xeno/Portfolio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: require signed execution security evidence

Browse Source
This commit is contained in:
LucaP
2026-09-02 11:12:28 +03:00
parent 259f52a02b
commit 7da2b72933
5 changed files with 180 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/deployment/release-checklist.md
View File

@@ -24,11 +24,15 @@ node scripts/supply-chain-check.mjs collect \
--project . \
--evidence /external/write-once/release-evidence/supply-chain \
--triage APPROVED_COMMITTED_MEDIUM_TRIAGE.json \
--execution-security SIGNED_EXECUTION_SECURITY_ENVELOPE.json \
--tool-trust-policy config/release-execution-trust.json \
--allow-registry-network yes \
--today YYYY-MM-DD
--now YYYY-MM-DDTHH:MM:SSZ
```
The collector runs `npm ci --ignore-scripts`, production and full development audits, the pinned license checker, and the pinned CycloneDX generator. It strips the environment to a minimal credential-free set. The verifier fails when package metadata or the lockfile changes, evidence digests do not match, a license is not allowlisted, an SBOM is malformed, or a Critical/High finding exists. Every Medium finding must have one current, exact, committed triage entry; stale extras also fail.
The collector runs `npm ci --ignore-scripts`, production and full development audits, the pinned license checker, and the pinned CycloneDX generator. It strips the environment to a minimal credential-free set. It also requires a separately signed execution-security envelope: all four privacy image roles must be digest-pinned with verified provenance and zero Critical/High findings; native tools must be integrity/signature verified and clean; repository secret/history scans, pinned CI actions, and distribution notices must all pass. The verifier checks that envelope against the protected public-key policy at `config/release-execution-trust.json`. Until Luca supplies and approves that public trust policy and the signed evidence, the supply-chain gate intentionally fails closed.
The verifier also fails when package metadata or the lockfile changes, evidence digests do not match, a license is not allowlisted, an SBOM is malformed, or a Critical/High finding exists. Every Medium finding must have one current, exact, committed triage entry; stale extras also fail.
- [ ] `npm run verify:supply-chain` passes against the selected immutable evidence directory.
- [ ] `npm audit` evidence covers production dependencies and the complete development tree.
@@ -36,6 +40,8 @@ The collector runs `npm ci --ignore-scripts`, production and full development au
- [ ] Every Medium finding has a current committed owner, rationale, and review date.
- [ ] CycloneDX SBOM is bound by the evidence manifest and packaged with the release.
- [ ] License inventory contains no unknown, copyleft, or unapproved expression.
- [ ] Signed execution image/native-tool evidence is current, complete, digest-pinned, and has zero Critical/High findings.
- [ ] Repository secret/history, CI action pinning, and distribution notice checks pass.
- [ ] `npm run build:preview` passes.
- [ ] Complete production build, unit/browser/accessibility/performance gates pass using the approved production config.
- [ ] Privacy reconciliation and signed-release admission pass against external trust state.