Repository navigation
Conversation
Collaborator
Author
|
Rehearsal record at Run · immutable release. Release ID 420703797, 17 exact assets, no index/build-evidence/build-recipe/rebuild-check/inventory companions. All four builds and signers passed. Publication, initial release-ID/immutability validation, Independent verification below completed with exit status 0: one release verification, 17 asset verifications, 16 attestation verifications (four binaries × provenance/SPDX × signer-prefix/exact tag-ref identity), 16 checksum entries and four signed-SPDX predicate comparisons. It uses the guide commands with only repository/tag/commit substitutions. Workflow CLI: 2.102.0; independent CLI: 2.97.0. Full independent verification transcript — commands and output |
Collaborator
Author
|
Successful rehearsal at Workflow — all jobs passed · immutable release · publisher log. Release ID 420812096: immutable=true, draft=false, 17 exact nonempty assets (four binaries, four SPDX2.3 documents, eight real action-produced bundles and SHA256SUMS). No index, inventory, build-evidence, build-recipe or rebuild-check companions. All four builds, all four isolated signing jobs, publication, cryptographic release/membership verification and the final release-ID/API read passed. The connection fix is exercised successfully; no mutation retry or tag reuse occurred. Immutable Independent verification completed with exit status 0 using checksum-verified GitHub CLI2.102.0, matching the publisher's recorded version: one release verification, 17 asset verifications, 16 attestation verifications (four binaries × provenance/SPDX × signer-prefix/exact tag-ref identity), all16 checksum entries and four signed-SPDX predicate comparisons. Commands are the guide's verification blocks with only repository/tag/commit substitutions. Full verification transcript — commands and output |
Collaborator
Author
|
Rehearsal GitHub CLI 2.102.0 matches the publisher log. Its official macOS ARM archive was checksum-verified (SHA-256 Offline proofAll four binaries passed provenance and SPDX verification under OS-enforced network denial, with both signer identity forms, exact source/ref/signer digest pins, self-hosted runners denied, and published-SPDX predicate equality. No gh --version
gh attestation trusted-root > trusted_root.jsonl
shasum -a 256 trusted_root.jsonl
/usr/bin/sandbox-exec -p '(version 1)(allow default)(deny network*)' env GH_TOKEN=offline-verification-no-network bash -x offline-verify.shFull offline commands and success outputLocal verified Fastly routeThe downloaded wasm and host CLI first passed provenance and immutable release membership checks. Viceroy 0.21.0, pinned in the source tree, served a real configured page: HTTP 200, fixture origin marker, injected JS and the exact full source SHA in Complete local commands and outputset -euxo pipefail
REPO_ROOT=<source-checkout>
EVIDENCE=<evidence-directory>
WORK="$EVIDENCE/viceroy-smoke-2"
TS="$EVIDENCE/ts-aarch64-apple-darwin"
WASM="$EVIDENCE/trusted-server-fastly.wasm"
VICEROY=<pinned-runtime-tools>/viceroy
mkdir "$WORK"
for port in 18888 17676; do
if lsof -nP -iTCP:"$port" -sTCP:LISTEN; then exit 1; fi
done
cp "$REPO_ROOT/edgezero.toml" "$REPO_ROOT/fastly.toml" "$WORK/"
cp "$REPO_ROOT/trusted-server.example.toml" "$WORK/app.toml"
ln -s "$REPO_ROOT/crates" "$WORK/crates"
node - "$WORK" <<'JS'
const fs=require('node:fs');const root=process.argv[2];
const path=`${root}/app.toml`;let text=fs.readFileSync(path,'utf8');text=text.replace('domain = "example.com"','domain = "127.0.0.1"').replace('cookie_domain = ".example.com"','cookie_domain = "127.0.0.1"');text=text.replace('origin_url = "https://origin.example.com"','origin_url = "http://127.0.0.1:18888"');if(!text.includes('origin_url = "http://127.0.0.1:18888"'))throw Error('Origin fixture replacement failed');fs.writeFileSync(path,text);
const fastly=`${root}/fastly.toml`;text=fs.readFileSync(fastly,'utf8').replace('env = "FASTLY_KEY"','data = "fictional-local-api-key"');fs.writeFileSync(fastly,text);
JS
chmod u+x "$TS"
"$TS" --version
(cd "$WORK" && "$TS" config push --adapter fastly --local \
--manifest "$WORK/edgezero.toml" --app-config "$WORK/app.toml" --no-diff --yes)
"$VICEROY" --version
cat > "$WORK/origin.mjs" <<'JS'
import http from 'node:http';
http.createServer((req,res)=>{res.writeHead(200,{'content-type':'text/html'});res.end('<!doctype html><html><head><title>Local release proof</title></head><body>phase1-verified-origin-marker</body></html>');}).listen(18888,'127.0.0.1');
JS
node "$WORK/origin.mjs" > "$WORK/origin.log" 2>&1 &
origin_pid=$!
cleanup() {
if [[ -n "${viceroy_pid:-}" ]]; then kill "$viceroy_pid" 2>/dev/null || true; wait "$viceroy_pid" 2>/dev/null || true; fi
kill "$origin_pid" 2>/dev/null || true
wait "$origin_pid" 2>/dev/null || true
}
trap cleanup EXIT
"$VICEROY" serve -C "$WORK/fastly.toml" --addr 127.0.0.1:17676 "$WASM" > "$WORK/viceroy.log" 2>&1 &
viceroy_pid=$!
curl --fail --silent --show-error --retry 20 --retry-connrefused --retry-delay 1 \
--retry-max-time 45 --max-time 30 -H 'Host: 127.0.0.1' \
-D "$WORK/headers.txt" -o "$WORK/body.html" http://127.0.0.1:17676/
cat "$WORK/headers.txt"
node - "$WORK" <<'JS'
const fs=require('node:fs');const assert=require('node:assert/strict');const crypto=require('node:crypto');const work=process.argv[2];const headers=fs.readFileSync(`${work}/headers.txt`,'utf8');const body=fs.readFileSync(`${work}/body.html`);assert.match(headers,/^HTTP\/1\.1 200/m);assert.match(headers,/^x-ts-version: 922c2211c0cc7941bfc8ffa9f775ef8ac0971232\r?$/im);assert.ok(body.includes('phase1-verified-origin-marker'));assert.ok(body.includes('/static/tsjs=tsjs-unified.min.js'));console.log(`SUCCESS: configured Viceroy page returned HTTP200, origin marker, injected JS and exact release source header; ${body.length} bytes, sha256=${crypto.createHash('sha256').update(body).digest('hex')}`);
JS |
Collaborator
Author
|
Rehearsal
Download recordThe ordinary release download was interrupted because transfer throughput was too low. Read-only bounded range downloads fetched the same release URLs; complete assembled files matched the published SHA-256 metadata before verification. No binary was substituted from a CI artifact or another release. Small companions were independently digest-checked as well. Commands and output follow; scripts existed only in the temporary evidence directory. Download commands and complete digest resultsgh api repos/prk-Jr/trusted-server/releases/tags/v0.0.0-rehearsal.4 > release-metadata.json
node range-download.mjs
node small-download.mjsimport fs from 'node:fs';
import {promisify} from 'node:util';
import {execFile} from 'node:child_process';
import crypto from 'node:crypto';
const run=promisify(execFile);
const release=JSON.parse(fs.readFileSync('release-metadata.json'));
const binaries=release.assets.filter(a=> !a.name.includes('.') || a.name.endsWith('.wasm'));
fs.mkdirSync('ranges',{recursive:true});
const tasks=[]; const chunk=2*1024*1024;
for(const a of binaries) for(let offset=0;offset<a.size;offset+=chunk) tasks.push({a,offset,end:Math.min(a.size-1,offset+chunk-1)});
let done=0;
async function worker(){while(tasks.length){const {a,offset,end}=tasks.shift();const out=`ranges/${a.name}.${offset}`; await run('curl',['--fail','--silent','--show-error','--location','--retry','2','--max-time','180','--range',`${offset}-${end}`,'--max-filesize',String(end-offset+1),'--output',out,a.browser_download_url]);if(fs.statSync(out).size!==end-offset+1)throw Error(`Range size mismatch: ${a.name} ${offset}`);done++;if(done%16===0)console.log(`Downloaded ${done} ranges`);}}
await Promise.all(Array.from({length:16},worker));
for(const a of binaries){const dest=fs.openSync(`${a.name}.assembled`,'w');const hash=crypto.createHash('sha256');for(let o=0;o<a.size;o+=chunk){const b=fs.readFileSync(`ranges/${a.name}.${o}`);fs.writeSync(dest,b);hash.update(b);}fs.closeSync(dest);if(`sha256:${hash.digest('hex')}`!==a.digest)throw Error(`Digest mismatch: ${a.name}`);fs.renameSync(`${a.name}.assembled`,a.name);console.log(`SUCCESS: ${a.name}: ${a.size} bytes match ${a.digest}`);}import fs from 'node:fs';import crypto from 'node:crypto';import {promisify} from 'node:util';import {execFile} from 'node:child_process';
const run=promisify(execFile);const {assets}=JSON.parse(fs.readFileSync('release-metadata.json'));await Promise.all(assets.filter(a=>a.size<2*1024*1024).map(async a=>{const valid=()=>fs.existsSync(a.name)&&`sha256:${crypto.createHash('sha256').update(fs.readFileSync(a.name)).digest('hex')}`===a.digest;if(!valid())await run('curl',['--fail','--silent','--show-error','--location','--max-time','180','--output',a.name,a.browser_download_url]);if(!valid())throw Error(`Bad asset: ${a.name}`);console.log(`SUCCESS: ${a.name} matches published digest`);}));Full online verification transcriptA small shell wrapper prints an explicit success line after each successful attestation command; JSON results remain separate for predicate comparison. |
Collaborator
Author
|
Rehearsal Build/sign/publication run passed all seven builds/signing jobs and immutable publication. Published release: ID 421431085, Full online verification transcript, part 1. A wrapper prints explicit success after each successful attestation command; JSON output stays separate for SPDX equality. |
Collaborator
Author
|
Rehearsal Build/sign/publication run passed all seven builds/signing jobs and immutable publication. Published release: ID 421431085, Full online verification transcript, part 2. |
Collaborator
Author
|
Rehearsal Build/sign/publication run passed all seven builds/signing jobs and immutable publication. Published release: ID 421431085, All seven binaries passed provenance and SPDX verification with both signer identity forms, exact source/ref/signer pins, self-hosted runners denied and published-SPDX predicate equality under OS-enforced network denial. No gh attestation trusted-root > trusted_root.jsonl
shasum -a 256 trusted_root.jsonl
/usr/bin/sandbox-exec -p '(version 1)(allow default)(deny network*)' env GH_TOKEN=offline-verification-no-network bash -x offline-verify.sh |
Collaborator
Author
|
Rehearsal Build/sign/publication run passed all seven builds/signing jobs and immutable publication. Published release: ID 421431085, Verified release wasm and host CLI were executed locally with pinned Viceroy 0.21.0, fictional loopback configuration and a local Node origin. A real page returned HTTP200, origin marker, injected JS and the exact full source SHA in set -euxo pipefail
REPO_ROOT=<source-checkout>
EVIDENCE=<evidence-directory>
WORK="$EVIDENCE/viceroy-smoke"
TS="$EVIDENCE/ts-aarch64-apple-darwin"
WASM="$EVIDENCE/trusted-server-fastly.wasm"
VICEROY=<pinned-runtime-tools>/viceroy
mkdir "$WORK"
for port in 18888 17676; do
if lsof -nP -iTCP:"$port" -sTCP:LISTEN; then exit 1; fi
done
cp "$REPO_ROOT/edgezero.toml" "$REPO_ROOT/fastly.toml" "$WORK/"
cp "$REPO_ROOT/trusted-server.example.toml" "$WORK/app.toml"
ln -s "$REPO_ROOT/crates" "$WORK/crates"
node - "$WORK" <<'JS'
const fs=require('node:fs');const root=process.argv[2];
const path=`${root}/app.toml`;let text=fs.readFileSync(path,'utf8');text=text.replace('domain = "example.com"','domain = "127.0.0.1"').replace('cookie_domain = ".example.com"','cookie_domain = "127.0.0.1"');text=text.replace('origin_url = "https://origin.example.com"','origin_url = "http://127.0.0.1:18888"');if(!text.includes('origin_url = "http://127.0.0.1:18888"'))throw Error('Origin fixture replacement failed');fs.writeFileSync(path,text);
const fastly=`${root}/fastly.toml`;text=fs.readFileSync(fastly,'utf8').replace('env = "FASTLY_KEY"','data = "fictional-local-api-key"');fs.writeFileSync(fastly,text);
JS
chmod u+x "$TS"
"$TS" --version
(cd "$WORK" && "$TS" config push --adapter fastly --local \
--manifest "$WORK/edgezero.toml" --app-config "$WORK/app.toml" --no-diff --yes)
"$VICEROY" --version
cat > "$WORK/origin.mjs" <<'JS'
import http from 'node:http';
http.createServer((req,res)=>{res.writeHead(200,{'content-type':'text/html'});res.end('<!doctype html><html><head><title>Local release proof</title></head><body>phase1-verified-origin-marker</body></html>');}).listen(18888,'127.0.0.1');
JS
node "$WORK/origin.mjs" > "$WORK/origin.log" 2>&1 &
origin_pid=$!
cleanup() {
if [[ -n "${viceroy_pid:-}" ]]; then kill "$viceroy_pid" 2>/dev/null || true; wait "$viceroy_pid" 2>/dev/null || true; fi
kill "$origin_pid" 2>/dev/null || true
wait "$origin_pid" 2>/dev/null || true
}
trap cleanup EXIT
"$VICEROY" serve -C "$WORK/fastly.toml" --addr 127.0.0.1:17676 "$WASM" > "$WORK/viceroy.log" 2>&1 &
viceroy_pid=$!
curl --fail --silent --show-error --retry 20 --retry-connrefused --retry-delay 1 \
--retry-max-time 45 --max-time 30 -H 'Host: 127.0.0.1' \
-D "$WORK/headers.txt" -o "$WORK/body.html" http://127.0.0.1:17676/
cat "$WORK/headers.txt"
node - "$WORK" <<'JS'
const fs=require('node:fs');const assert=require('node:assert/strict');const crypto=require('node:crypto');const work=process.argv[2];const headers=fs.readFileSync(`${work}/headers.txt`,'utf8');const body=fs.readFileSync(`${work}/body.html`);assert.match(headers,/^HTTP\/1\.1 200/m);assert.match(headers,/^x-ts-version: 937214a632f9387601dba94f996de78b2e6ee424\r?$/im);assert.ok(body.includes('phase1-verified-origin-marker'));assert.ok(body.includes('/static/tsjs=tsjs-unified.min.js'));console.log(`SUCCESS: configured Viceroy page returned HTTP200, origin marker, injected JS and exact release source header; ${body.length} bytes, sha256=${crypto.createHash('sha256').update(body).digest('hex')}`);
JS |
Collaborator
Author
|
Rehearsal Build/sign/publication run passed all seven builds/signing jobs and immutable publication. Published release: ID 421431085, All 29 published files were downloaded from this release. Bounded range downloads were assembled and checked against the published SHA-256 metadata; small companions were independently digest-checked. No earlier release or CI artifact substituted for a binary. gh api repos/prk-Jr/trusted-server/releases/tags/v0.0.0-rehearsal.5 > release-metadata.json
node range-download.mjs
node small-download.mjs
node check-downloads.mjsimport fs from 'node:fs';
import {promisify} from 'node:util';
import {execFile} from 'node:child_process';
import crypto from 'node:crypto';
const run=promisify(execFile);
const release=JSON.parse(fs.readFileSync('release-metadata.json'));
const binaries=release.assets.filter(a=> a.size>=2*1024*1024);
fs.mkdirSync('ranges',{recursive:true});
const tasks=[]; const chunk=2*1024*1024;
for(const a of binaries) for(let offset=0;offset<a.size;offset+=chunk) tasks.push({a,offset,end:Math.min(a.size-1,offset+chunk-1)});
let done=0;
async function worker(){while(tasks.length){const {a,offset,end}=tasks.shift();const out=`ranges/${a.name}.${offset}`; await run('curl',['--fail','--silent','--show-error','--location','--retry','2','--max-time','180','--range',`${offset}-${end}`,'--max-filesize',String(end-offset+1),'--output',out,a.browser_download_url]);if(fs.statSync(out).size!==end-offset+1)throw Error(`Range size mismatch: ${a.name} ${offset}`);done++;if(done%32===0)console.log(`Downloaded ${done} ranges`);}}
await Promise.all(Array.from({length:32},worker));
for(const a of binaries){const dest=fs.openSync(`${a.name}.assembled`,'w');const hash=crypto.createHash('sha256');for(let o=0;o<a.size;o+=chunk){const b=fs.readFileSync(`ranges/${a.name}.${o}`);fs.writeSync(dest,b);hash.update(b);}fs.closeSync(dest);if(`sha256:${hash.digest('hex')}`!==a.digest)throw Error(`Digest mismatch: ${a.name}`);fs.renameSync(`${a.name}.assembled`,a.name);console.log(`SUCCESS: ${a.name}: ${a.size} bytes match ${a.digest}`);}import fs from 'node:fs';import crypto from 'node:crypto';import {promisify} from 'node:util';import {execFile} from 'node:child_process';
const run=promisify(execFile);const {assets}=JSON.parse(fs.readFileSync('release-metadata.json'));await Promise.all(assets.filter(a=>a.size<2*1024*1024).map(async a=>{const valid=()=>fs.existsSync(a.name)&&`sha256:${crypto.createHash('sha256').update(fs.readFileSync(a.name)).digest('hex')}`===a.digest;if(!valid())await run('curl',['--fail','--silent','--show-error','--location','--max-time','180','--output',a.name,a.browser_download_url]);if(!valid())throw Error(`Bad asset: ${a.name}`);console.log(`SUCCESS: ${a.name} matches published digest`);}));import fs from'node:fs';import assert from'node:assert/strict';import crypto from'node:crypto';
const release=JSON.parse(fs.readFileSync('release-metadata.json'));const expected=JSON.parse(fs.readFileSync('expected-assets.json'));
assert.equal(release.immutable,true);assert.equal(release.draft,false);assert.deepEqual(release.assets.map(a=>a.name).sort(),expected);assert.equal(expected.length,29);
for(const a of release.assets){assert(fs.lstatSync(a.name).isFile());const bytes=fs.readFileSync(a.name);assert(bytes.length>0);assert.equal(bytes.length,a.size);assert.equal('sha256:'+crypto.createHash('sha256').update(bytes).digest('hex'),a.digest);}
const sums=fs.readFileSync('SHA256SUMS','utf8').trim().split('\n');assert.equal(sums.length,28);assert.deepEqual(sums.map(line=>line.match(/^[a-f0-9]{64} (.+)$/)[1]).sort(),expected.filter(a=>a!=='SHA256SUMS'));
console.log('SUCCESS: immutable published release contains exactly29 nonempty assets with published digests; SHA256SUMS covers exactly28 companions and binaries, excluding itself.'); |
Collaborator
Author
|
Rehearsal
Full commands and explicit success output:
Any following documentation-only head retains this exact rehearsed implementation SHA. The PR remains draft; no reviewers requested. Maintainer production-release/settings and allowlist review gates remain. |
Collaborator
Author
|
Rehearsal .6 online verification transcript, part 1/2, exact source 39a769c. Independent read-only checks passed: documented download, immutable prerelease/not Latest, release verification, all 29 verify-asset calls, 28 checksums, both predicates and signer forms for all seven binaries WITH bundles and WITHOUT bundles, SPDX equality, macOS minimum OS and CLI source labels. The original workflow remains failed; see the failure/build/runtime record and offline transcript. Pinned gh 2.102.0. |
Collaborator
Author
|
Rehearsal .6 online verification transcript, part 2/2, exact source 39a769c. Independent read-only checks passed: documented download, immutable prerelease/not Latest, release verification, all 29 verify-asset calls, 28 checksums, both predicates and signer forms for all seven binaries WITH bundles and WITHOUT bundles, SPDX equality, macOS minimum OS and CLI source labels. The original workflow remains failed; see the failure/build/runtime record and offline transcript. Pinned gh 2.102.0. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.7 at 7a05940: failed infrastructure rehearsal; workflow cancelled. Run. Upstream CI passed all seven builds and all six workflows at this exact reviewed head before the fresh lightweight tag was pushed. GitHub cancelled the Apple Silicon job after about 15 minutes waiting for a hosted runner. It acquired no runner and executed no steps. The annotations explicitly report hosted-runner acquisition failure and macOS ARM capacity constraints. Once that made successful publication impossible, the remaining Intel build was cancelled to avoid wasted runner work. Five builds passed. Signing and publication executed no steps. No draft or published release exists for this tag, so release/asset/attestation verification and Fastly packaging were not run for .7. The lightweight .7 tag is retained unchanged. This does not count as a successful rehearsal. The next attempt uses fresh .8 at the same CI-green reviewed commit under standing approval; no implementation or runner-setting change is required for this infrastructure failure.
Cancellation annotations: [
{
"level": "failure",
"message": "The job was not acquired by Runner of type hosted even after multiple attempts"
},
{
"level": "notice",
"message": "Due to capacity constraints, jobs targeting macOS arm64 runners may experience longer queue times."
},
{
"level": "notice",
"message": "Due to capacity constraints, jobs targeting macOS arm64 runners may experience longer queue times."
},
{
"level": "notice",
"message": "Due to capacity constraints, jobs targeting macOS arm64 runners may experience longer queue times."
}
]Release-state readback: |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.8 at 7a05940: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. The publisher found the release attestation on its first availability check; no availability wait was needed in this run. Failure-path tests cover the bounded 2s/5s waits and immediate rejection cases. The release has exactly 29 assets, draft=false, immutable=true, prerelease=true and is not Latest. The documented gh release download command succeeded. All 29 verify-asset checks and 28 SHA256SUMS entries passed. All seven binaries passed provenance and SPDX verification, both signer forms, exact tag/source/signer pins and deny-self-hosted-runners, both with bundles and via online attestation-store lookup without bundles. Networking-denied offline verification passed with an independent binary SHA-256 pin for each asset; every attested SBOM predicate equalled its shipped SPDX document. Both macOS minimum-OS checks and all CLI package/source/target/variant checks passed. All Axum container smokes reached the non-loopback bind through a host-published port. Pinned Fastly 16.0.0 packed, validated, inspected and byte-compared the verified wasm without deployment. Viceroy returned the expected page/source header and confirmed no Build facts log in default single mode. Full command/output transcripts follow in separate comments. Temporary local paths are redacted. This supersedes the failed .6 workflow (independent checks passed afterward) and the .7 runner-capacity cancellation. Their tags/releases remain unchanged. Any subsequent review-head update must be docs-only and retain this exact rehearsed implementation SHA. The PR remains draft with no reviewers. Full transcript: online 1 · online 2 · offline 1 · offline 2 · publisher 1 |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.8 at 7a05940: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. online transcript, part 1. Documented download, release/asset verification, checksums, all-seven bundle and online-store verification, both signer forms, both predicates and SPDX equality. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.8 at 7a05940: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. online transcript, part 2. Documented download, release/asset verification, checksums, all-seven bundle and online-store verification, both signer forms, both predicates and SPDX equality. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.8 at 7a05940: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. offline transcript, part 1. Pinned gh 2.102.0. Trust-root SHA-256: 65ca537f6ed8a47fd0e560c421baa1f6c1efb8b25fc200d8c5c02c0e92eb2b9c. Independent binary pins derive from the cryptographically verified release attestation, separately from the downloaded SHA256SUMS. OS sandbox denied networking including the control request. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.8 at 7a05940: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. offline transcript, part 2. Pinned gh 2.102.0. Trust-root SHA-256: 65ca537f6ed8a47fd0e560c421baa1f6c1efb8b25fc200d8c5c02c0e92eb2b9c. Independent binary pins derive from the cryptographically verified release attestation, separately from the downloaded SHA256SUMS. OS sandbox denied networking including the control request. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.8 at 7a05940: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. publisher transcript, part 1. Publisher output includes the bounded availability check, exact release-attestation binding and post-publication verification. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.9 at 149754d: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. The publisher found the release attestation available on its first check; no live availability wait was needed. Failure-path tests cover five checks with 2s/5s/10s/20s backoff, the 60s availability deadline, late-success rejection and immediate definitive failures. The release has exactly 29 assets, draft=false, immutable=true, prerelease=true and is not Latest. The documented gh release download command succeeded. All 29 verify-asset checks and 28 SHA256SUMS entries passed. All seven binaries passed provenance and SPDX verification, both signer forms, exact tag/source/signer pins and deny-self-hosted-runners, both with bundles and via online attestation-store lookup without bundles. Networking-denied offline verification passed with an independent binary SHA-256 pin for each asset; every attested SBOM predicate equalled its shipped SPDX document. Both macOS minimum-OS checks and all CLI package/source/target/variant checks passed. All Axum container smokes proved 0.0.0.0:8080 through a host-published port and exit-1 rejection for both primary and legacy port zero. The publisher re-downloaded all 29 published assets and byte-compared them with the signed checksums and handoff. Pinned Fastly 16.0.0 packed, validated, inspected and byte-compared the verified wasm without deployment. Viceroy returned the expected page/source header and confirmed no Build facts log in default single mode. Full command/output transcripts follow in separate comments. Temporary local paths are redacted. This supersedes the failed .6 workflow (independent checks passed afterward) and the .7 runner-capacity cancellation. Their tags/releases remain unchanged. Any subsequent review-head update must be docs-only and retain this exact rehearsed implementation SHA. The PR remains draft with no reviewers. Full transcript: online 1 · online 2 · offline 1 · offline 2 · publisher 1 |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.9 at 149754d: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. online transcript, part 1. Documented download, release/asset verification, checksums, all-seven bundle and online-store verification, both signer forms, both predicates and SPDX equality. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.9 at 149754d: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. online transcript, part 2. Documented download, release/asset verification, checksums, all-seven bundle and online-store verification, both signer forms, both predicates and SPDX equality. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.9 at 149754d: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. offline transcript, part 1. Pinned gh 2.102.0. Trust-root SHA-256: 65ca537f6ed8a47fd0e560c421baa1f6c1efb8b25fc200d8c5c02c0e92eb2b9c. Independent binary pins derive from the cryptographically verified release attestation, separately from the downloaded SHA256SUMS. OS sandbox denied networking including the control request. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.9 at 149754d: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. offline transcript, part 2. Pinned gh 2.102.0. Trust-root SHA-256: 65ca537f6ed8a47fd0e560c421baa1f6c1efb8b25fc200d8c5c02c0e92eb2b9c. Independent binary pins derive from the cryptographically verified release attestation, separately from the downloaded SHA256SUMS. OS sandbox denied networking including the control request. |
Collaborator
Author
|
Rehearsal v0.0.0-rehearsal.9 at 149754d: passed. Fork run. Fresh lightweight tag; exact reviewed head; all seven builds/signing jobs and the publisher passed. The full independent verification also passed. publisher transcript, part 1. Publisher output includes the bounded availability check, exact release-attestation binding and post-publication verification. |
Identify the supplied host or port variable when refusing startup, without forwarding fallback warnings. Preserve EdgeZero validation and cover both port aliases with a regression test. Retain both core module declarations when integrating the current main branch. Record that the updated binaries still require a fresh release rehearsal.
- Print Axum bind-address refusals to stderr so RUST_LOG=off cannot hide them; add a binary-level regression test - Log and ignore other tags' release attestations instead of verifying them after publication - Time-bound every release API read; mutations stay single-shot - Run the CLI build-facts test in release mode in CI and compare the embedded source with the exact supplied commit - Assert the v* tag gate and action pinning in both workflows - Define COMMIT in the maintainer checklist; describe both attestation subjects accurately - Make the Fastly BUILD_INFO constant private
- Supply a fictional commit to the release-mode CLI test so a fallback to local git cannot pass, and assert release mode matches the supplied control - Anchor the publication gate assertion to the job-level if - Document the read timeout and job-bounded mutations
Collaborator
Author
|
Phase 1 rehearsal Exact reviewed head Read-only diagnosis found that this SHA is referenced only by the new tag in the fork; the successful Phase 2 |
Collaborator
Author
|
Phase 1 exact-head rehearsal Reviewed source |
Collaborator
Author
|
Phase 1 exact-head rehearsal Reviewed source |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SHA256SUMS(29 files).Changes
phase1*AGENTS.md;domains.rsab6e549 size: 37 new files / 10,132 lines; existing +642/−50. Code additions: 1,045 Rust + 2,524 workflow/script/test/cohort lines. Ceiling waived; scope unchanged.
Compatibility audit.
Closes
Part of #1235 until D7 (IAB settings) is complete.
Spec / Plan
Spec · Plan. The spec was reviewed in #1262 (two rounds) and is carried here with phase labels and Phase 1 notes; approving this PR approves the phased spec. #1235 asked for a separate spec PR; this PR combines them by agreement.
Test plan
ab6e549: hosted CI is green: 32 passed checks, seven builds; signing/publication skipped on the PR. Exact-head rehearsal
.12and full independent verification passed: 29 immutable prerelease files (not Latest), both predicates/identities online and offline for all seven binaries, SPDX equality, all asset/checksum checks, native smokes and CLI source identity. The prior.11draft-create denial is recorded;.12used the same reviewed code at the fork branch head, without source/settings/token changes.#1235 Done when and exact signer commands
.12passed at this exact head; IAB settings remain D7..12transcript above.v*tags — maintainer setting.The issue example pins
release.yml; the reviewed signer is reusablerelease-build.yml.artifact-metadata: writeis intentionally omitted (not needed for file attestations). Topology alone does not establish SLSA Build Level 3.For each binary, run both predicates (
https://slsa.dev/provenance/v1,https://spdx.dev/Document/v2.3) and these identities separately, with independently approved source pins:Allowlist changes needing maintainer review
Exact hosts:
actions.github.io(SLSA buildType),slsa.dev(provenance),spdx.dev(SPDX),cli.github.com(verification docs). Reviewed per-line suppressions:cyclonedx.org(intermediate-format reference; removed from allowlist),api.github.com,uploads.github.com.Phase 2 notes: producing-job binding remains deferred: a compromised build dependency on one runner could replace another job's artifact, equivalent to a compromised build of the same source; the later transfer-binding slice addresses this. Controlled composition/qualification and further Axum hardening remain deferred.
Human gates
Keep draft; no reviewers. Exact-head
.12verification is complete. Maintainers must enable immutable releases and the restrictedv*ruleset before settingRELEASE_PUBLICATION_ENABLED=true; no settings token/API precheck, by review decision. Decide rc-branch tag eligibility; approve the spec/merge, reference hosts/suppressions and first production release. No IAB tags, releases or settings changes.