Add release-time provenance verification against upstream - #21
Merged
Conversation
check_release_provenance.py only confirms the manifest is filled in. Add verify_release_provenance.py, which clones the upstream repos at the recorded commits and proves the vendored bytes came from them, so a hand-vendored tree with a stale r_commit/core_commit cannot ship: - core (hard): every top-level object under extern/NNS-core must exist in core_repo@core_commit (NNS-core is vendored by a plain copy, so its git objects appear verbatim upstream). - R src tree (hard, offline): recorded r_src_tree_hash must equal the vendored tools/NNS/src tree hash. - R tarball (hard when present): if r_repo commits the vendored tarball at r_commit, its blob must match the vendored tarball blob. The built R package normalizes R/ sources, so the committed tarball is the reliable cross-repo anchor; absence is reported as a skipped note. Wire it into the release workflow's provenance-check job for real releases only (push tag or publish=pypi); dry runs may carry placeholder provenance. Allow-list the script for the subprocess lint ban (it shells out to git), and add an offline unit test asserting the committed manifest's r_src_tree_hash matches the vendored tree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
check_release_provenance.pyonly confirms the manifest is filled in (nounknown, tag matches version) — it trusts the recorded SHAs. This adds a self-checking layer so a hand-vendored tree with a staler_commit/core_commitcan't slip into a release (the exact situation that left the manifest asunknownuntil this session's backfill).What
scripts/verify_release_provenance.pyclones the upstreams at the recorded commits and proves the vendored bytes came from them:extern/NNS-coremust exist incore_repo@core_commit. NNS-core is vendored by a plain copy, so its git objects appear verbatim upstream — layout/method-agnostic.r_src_tree_hashmust equal the vendoredtools/NNS/srctree hash.r_repocommits the vendored tarball atr_commit, its blob must match the vendored tarball blob. (The built R package normalizesR/sources — only 3/37 source blobs survive byte-identical — so the committed tarball is the reliable cross-repo anchor; absence is a skipped note, not a failure.)Wired into the release workflow's
provenance-checkjob for real releases only (pushtag orpublish=pypi); dry runs may carry placeholder provenance.Validation (run locally)
extern/NNS-core↔NNS-core@cfc25a34,tools/NNS↔NNS@905b8bbd.core_commitat a commit with different core content fails with precise per-object messages.test_verify_provenance_offline.py) asserts the committedr_src_tree_hashmatches the vendored tree — a standing guard against future drift.release.ymlparses.https://claude.ai/code/session_012bjk4Y5eT1Sva8tNJjqUSw
Generated by Claude Code