Repository navigation

Add binary attestation contracts and release build guards - #1262

Closed

prk-Jr wants to merge 167 commits into

mainfrom

spec/1235-release-attestation

Closed

Add binary attestation contracts and release build guards#1262
prk-Jr wants to merge 167 commits into
mainfrom
spec/1235-release-attestation

Commits on Oct 9, 2026
- Design release binary attestation
  prk-Jr
  committed
  91c1907
- Tighten release attestation verification and deployment contracts
  prk-Jr
  committed
  c58aa77
- Require reproducible release builds and operator replay
  prk-Jr
  committed
  fd5cc4d
- Extend release attestation contracts to all server adapters
  prk-Jr
  committed
  712f355
- Merge branch 'main' into spec/1235-release-attestation
  aram356
  authored
  7f6056b
Commits on Oct 12, 2026
- Resolve release attestation review findings
  prk-Jr
  committed
  24a8a71
- Merge branch 'main' into spec/1235-release-attestation
  prk-Jr
  authored
  d29812c
- Merge branch 'main' into spec/1235-release-attestation
  aram356
  authored
  a42fe6b
Commits on Oct 13, 2026
- Merge branch 'main' into spec/1235-release-attestation
  prk-Jr
  authored
  44c5b56
- Plan attested release implementation and integration milestones
  prk-Jr
  committed
  484d2c0
- Close spec-to-plan verification and qualification gaps
  prk-Jr
  committed
  58d2e7a
- Keep release spec and implementation on the existing PR
  prk-Jr
  committed
  d157766
- Clarify release implementation prerequisites
  prk-Jr
  committed
  8a45cc1
- Add strict release document utilities
  prk-Jr
  committed
  1cfca13
- Reject invalid keys in nested producer arrays
  prk-Jr
  committed
  c299409
- Normalize serialization errors and identity fields
  prk-Jr
  committed
  fbb88d2
- Record release utility verification and review
  prk-Jr
  committed
  7acdfb3
- Define fixed release inputs and preflight policy
  prk-Jr
  committed
  c9076d0
- Require the SPDX 2.3 predicate in release policy
  prk-Jr
  committed
  31ee073
- Check discovered test sources and nested Cargo overrides
  prk-Jr
  committed
  b89552d
- Record preflight verification and review
  prk-Jr
  committed
  7dd91ce
- Derive immutable release build facts
  prk-Jr
  committed
  bfb6974
- Record immutable build facts verification
  prk-Jr
  committed
  2956485
- Bind release JS inputs to a checked inventory
  prk-Jr
  committed
  e1606fa
- Record checked JS input verification
  prk-Jr
  committed
  d668129
- Record release JS composition evidence
  prk-Jr
  committed
  eeb68f9
- Check all JavaScript validation sources
  prk-Jr
  committed
  27080c5
- Check lifecycle output package ownership
  prk-Jr
  committed
  c9683ba
- Bind installed tree modes to opened files
  prk-Jr
  committed
  9684fd8
- Record JS composition verification and source checks
  prk-Jr
  committed
  8c8e9a7
- Build and compare shared release JS inputs
  prk-Jr
  committed
  2236876
- Bound release Git acquisition and validate JS inventory sizes
  prk-Jr
  committed
  3e7fdc3
Commits on Oct 14, 2026
- Record independent JS build verification
  prk-Jr
  committed
  c27d50f
- Add release environment qualification checks
  prk-Jr
  committed
  481f8c7
- Validate qualification probe phases and numeric floors
  prk-Jr
  committed
  7c8f279
- Protect immutable source ancestors in macOS qualification
  prk-Jr
  committed
  b48b92c
- Record local qualification framework verification
  prk-Jr
  committed
  54f6c6e
- Add confined Rust recipe and executable inspection framework
  prk-Jr
  committed
  5476b7c
- Correct release runtime configuration and startup gates
  prk-Jr
  committed
  9988a56
- Bind release boundary imports to the source-owned module
  prk-Jr
  committed
  2a2db6d
- Terminate bounded process groups after leader exit
  prk-Jr
  committed
  7abb8e8
- Record local Rust recipe verification and integration gates
  prk-Jr
  committed
  99d2ec7
- Replace Python release tooling and address attestation review
  prk-Jr
  committed
  6d0efda
- Align crate documentation with release build guards
  prk-Jr
  committed
  6a07ccc
Commits on Oct 15, 2026
- Define fixed Rust release inputs and preflight policy
  prk-Jr
  committed
  90a87c3
- Authenticate release source and helper closure in preflight
  prk-Jr
  committed
  917620d
- Parse release evidence under embedded consumer policy and bound gh
  prk-Jr
  committed
  7450b37
- Harden release source authentication and preflight inputs
  prk-Jr
  committed
  8a68537
- Merge remote-tracking branch 'origin/main' into spec/1235-release-attestation
  prk-Jr
  committed
  a7d1740
- Make escaped gh descendant test portable to Linux
  prk-Jr
  committed
  019d791
- Add bounded release child-process supervision
  prk-Jr
  committed
  f407fe4
- Avoid secret-bearing redaction test diagnostics
  prk-Jr
  committed
  9473dde
- Verify official release evidence through the ts CLI
  prk-Jr
  committed
  da3c9ce
- Gate macOS offline test imports by platform
  prk-Jr
  committed
  39f59bb
- Add guarded producer boundaries and original material verification
  prk-Jr
  committed
  39fbf7c
- Preserve bounded diagnostics for failed denial probes
  prk-Jr
  committed
  58da0d7
- Extract authenticated dependency archives into bounded private state
  prk-Jr
  committed
  69583d8
- Specify private propagation for recursive read-only mounts
  prk-Jr
  committed
  c9d0b5f
- Review lifecycle declarations against authenticated package manifests
  prk-Jr
  committed
  4473b75
- Require Git object bodies to match preflight sizes
  prk-Jr
  committed
  fd7c2d3
- Share bounded Git object verification across source and Cargo policies
  prk-Jr
  committed
  67aaa3f
- Keep boundary sibling fixtures alive until parent cleanup
  prk-Jr
  committed
  e07944b
- Validate pinned consumer verification against real signed fixtures
  prk-Jr
  committed
  4eebe62
- Build and compare two fresh offline JavaScript installations
  prk-Jr
  committed
  2edd46c
- Support reviewed layouts in locked npm originals
  prk-Jr
  committed
  e2260d4
- Optimize full JavaScript acceptance checks with test safety retained
  prk-Jr
  committed
  cbd9604
- Preserve approved source context in collector rejection fixtures
  prk-Jr
  committed
  1a2c460
- Record two fresh JS build acceptance evidence
  prk-Jr
  committed
  a439929
- Reap escaped macOS sandbox descendants by sandbox instance
  prk-Jr
  committed
  60fafa7
- Mark Task 7 complete after macOS escape containment passes CI
  prk-Jr
  committed
  94fabc2
- Add closed release recipe planning with checked A/B profiles
  prk-Jr
  committed
  a7ae687
- Apply role umasks to confined release commands
  prk-Jr
  committed
  8678c3e
- Prepare confined Cargo execution pieces for release recipes
  prk-Jr
  committed
  03fa8e5
Commits on Oct 16, 2026
- Run a confined candidate Cargo build of the Fastly Wasm in Linux CI
  prk-Jr
  committed
  2d933b0
- Install worker-build with its published lockfile
  prk-Jr
  committed
  ce50e5d
- Merge branch 'main' into spec/1235-release-attestation
  prk-Jr
  authored
  1b23a87
- Record the first confined candidate Cargo build evidence
  prk-Jr
  committed
  efa34f7
- Compare Fastly A and B builds byte for byte with remapped paths
  prk-Jr
  committed
  d472aaa
- Name recipe build roles Canonical and Reproduction
  prk-Jr
  committed
  26045fd
- Record Fastly canonical and reproduction byte equality evidence
  prk-Jr
  committed
  f0511dc
- Gate final Fastly bytes on Wasm validation and a Viceroy request
  prk-Jr
  committed
  4cc5700
- Record Fastly final-byte runtime gate evidence
  prk-Jr
  committed
  7bc57a1
- Normalize vendored Git manifests in the producer
  prk-Jr
  committed
  bf3057d
- Record producer-normalized manifest evidence
  prk-Jr
  committed
  be3e16d
- Add confined Linux CLI candidate recipe and startup evidence
  prk-Jr
  committed
  10167c6
- Build the Linux candidate probe inside the GNU baseline
  prk-Jr
  committed
  b4fd6b1
- Acknowledge container creation before starting confined processes
  prk-Jr
  committed
  e813dbf
- Report bounded final-byte context for rejected build paths
  prk-Jr
  committed
  3fc1ca8
- Confine GNU build storage and enforce bound artifact paths
  prk-Jr
  committed
  d75c5ea
- Keep release fixtures inside owned build storage
  prk-Jr
  committed
  639596d
- Merge main into release attestation branch
  prk-Jr
  committed
  0299c3a
- Record successful Linux CLI candidate validation
  prk-Jr
  committed
  ac32b75
- Disable background Git maintenance in source fixtures
  prk-Jr
  committed
  8fbee5a
Commits on Oct 19, 2026
- Merge branch 'main' into spec/1235-release-attestation
  prk-Jr
  authored
  4c523cc
- Format documentation proposal scripts with the docs Prettier config
  prk-Jr
  committed
  8510fde
- Prepare Apple CLI candidate recipes for macOS boundaries
  prk-Jr
  committed
  c78185b
- Exercise Apple CLI candidates on native macOS runners
  prk-Jr
  committed
  edf4697
- Isolate Darwin Cargo from ambient OpenSSL configuration
  prk-Jr
  committed
  84f1b58
- Merge branch 'main' into spec/1235-release-attestation
  prk-Jr
  authored
  8a63be8
- Update Darwin plan environment regression expectations
  prk-Jr
  committed
  9867d8f
- Capture confined Cargo unit observations for candidate recipes
  prk-Jr
  committed
  4176b81
- Hide optional macOS OpenSSL configuration from confined Cargo
  prk-Jr
  committed
  76fd76c
- Retain verified Cargo package origins during vendoring
  prk-Jr
  committed
  850d203
- Preserve host dependency identities in Cargo composition metadata
  prk-Jr
  committed
  203c7db
- Create fresh source checkouts under canonical temporary paths
  prk-Jr
  committed
  22d600e
- Merge main Rust CI cache updates into attestation implementation
  prk-Jr
  committed
  456d150
- Validate candidate release transfers and comparison outcomes
  prk-Jr
  committed
  6c065ad
- Bind candidate composition to verified source and final artifact bytes
  prk-Jr
  committed
  6bc3dcf
- Retain candidate tool identities and observed runtime requirements
  prk-Jr
  committed
  3fef2c5
- Add private SPDX rendering and observed archive profile tests
  prk-Jr
  committed
  a86fa4a
- Retain measured build receipts and correct AWS feature policy
  prk-Jr
  committed
  d8fdb26
- Export checked JS contributors and candidate build receipts
  prk-Jr
  committed
  b99a176
- Project verified Cargo packages into SPDX components
  prk-Jr
  committed
  775696b
- Bind Darwin recipes to detached SDK contents
  prk-Jr
  committed
  df4a6e5
Commits on Oct 20, 2026
Commits on Oct 21, 2026
Commits on Oct 22, 2026
- Record hosted receipt and Apple measurement acceptance
  prk-Jr
  committed
  6d6c630
- Measure the selected Apple toolchain library directory
  prk-Jr
  committed
  add479f
- Merge main into the release attestation branch
  prk-Jr
  committed
  7c6de17
- Align candidate tool pins with the merged toolchain
  prk-Jr
  committed
  810862e
- Merge branch 'main' into spec/1235-release-attestation
  prk-Jr
  authored
  383e2d7
- Generate authentication fixture keys from kernel randomness
  prk-Jr
  committed
  0bf4523
- Read kernel entropy without constant key buffers
  prk-Jr
  committed
  d4408d2
- Vendor direct file links from verified Git objects
  prk-Jr
  committed
  0c67be6
- Reject unmeasured JavaScript licenses and align Git fixtures
  prk-Jr
  committed
  7e41dfa
- Allow exact Cargo registry bookkeeping in vendored builds
  prk-Jr
  committed
  5d194d0
- Accept the reviewed Fastly asynchronous I/O host module
  prk-Jr
  committed
  41560cf
- Reconcile SPDX fixtures and native coverage dependencies
  prk-Jr
  committed
  9368a57
- Adapt workflow job observations into typed collector inputs
  prk-Jr
  committed
  060172f
- Measure selected Fastly host tools inside the denied boundary
  prk-Jr
  committed
  9999c39
- Keep optional reproductions nonblocking in the workflow adapter
  prk-Jr
  committed
  99a8c58
- Merge remote-tracking branch 'origin/spec/1235-release-attestation' into claude/workflow-adapter
  prk-Jr
  committed
  122b786

Commits

Commits on Oct 9, 2026

Commits on Oct 12, 2026

Commits on Oct 13, 2026

Commits on Oct 14, 2026

Commits on Oct 15, 2026

Commits on Oct 16, 2026

Commits on Oct 19, 2026

Commits on Oct 20, 2026

Commits on Oct 21, 2026