From 7e828ce308d96a2f2416b97a58df0dd87e41d3e9 Mon Sep 17 00:00:00 2001 From: Zoey Rose Date: Thu, 13 Aug 2026 13:04:35 +0000 Subject: [PATCH] test(provenance): verify landed-main identity reference --- PROVENANCE.md | 25 +++++++------------- provenance/identity-reference.synthetic.json | 8 +++---- tools/check-provenance-identity-reference.sh | 4 ++-- tools/test-provenance-identity-reference.sh | 1 + 4 files changed, 16 insertions(+), 22 deletions(-) diff --git a/PROVENANCE.md b/PROVENANCE.md index bf8fab2..015aa5a 100644 --- a/PROVENANCE.md +++ b/PROVENANCE.md @@ -39,9 +39,12 @@ permission applies only to the exact selected destination material recorded by the review. `provenance/identity-reference.synthetic.json` demonstrates the canonical -privacy-preserving identity reference workflow for issue #84. It is +privacy-preserving identity reference workflow for issue #386. It is newly reviewer-signed synthetic evidence only: it grants no permission for real -material and copies neither the coordinator registry nor identity aliases. +material and copies neither the coordinator registry nor identity aliases. Its +immutable evidence reference pins coordinator commit +`6f6040212f0fa0cb6b8e4e695d1488a403d966be`, the squash merge of coordinator +PR #381 already reachable from canonical `origin/main`. `tools/check-foundations.sh` always validates the local record shape. With an explicit coordinator checkout it also performs bounded offline verification: @@ -49,18 +52,8 @@ explicit coordinator checkout it also performs bounded offline verification: ATRINIK_COORDINATOR=/path/to/atrinik tools/check-foundations.sh ``` -Before coordinator PR #381 merges, audit its pushed branch without treating -the result as approval: - -```sh -ATRINIK_COORDINATOR=/path/to/atrinik \ -ATRINIK_COORDINATOR_TRUSTED_REF=origin/feat/privacy-preserving-provenance-registry \ -tools/check-provenance-identity-reference.sh -``` - The record's `evidence_reference.url` is the immutable online permalink. -This permanently synthetic demonstration remains a non-authorizing audit of -the exact pushed feature commit. Production evidence must instead pin a -revision already reachable from `origin/main` (or a future implemented and -verified signed release); squash-merging PR #381 does not promote its internal -commits to production authority. +The default validation path loads current revocation state and reviewer +authority from trusted `origin/main`, then reads the pinned registry, schema, +and reviewer blobs without network access. The demonstration remains synthetic +and therefore cannot authorize real material. diff --git a/provenance/identity-reference.synthetic.json b/provenance/identity-reference.synthetic.json index 987f3b6..733d320 100644 --- a/provenance/identity-reference.synthetic.json +++ b/provenance/identity-reference.synthetic.json @@ -13,16 +13,16 @@ "transformation": "Synthetic port used only to verify the reference contract.", "scope_binding": "psb-22222222222222222222222222222222", "scope_approval": { - "key_id": "synthetic-reviewer-2026", - "signature": "-----BEGIN SSH SIGNATURE-----\nU1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgBruVWBv4FEuaHvyX1z13qRO9BU\nTXED0DGAjTaWDx1NAAAAAVYXRyaW5pay1wcm92ZW5hbmNlLXYxAAAAAAAAAAZzaGE1MTIA\nAABTAAAAC3NzaC1lZDI1NTE5AAAAQIIntFyZwxlBb8JrL5UGvsL55gDCSPrsD63OUhQdDz\n1u0Aiv3EtOOR5D79Ort0aOsVmoADkKb3IVmxYRM7vt3wI=\n-----END SSH SIGNATURE-----" + "key_id": "synthetic-component-reviewer-2026", + "signature": "-----BEGIN SSH SIGNATURE-----\nU1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgkjGqMmv/M++0NFFTLIFK3kuJ84\nd5ZFkWQvXyK+QehDoAAAAVYXRyaW5pay1wcm92ZW5hbmNlLXYxAAAAAAAAAAZzaGE1MTIA\nAABTAAAAC3NzaC1lZDI1NTE5AAAAQNRLaQRiwLHs8L7csYA7tI5RLLZNWARYbHp8VASw+C\nAmjNuEKeafM9Xlv3er28KlBF3qXpxTB2C/WQLNZ6CsfgY=\n-----END SSH SIGNATURE-----" }, "evidence_reference": { "repository": "atrinik/atrinik", - "revision": "51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0", + "revision": "6f6040212f0fa0cb6b8e4e695d1488a403d966be", "record_id": "pir-c-22222222222222222222222222222222", "registry_sha256": "0a04fcadccb37e64f6c1209bc0b7e8d5762639ce4c5521c3bba028d9eba037bd", "schema_sha256": "9c726627c8679b4b437db2b54b2480fe0c45eef788de7cd76de1dec5c3ce3409", "reviewers_sha256": "b7a44ad27cec663a9092b924a0f6a9c95bf95a2ce74cf75ba8873e7938782240", - "url": "https://github.com/atrinik/atrinik/blob/51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222" + "url": "https://github.com/atrinik/atrinik/blob/6f6040212f0fa0cb6b8e4e695d1488a403d966be/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222" } } diff --git a/tools/check-provenance-identity-reference.sh b/tools/check-provenance-identity-reference.sh index c26475a..c07afb6 100755 --- a/tools/check-provenance-identity-reference.sh +++ b/tools/check-provenance-identity-reference.sh @@ -15,14 +15,14 @@ jq -e ' .repository == "atrinik/server" and .path == "internal/kernel/kernel.go") and (.transformation | type == "string" and length > 0) and (.scope_approval | type == "object" and (keys | sort) == ["key_id", "signature"] and - .key_id == "synthetic-reviewer-2026" and + .key_id == "synthetic-component-reviewer-2026" and (.signature | test("^-----BEGIN SSH SIGNATURE-----\\n[A-Za-z0-9+/=\\n]+\\n-----END SSH SIGNATURE-----$"))) and (.evidence_reference | type == "object" and (keys | sort) == ["record_id", "registry_sha256", "repository", "reviewers_sha256", "revision", "schema_sha256", "url"] and .repository == "atrinik/atrinik" and .record_id == "pir-c-22222222222222222222222222222222" and ([.registry_sha256, .reviewers_sha256, .schema_sha256] | all(test("^[0-9a-f]{64}$"))) and - (.revision | test("^[0-9a-f]{40}$")) and + .revision == "6f6040212f0fa0cb6b8e4e695d1488a403d966be" and (. as $e | $e.url == ("https://github.com/atrinik/atrinik/blob/" + $e.revision + "/governance/provenance-identities/registry.json#" + $e.record_id))) and (.scope_binding | test("^psb-[0-9a-f]{32}$")) and diff --git a/tools/test-provenance-identity-reference.sh b/tools/test-provenance-identity-reference.sh index 7859e81..79d2c85 100755 --- a/tools/test-provenance-identity-reference.sh +++ b/tools/test-provenance-identity-reference.sh @@ -11,6 +11,7 @@ for mutation in \ '.source = null' \ '.destination.contact = "forbidden"' \ '.evidence_reference.registry_sha256 = "invalid"' \ + '.evidence_reference.revision = "51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0" | .evidence_reference.url = "https://github.com/atrinik/atrinik/blob/51aa7ac9d5ae9c0ff0b2a24a46b5d3e97739bbe0/governance/provenance-identities/registry.json#pir-c-22222222222222222222222222222222"' \ '.evidence_reference.url = "https://example.invalid/movable"' \ '.scope_approval.signature = "placeholder"'; do jq "${mutation}" "${source_record}" >"${temporary}"