Verify protected package provenance before repository signing #78
No reviewers
Labels
No labels
P0
P1
P2
P3
audio
bakery
boot
breadbug
bug
build
ci
dependencies
design
disk
docs
encryption
final
firewall
graphics
hardware
idle
installer
keybinds
nvidia
packages
phase-1
polish
recovery
reliability
reproducibility
secure-boot
security
shell
signing
snapshots
supply-chain
swap
tech-debt
theming
ux
website
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Breadway/bos!78
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix/bos-40-package-provenance"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The signer currently gives registry-uploaded bytes repository trust without checking the producing build. This change pins the complete name/version/architecture/filename/SHA256 set in a protected checked-in policy. Collection requests approved filenames directly and verifies exact archive bytes and PKGINFO before any signature. Local overrides and offline sign-only mode enforce the same policy.
Initial digests come from the existing published database, independently verified with the pinned repository key. The signed database and signature are committed as reviewable bootstrap evidence. Each BOS builder emits an unapproved provenance artifact recording the source commit, workflow, run ID and package digest. New package bytes require an independently reviewed policy update; registry metadata and candidate artifacts cannot advance trust. breadlock's separate producer uses the documented recorder and policy review procedure.
Verified both scripts: test-package-provenance.py serves an isolated loopback registry, replaces a package at the same filename/version, and proves collection, local overrides and offline sign-only refuse it before a signature while preserving the prior published tree. It also checks identity mismatches, extra files, duplicate policy fields, unsafe filenames and build-provenance recording. test-offline-signing.py creates temporary unrelated keys and verifies real package/database signatures for the approved set, ISO integrity and key-purpose rejection. Bootstrap detached signature verification, workflow YAML and shell blocks, Python compilation and diff checks pass.
Stacked on BOS-39 PR #75 to keep signing isolation and provenance review separate. Retarget to main after that dependency merges. Deployment key provisioning/removal gates remain as documented in #75; this PR changes no live trust or private material. The six-hour Zen poll still builds candidate updates, but publication now also requires policy review and offline approval.
Closes #40
Independent review of PR #78 at
7716e35247c8bcc910cec5bb39f50006ac0c6958Acceptance mapping: exact protected package identity/version/architecture/filename/digest validation is implemented in
scripts/package-provenance.py:34-60,89-106; the signer validates downloaded bytes and uses allowlisted package filenames before signing atscripts/ci-publish-signed-repo.sh:88-98,140-160. The same-version registry replacement test checks rejection before signatures and preservation of the prior tree inscripts/test-package-provenance.py:74-94. The reported bootstrap database signature is checked against the pinned repository key.The existing review's stack dependency remains: PR #78 targets
fix/bos-39-isolate-signingand must be retargeted after BOS-39 lands. Forgejo reports no CI statuses for this head, and the offline key migration and protected-policy approval remain activation gates. BOS is release-sensitive. No merge attempted.