From f4028b7a745e6937966c97a96907ab6813d3c5a0 Mon Sep 17 00:00:00 2001 From: Zoey Rose Date: Thu, 13 Aug 2026 07:58:00 +0000 Subject: [PATCH 1/3] test(provenance): demonstrate canonical identity reference --- PROVENANCE.md | 22 +++++++++++++++ provenance/identity-reference.synthetic.json | 28 ++++++++++++++++++++ tools/check-foundations.sh | 1 + tools/check-provenance-identity-reference.sh | 26 ++++++++++++++++++ 4 files changed, 77 insertions(+) create mode 100644 provenance/identity-reference.synthetic.json create mode 100755 tools/check-provenance-identity-reference.sh diff --git a/PROVENANCE.md b/PROVENANCE.md index fb7437d..5d1ffc3 100644 --- a/PROVENANCE.md +++ b/PROVENANCE.md @@ -37,3 +37,25 @@ of coverage, and this source-reuse route does not permit GPL/AGPL dependencies or bundles. The checked-in Classic distribution remains GPL-2.0-or-later; MIT permission applies only to the exact selected destination material recorded by the review. + +`provenance/identity-reference.synthetic.json` demonstrates the canonical +privacy-preserving identity reference workflow for issue #84. It is +reviewer-signed synthetic evidence only: it grants no permission for real +material and copies neither the coordinator registry nor identity aliases. +`tools/check-foundations.sh` always validates the local record shape. With an +explicit coordinator checkout it also performs bounded offline verification: + +```sh +ATRINIK_COORDINATOR=/path/to/atrinik tools/check-foundations.sh +``` + +Before coordinator PR #381 merges, audit its pushed branch without treating +the result as approval: + +```sh +ATRINIK_COORDINATOR=/path/to/atrinik \ +ATRINIK_COORDINATOR_TRUSTED_REF=origin/feat/privacy-preserving-provenance-registry \ +tools/check-provenance-identity-reference.sh +``` + +The record's `evidence_reference.url` is the immutable online permalink. diff --git a/provenance/identity-reference.synthetic.json b/provenance/identity-reference.synthetic.json new file mode 100644 index 0000000..b4bf2b7 --- /dev/null +++ b/provenance/identity-reference.synthetic.json @@ -0,0 +1,28 @@ +{ + "schema_version": 1, + "synthetic": true, + "source": { + "repository": "atrinik/synthetic-history", + "path": "engine/beta.c", + "revision": "2222222222222222222222222222222222222222" + }, + "destination": { + "repository": "atrinik/server", + "path": "internal/kernel/kernel.go" + }, + "transformation": "Synthetic port used only to verify the reference contract.", + "scope_binding": "psb-22222222222222222222222222222222", + "scope_approval": { + "key_id": "synthetic-reviewer-2026", + "signature": "-----BEGIN SSH SIGNATURE-----\nU1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgBruVWBv4FEuaHvyX1z13qRO9BU\nTXED0DGAjTaWDx1NAAAAAVYXRyaW5pay1wcm92ZW5hbmNlLXYxAAAAAAAAAAZzaGE1MTIA\nAABTAAAAC3NzaC1lZDI1NTE5AAAAQGcyoaKoDFIcb6bogMTJmFpDJZhY3ro3N+OoeHalXc\nb0OI8EcGvJehLZy1beFGd8P5TKdASQD0lP+uvR2rKkQgw=\n-----END SSH SIGNATURE-----" + }, + "evidence_reference": { + "repository": "atrinik/atrinik", + "revision": "98ff80ef66a71d8b7c48e7d0c71029abd5c90227", + "record_id": "pir-c-22222222222222222222222222222222", + "registry_sha256": "0a04fcadccb37e64f6c1209bc0b7e8d5762639ce4c5521c3bba028d9eba037bd", + "schema_sha256": "34ab398af4f166b8b65ac68500b547b9ade4955bd0b73770eeda1337bf5dcf47", + "reviewers_sha256": "b7a44ad27cec663a9092b924a0f6a9c95bf95a2ce74cf75ba8873e7938782240", + "url": "https://github.com/atrinik/atrinik/blob/98ff80ef66a71d8b7c48e7d0c71029abd5c90227/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222" + } +} diff --git a/tools/check-foundations.sh b/tools/check-foundations.sh index 4a6e112..4185051 100755 --- a/tools/check-foundations.sh +++ b/tools/check-foundations.sh @@ -23,6 +23,7 @@ required=(CONTRIBUTING.md PROVENANCE.md SECURITY.md THIRD_PARTY_NOTICES.md) for document in "${required[@]}"; do test -s "${document}" done +tools/check-provenance-identity-reference.sh if grep -RhE '^[[:space:]]*uses:' .github/workflows \ | grep -Ev '@[0-9a-f]{40}([[:space:]]|$)' >/dev/null; then diff --git a/tools/check-provenance-identity-reference.sh b/tools/check-provenance-identity-reference.sh new file mode 100755 index 0000000..af0ed5c --- /dev/null +++ b/tools/check-provenance-identity-reference.sh @@ -0,0 +1,26 @@ +#!/usr/bin/env bash +set -euo pipefail + +repository=$(git rev-parse --show-toplevel) +record="${repository}/provenance/identity-reference.synthetic.json" + +jq -e ' + (keys | sort) == ["destination", "evidence_reference", "schema_version", "scope_approval", "scope_binding", "source", "synthetic", "transformation"] and + .schema_version == 1 and .synthetic == true and + .destination.repository == "atrinik/server" and + .destination.path == "internal/kernel/kernel.go" and + .evidence_reference.repository == "atrinik/atrinik" and + (.evidence_reference.revision | test("^[0-9a-f]{40}$")) and + (.evidence_reference as $e | ($e.url | contains($e.revision))) and + (.scope_binding | test("^psb-[0-9a-f]{32}$")) and + (.scope_approval.signature | startswith("-----BEGIN SSH SIGNATURE-----")) +' "${record}" >/dev/null + +if [[ -n "${ATRINIK_COORDINATOR:-}" ]]; then + trusted_ref=${ATRINIK_COORDINATOR_TRUSTED_REF:-origin/main} + arguments=(provenance validate --reference "${record}") + if [[ "${trusted_ref}" != origin/main ]]; then + arguments+=(--non-authorizing-audit-ref "${trusted_ref}") + fi + "${ATRINIK_COORDINATOR}/atrinik" "${arguments[@]}" +fi From d744fcbbaeb94ef59e227fad10bee1e152f4f396 Mon Sep 17 00:00:00 2001 From: Zoey Rose Date: Thu, 13 Aug 2026 08:08:55 +0000 Subject: [PATCH 2/3] fix(provenance): harden synthetic reference validation --- PROVENANCE.md | 5 ++++ provenance/identity-reference.synthetic.json | 8 +++--- tools/check-foundations.sh | 2 +- tools/check-provenance-identity-reference.sh | 27 +++++++++++++++----- tools/test-provenance-identity-reference.sh | 21 +++++++++++++++ 5 files changed, 51 insertions(+), 12 deletions(-) create mode 100755 tools/test-provenance-identity-reference.sh diff --git a/PROVENANCE.md b/PROVENANCE.md index 5d1ffc3..bf8fab2 100644 --- a/PROVENANCE.md +++ b/PROVENANCE.md @@ -59,3 +59,8 @@ tools/check-provenance-identity-reference.sh ``` The record's `evidence_reference.url` is the immutable online permalink. +This permanently synthetic demonstration remains a non-authorizing audit of +the exact pushed feature commit. Production evidence must instead pin a +revision already reachable from `origin/main` (or a future implemented and +verified signed release); squash-merging PR #381 does not promote its internal +commits to production authority. diff --git a/provenance/identity-reference.synthetic.json b/provenance/identity-reference.synthetic.json index b4bf2b7..f7e7b47 100644 --- a/provenance/identity-reference.synthetic.json +++ b/provenance/identity-reference.synthetic.json @@ -14,15 +14,15 @@ "scope_binding": "psb-22222222222222222222222222222222", "scope_approval": { "key_id": "synthetic-reviewer-2026", - "signature": "-----BEGIN SSH SIGNATURE-----\nU1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgBruVWBv4FEuaHvyX1z13qRO9BU\nTXED0DGAjTaWDx1NAAAAAVYXRyaW5pay1wcm92ZW5hbmNlLXYxAAAAAAAAAAZzaGE1MTIA\nAABTAAAAC3NzaC1lZDI1NTE5AAAAQGcyoaKoDFIcb6bogMTJmFpDJZhY3ro3N+OoeHalXc\nb0OI8EcGvJehLZy1beFGd8P5TKdASQD0lP+uvR2rKkQgw=\n-----END SSH SIGNATURE-----" + "signature": "-----BEGIN SSH SIGNATURE-----\nU1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgBruVWBv4FEuaHvyX1z13qRO9BU\nTXED0DGAjTaWDx1NAAAAAVYXRyaW5pay1wcm92ZW5hbmNlLXYxAAAAAAAAAAZzaGE1MTIA\nAABTAAAAC3NzaC1lZDI1NTE5AAAAQEFugnjUUCSFgna/vEgGbOICU997Tt/8eQzkbpW9Q+\n2I3AWwe5/21Woy/HAYW3EQPMjTyLpyx/ZNOPUhE23D6AU=\n-----END SSH SIGNATURE-----" }, "evidence_reference": { "repository": "atrinik/atrinik", - "revision": "98ff80ef66a71d8b7c48e7d0c71029abd5c90227", + "revision": "89fc98b95f23c0f0f068c5254ffb72c62f173119", "record_id": "pir-c-22222222222222222222222222222222", "registry_sha256": "0a04fcadccb37e64f6c1209bc0b7e8d5762639ce4c5521c3bba028d9eba037bd", - "schema_sha256": "34ab398af4f166b8b65ac68500b547b9ade4955bd0b73770eeda1337bf5dcf47", + "schema_sha256": "e040c1575fbd2906d0fe1fcb27a874518a39b8bc5629ac2a987652ea801553f9", "reviewers_sha256": "b7a44ad27cec663a9092b924a0f6a9c95bf95a2ce74cf75ba8873e7938782240", - "url": "https://github.com/atrinik/atrinik/blob/98ff80ef66a71d8b7c48e7d0c71029abd5c90227/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222" + "url": "https://github.com/atrinik/atrinik/blob/89fc98b95f23c0f0f068c5254ffb72c62f173119/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222" } } diff --git a/tools/check-foundations.sh b/tools/check-foundations.sh index 4185051..7c8a872 100755 --- a/tools/check-foundations.sh +++ b/tools/check-foundations.sh @@ -23,7 +23,7 @@ required=(CONTRIBUTING.md PROVENANCE.md SECURITY.md THIRD_PARTY_NOTICES.md) for document in "${required[@]}"; do test -s "${document}" done -tools/check-provenance-identity-reference.sh +tools/test-provenance-identity-reference.sh if grep -RhE '^[[:space:]]*uses:' .github/workflows \ | grep -Ev '@[0-9a-f]{40}([[:space:]]|$)' >/dev/null; then diff --git a/tools/check-provenance-identity-reference.sh b/tools/check-provenance-identity-reference.sh index af0ed5c..c26475a 100755 --- a/tools/check-provenance-identity-reference.sh +++ b/tools/check-provenance-identity-reference.sh @@ -2,18 +2,31 @@ set -euo pipefail repository=$(git rev-parse --show-toplevel) -record="${repository}/provenance/identity-reference.synthetic.json" +record=${1:-"${repository}/provenance/identity-reference.synthetic.json"} jq -e ' + type == "object" and (keys | sort) == ["destination", "evidence_reference", "schema_version", "scope_approval", "scope_binding", "source", "synthetic", "transformation"] and .schema_version == 1 and .synthetic == true and - .destination.repository == "atrinik/server" and - .destination.path == "internal/kernel/kernel.go" and - .evidence_reference.repository == "atrinik/atrinik" and - (.evidence_reference.revision | test("^[0-9a-f]{40}$")) and - (.evidence_reference as $e | ($e.url | contains($e.revision))) and + (.source | type == "object" and (keys | sort) == ["path", "repository", "revision"] and + .repository == "atrinik/synthetic-history" and .path == "engine/beta.c" and + (.revision | test("^[0-9a-f]{40}$"))) and + (.destination | type == "object" and (keys | sort) == ["path", "repository"] and + .repository == "atrinik/server" and .path == "internal/kernel/kernel.go") and + (.transformation | type == "string" and length > 0) and + (.scope_approval | type == "object" and (keys | sort) == ["key_id", "signature"] and + .key_id == "synthetic-reviewer-2026" and + (.signature | test("^-----BEGIN SSH SIGNATURE-----\\n[A-Za-z0-9+/=\\n]+\\n-----END SSH SIGNATURE-----$"))) and + (.evidence_reference | type == "object" and + (keys | sort) == ["record_id", "registry_sha256", "repository", "reviewers_sha256", "revision", "schema_sha256", "url"] and + .repository == "atrinik/atrinik" and + .record_id == "pir-c-22222222222222222222222222222222" and + ([.registry_sha256, .reviewers_sha256, .schema_sha256] | all(test("^[0-9a-f]{64}$"))) and + (.revision | test("^[0-9a-f]{40}$")) and + (. as $e | $e.url == ("https://github.com/atrinik/atrinik/blob/" + $e.revision + + "/governance/provenance-identities/registry.json#" + $e.record_id))) and (.scope_binding | test("^psb-[0-9a-f]{32}$")) and - (.scope_approval.signature | startswith("-----BEGIN SSH SIGNATURE-----")) + true ' "${record}" >/dev/null if [[ -n "${ATRINIK_COORDINATOR:-}" ]]; then diff --git a/tools/test-provenance-identity-reference.sh b/tools/test-provenance-identity-reference.sh new file mode 100755 index 0000000..7859e81 --- /dev/null +++ b/tools/test-provenance-identity-reference.sh @@ -0,0 +1,21 @@ +#!/usr/bin/env bash +set -euo pipefail + +repository=$(git rev-parse --show-toplevel) +source_record="${repository}/provenance/identity-reference.synthetic.json" +temporary=$(mktemp /tmp/atrinik-server-provenance-reference.XXXXXX) +trap 'rm -f -- "${temporary}"' EXIT + +tools/check-provenance-identity-reference.sh "${source_record}" +for mutation in \ + '.source = null' \ + '.destination.contact = "forbidden"' \ + '.evidence_reference.registry_sha256 = "invalid"' \ + '.evidence_reference.url = "https://example.invalid/movable"' \ + '.scope_approval.signature = "placeholder"'; do + jq "${mutation}" "${source_record}" >"${temporary}" + if tools/check-provenance-identity-reference.sh "${temporary}"; then + echo "malformed provenance identity reference passed: ${mutation}" >&2 + exit 1 + fi +done From c872d0a3c5af13b3e9a92d4bf40ef9e804972fa5 Mon Sep 17 00:00:00 2001 From: Zoey Rose Date: Thu, 13 Aug 2026 08:19:25 +0000 Subject: [PATCH 3/3] test(provenance): repin isolated trust evidence --- provenance/identity-reference.synthetic.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/provenance/identity-reference.synthetic.json b/provenance/identity-reference.synthetic.json index f7e7b47..987f3b6 100644 --- a/provenance/identity-reference.synthetic.json +++ b/provenance/identity-reference.synthetic.json @@ -14,15 +14,15 @@ "scope_binding": "psb-22222222222222222222222222222222", "scope_approval": { "key_id": "synthetic-reviewer-2026", - "signature": "-----BEGIN SSH SIGNATURE-----\nU1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgBruVWBv4FEuaHvyX1z13qRO9BU\nTXED0DGAjTaWDx1NAAAAAVYXRyaW5pay1wcm92ZW5hbmNlLXYxAAAAAAAAAAZzaGE1MTIA\nAABTAAAAC3NzaC1lZDI1NTE5AAAAQEFugnjUUCSFgna/vEgGbOICU997Tt/8eQzkbpW9Q+\n2I3AWwe5/21Woy/HAYW3EQPMjTyLpyx/ZNOPUhE23D6AU=\n-----END SSH SIGNATURE-----" + "signature": "-----BEGIN SSH SIGNATURE-----\nU1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgBruVWBv4FEuaHvyX1z13qRO9BU\nTXED0DGAjTaWDx1NAAAAAVYXRyaW5pay1wcm92ZW5hbmNlLXYxAAAAAAAAAAZzaGE1MTIA\nAABTAAAAC3NzaC1lZDI1NTE5AAAAQIIntFyZwxlBb8JrL5UGvsL55gDCSPrsD63OUhQdDz\n1u0Aiv3EtOOR5D79Ort0aOsVmoADkKb3IVmxYRM7vt3wI=\n-----END SSH SIGNATURE-----" }, "evidence_reference": { "repository": "atrinik/atrinik", - "revision": "89fc98b95f23c0f0f068c5254ffb72c62f173119", + "revision": "51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0", "record_id": "pir-c-22222222222222222222222222222222", "registry_sha256": "0a04fcadccb37e64f6c1209bc0b7e8d5762639ce4c5521c3bba028d9eba037bd", - "schema_sha256": "e040c1575fbd2906d0fe1fcb27a874518a39b8bc5629ac2a987652ea801553f9", + "schema_sha256": "9c726627c8679b4b437db2b54b2480fe0c45eef788de7cd76de1dec5c3ce3409", "reviewers_sha256": "b7a44ad27cec663a9092b924a0f6a9c95bf95a2ce74cf75ba8873e7938782240", - "url": "https://github.com/atrinik/atrinik/blob/89fc98b95f23c0f0f068c5254ffb72c62f173119/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222" + "url": "https://github.com/atrinik/atrinik/blob/51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222" } }