-preparation.sh.br deleted file mode 100644 index 8ca40f8..0000000 Binary files a/tests/fixtures/chat-6a6e0c-unix-supervisor-preparation.sh.br and /dev/null differ diff --git a/tests/fixtures/chat-6a6e0c-windows-bootstrap.ps1.br b/tests/fixtures/chat-6a6e0c-windows-bootstrap.ps1.br deleted file mode 100644 index 49d1f3c..0000000 Binary files a/tests/fixtures/chat-6a6e0c-windows-bootstrap.ps1.br and /dev/null differ diff --git a/tests/fixtures/chat-c4332b-client-v1-conformance.yml.br b/tests/fixtures/chat-c4332b-client-v1-conformance.yml.br new file mode 100644 index 0000000..4827696 Binary files /dev/null and b/tests/fixtures/chat-c4332b-client-v1-conformance.yml.br differ diff --git a/tests/fixtures/chat-c4332b-unix-supervisor-preparation.sh.br b/tests/fixtures/chat-c4332b-unix-supervisor-preparation.sh.br new file mode 100644 index 0000000..24c6ba9 Binary files /dev/null and b/tests/fixtures/chat-c4332b-unix-supervisor-preparation.sh.br differ diff --git a/tests/fixtures/chat-c4332b-windows-bootstrap.ps1.br b/tests/fixtures/chat-c4332b-windows-bootstrap.ps1.br new file mode 100644 index 0000000..05aaf77 Binary files /dev/null and b/tests/fixtures/chat-c4332b-windows-bootstrap.ps1.br differ