docs(proposals): add SHA-256 digest capture and verification proposal

[LalatenduMohanty]

Proposes computing, storing, and verifying SHA-256 digests for all downloaded artifacts to close the supply-chain gap where fromager accepts unverified bytes.

Closes: #1296

• PR follows CONTRIBUTING.md guidelines

[coderabbitai]

Warning

Review limit reached

Next included review available in 4 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 6c8860dc-673e-4a03-be33-8e6af41e7208

📥 Commits

Reviewing files that changed from the base of the PR and between c4fbe16 and f842140.

📒 Files selected for processing (1)

• docs/proposals/digest-verification.md

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: d5102c89-25ec-4e2d-8fa6-8a2e8599d960

📥 Commits

Reviewing files that changed from the base of the PR and between cf4dc21 and c4fbe16.

📒 Files selected for processing (1)

• docs/proposals/digest-verification.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds a proposal for three phases of source provenance in Fromager. The design covers upstream identity, source transformations, build context, artifact digests, and storage in provenance-index.json, with references from existing metadata files. It specifies digest-aware acquisition, expected-versus-observed verification, fail-closed sdist reuse, optional upstream evidence, publication records, backward compatibility, rollout steps, and test invariants. It explicitly defers changes to sdist generation.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🔵 Low · up to c4fbe

This documentation-only proposal does not change runtime behavior, but its planned provenance records lack defined atomic update and recovery semantics, which could allow inconsistent verification or reuse state when implemented. The design is mergeable with explicit owner follow-up, and issue #1296 should remain open until enforcement is specified.

🚥 Pre-merge checks | ✅ 2 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The document addresses the linked issue conceptually, but it does not implement the requested Phase 1 changes. It adds no download hashing, digest verification, data-model fields, provenance output, o…	Implement the Phase 1 requirements in code, or link the proposal to an issue that specifically tracks design work rather than implementation.
Out of Scope Changes check	⚠️ Warning	The proposal includes Phase 2 and Phase 3 work, such as lineage-aware sdist reuse, upstream evidence, and builder mirror publication. These items exceed the linked issue's Phase 1 scope. [#1296]	Limit this pull request to the Phase 1 proposal, or link the additional phases to separate issues and explain their intended scope.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the new proposal and its primary focus on SHA-256 digest capture and verification.
Description check	✅ Passed	The description directly matches the changeset by describing SHA-256 digest computation, storage, and verification for downloaded artifacts.

Full details: Linked Issues check

Explanation

The document addresses the linked issue conceptually, but it does not implement the requested Phase 1 changes. It adds no download hashing, digest verification, data-model fields, provenance output, or re-download checks. [#1296]

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[rd4398]

This looks good and I really like the idea. I will let @tiran take a look as well before clicking approve.

Also, we should set a timeline for this to be implemented. I would love to contribute to the implementation