adminandClaude Sonnet 5
a3df134caf
masterplan-lock / check (push) Successful in 3s
Security Scan (SIAX Cloud) / security (push) Successful in 16s
CI (SIAX Cloud) / integration (push) Successful in 28s
CI (SIAX Cloud) / quality (push) Successful in 35s
masterplan-lock / check (pull_request) Successful in 5s
CI (SIAX Cloud) / security (pull_request) Successful in 13s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 14s
CI (SIAX Cloud) / integration (pull_request) Successful in 28s
CI (SIAX Cloud) / security (push) Successful in 1m24s
CI (SIAX Cloud) / quality (pull_request) Successful in 1m9s
0pt's own "P007 pattern" release chain (added 2026-09-14) genuinely failed the ADR-W16-003 promotion bar an audit (2026-09-15) checked it against: syft/cosign installed via curl + a freshly-refetched checksums file (not a pinned, out-of-band-verified digest), no vulnerability scan of the built digest at all, cosign signed only the bare digest (no in-toto/SLSA statement, no source-SHA/build-identity/environment/SBOM-hash binding, no scoped key identity), and evidence committed straight back into this same mutable repo (siax/production-evidence/*.json, siax/source-bundles/*.json -- nine such commits already existed in this repo's history, deleted in this change). Delegates every bar item (1-7: pinned-tool install, SBOM, blocking vuln scan, in-toto attestation, scoped-key signing, pubkey verification, AUD0/ST0RE evidence storage) to sax3l/siax-templates' real, reviewed G17 reference implementation (PR #51, merged, pinned at 384e35060b91ea78ec045e14af114abf5d5eb23b), checked out at CI runtime via the SIAX_CI_TOKEN org secret this repo already had wired for a different cross-repo write -- picked over a vendored copy (the mechanism st0re/cl0ud/ api0 used) because 0pt has no prior vendoring convention anywhere in this repo. Matches aud0/h0st's own migrations for the same reason. See .siax/hooks/README.md for the full composition-mechanism rationale. .siax/hooks/G17.sh is the adapter: owns only 0pt-specific values (image repo, key identity, and a license-allowlist policy measured against 0pt's own real SBOM -- 280 components, one genuine new finding this pass caught that the old gate never checked at all: gcompat's NCSA license, triaged and allowed as the real OS-substrate license it is). cd.yml's own real signed-artifact wait/verify gate (predates this migration, genuinely 0pt-specific -- polls the registry for release.yml's artifact, verifies before triggering Coolify) is KEPT, updated from `cosign verify` (bare digest) to `cosign verify-attestation --type ...` to match the new attestation format `cosign attest` produces. A fresh cosign keypair was generated for this migration -- the previously committed cosign.pub had no corresponding private-key secret ever provisioned on this repo (the old release.yml's own comment confirms: "NOT YET SET on sax3l/0pt as of this writing"), so there was no real existing key material to carry forward. G20 (live-digest-equality) deliberately NOT wired in this pass: 0pt has no Coolify application provisioned and no /version endpoint for it to poll against -- see .siax/hooks/README.md "G20 -- deliberately not wired yet" for what would need to exist first. Verified for real during this migration (see PR description for the full evidence): a real image built from this repo's own Dockerfile, pushed to a local registry, SBOM'd (syft), scanned (trivy, 0 CRITICAL/HIGH findings), DSSE-attested (cosign attest) and verified (cosign verify-attestation) against the new cosign.pub, submitted to a mock AUD0 server enforcing the real eventInputSchema contract, plus three real tamper-rejection negative controls (wrong key, wrong predicate type, never-attested digest) against this exact artifact, plus the reference implementation's own 29/29-assertion selftest (including a real live check against production api.aud0.siax.io). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
5 lines
178 B
Plaintext
5 lines
178 B
Plaintext
-----BEGIN PUBLIC KEY-----
|
|
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjHBlAcoKLipNvBHujrscg7E06j6I
|
|
QU9pPVy+rDGUoIp+kTRlrgK4ObU37HZCaBQ8B6tf2Fqee0orLVo6SFJzdQ==
|
|
-----END PUBLIC KEY-----
|