CalvinBackup/OBLITERATUS
1
0
Fork 0
mirror of https://github.com/elder-plinius/OBLITERATUS.git synced 2026-08-30 06:30:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci: release tested source snapshots only

Browse Source
This commit is contained in:
Joseph Magly
2026-08-22 11:28:30 -04:00
parent c546d30e9e
commit beb4707401
15 changed files with 104 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/SUPPLY_CHAIN_POLICY.md
+12 -12
View File
@@ -11,21 +11,21 @@ license-tool transitive dependencies are covered by `uv.lock`.
## Digest-bound release evidence
Release artifacts use a build-once evidence chain. The release package job is
the sole producer of the wheel and source distribution. It also emits a bound
CycloneDX SBOM and a canonical `SHA256SUMS` manifest covering both distributions
and the SBOM.
The release artifact is a deterministic ZIP snapshot of the tested repository
commit. No wheel, source distribution, executable, or other compiled package is
published. The release job creates the snapshot once with `git archive`, then
emits a bound CycloneDX source SBOM and a canonical `SHA256SUMS` manifest.
GitHub's keyless Sigstore-backed attestation service signs two in-toto
statements for that release set:
- SLSA build provenance for every subject named by `SHA256SUMS`;
- an SBOM attestation binding the CycloneDX document to the wheel digest.
- an SBOM attestation binding the CycloneDX document to the source ZIP digest.
The supply-chain job downloads the package job's retained artifact, verifies
`SHA256SUMS`, and revalidates the SBOM binding. It must not rebuild a substitute
wheel. Publication must use these same tested and attested bytes. A commit,
dependency lock, build instruction, artifact, checksum manifest, SBOM, or
`SHA256SUMS`, and revalidates the SBOM binding. It must not create a substitute
archive. Publication must use this same tested and attested ZIP. A commit,
dependency lock, snapshot instruction, artifact, checksum manifest, SBOM, or
release-policy change invalidates the evidence.
Consumers can perform the portable integrity check with:
@@ -34,7 +34,7 @@ Consumers can perform the portable integrity check with:
sha256sum --check SHA256SUMS
```
For authenticity and provenance, verify each distribution against the canonical
For authenticity and provenance, verify the source ZIP against the canonical
repository with GitHub's attestation verifier. A checksum without its signed
provenance proves byte integrity only; it does not prove who built the artifact
or which source and build instructions produced it.
@@ -45,9 +45,9 @@ The Supply chain job retains these artifacts for 14 days:
- one redacted Gitleaks JSON report for the checkout;
- OSV audit JSON and scanner status for Python 3.10, 3.11, and 3.12 on Linux;
- a JSON license inventory for all packaged extras;
- a CycloneDX 1.5 SBOM bound to the built wheel by SHA-256;
- the policy decisions and built wheel used by those checks.
- a JSON license inventory for all supported dependency extras;
- a CycloneDX 1.5 source SBOM bound to the repository ZIP by SHA-256;
- the policy decisions and exact tested source ZIP used by those checks.
Every secret finding and every OSV vulnerability is blocking by default. OSV
does not provide a normalized severity for every advisory, so the policy treats