xeno/Portfolio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: bind final release authority and expiry

Browse Source
This commit is contained in:
LucaP
2026-09-02 12:07:38 +03:00
parent a8fa09e21e
commit 90137c388c
7 changed files with 123 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/deployment/release-checklist.md
View File

@@ -25,14 +25,12 @@ node scripts/supply-chain-check.mjs collect \
--evidence /external/write-once/release-evidence/supply-chain \
--triage APPROVED_COMMITTED_MEDIUM_TRIAGE.json \
--execution-security SIGNED_EXECUTION_SECURITY_ENVELOPE.json \
--tool-trust-policy config/release-execution-trust.json \
--allow-registry-network yes \
--now YYYY-MM-DDTHH:MM:SSZ
--allow-registry-network yes
```
The collector runs `npm ci --ignore-scripts`, production and full development audits, the pinned license checker, and the pinned CycloneDX generator. It strips the environment to a minimal credential-free set. It also requires a separately signed execution-security envelope: all four privacy image roles must be digest-pinned with verified provenance and zero Critical/High findings; native tools must be integrity/signature verified and clean; repository secret/history scans, pinned CI actions, and distribution notices must all pass. The verifier checks that envelope against the protected public-key policy at `config/release-execution-trust.json`. Until Luca supplies and approves that public trust policy and the signed evidence, the supply-chain gate intentionally fails closed.
The collector runs `npm ci --ignore-scripts`, production and full development audits, the pinned license checker, and the pinned CycloneDX generator. It strips the environment to a minimal credential-free set. It also requires a separately signed execution-security envelope: all four privacy image roles must be digest-pinned with verified provenance and zero Critical/High findings; native tools must be integrity/signature verified and clean; repository secret/history scans, pinned CI actions, and distribution notices must all pass. The verifier checks that envelope against the fixed protected authority checkpoint described below. Until Luca supplies and approves that protected authority and the signed evidence, the supply-chain gate intentionally fails closed.
The verifier also fails when package metadata or the lockfile changes, evidence digests do not match, a license is not allowlisted, an SBOM is malformed, or a Critical/High finding exists. Every Medium finding must have one current, exact, committed triage entry; stale extras also fail.
The verifier reads the fixed protected authority checkpoint at `/etc/portfolio-release-authority/.control`: `execution-trust.json` and the exact-JSON `supply-chain-authority.json` binding whose SHA-256 digest covers the trust-policy bytes. The authority root and control directory must be real, activation-service-owned, and not group/world writable. Verification uses system time and independently resolves Git `HEAD`; the signed repository commit must match that current `HEAD` exactly. It fails when package metadata or the lockfile changes, evidence digests do not match, a license is not allowlisted, an SBOM is malformed, or a Critical/High finding exists. Every Medium finding must have one current, exact, committed triage entry; stale extras also fail.
- [ ] `npm run verify:supply-chain` passes against the selected immutable evidence directory.
- [ ] `npm audit` evidence covers production dependencies and the complete development tree.
@@ -40,6 +38,7 @@ The verifier also fails when package metadata or the lockfile changes, evidence
- [ ] Every Medium finding has a current committed owner, rationale, and review date.
- [ ] CycloneDX SBOM is bound by the evidence manifest and packaged with the release.
- [ ] License inventory contains no unknown, copyleft, or unapproved expression.
- [ ] Fixed protected authority checkpoint and signed current-`HEAD` commit binding pass.
- [ ] Signed execution image/native-tool evidence is current, complete, digest-pinned, and has zero Critical/High findings.
- [ ] Repository secret/history, CI action pinning, and distribution notice checks pass.
- [ ] `npm run build:preview` passes.