diff --git a/.forgejo/workflows/image.yaml b/.forgejo/workflows/image.yaml index 3ce0b14..f77cfb1 100644 --- a/.forgejo/workflows/image.yaml +++ b/.forgejo/workflows/image.yaml @@ -51,7 +51,7 @@ jobs: SHORT="${REF:0:7}" mkdir -p buildctx "${HOME}/bin" wget -qO /tmp/repo.tar.gz \ - "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz" + "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz" tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1 wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \ | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker diff --git a/charts/flex-auth/templates/deployment.yaml b/charts/flex-auth/templates/deployment.yaml index f0a0fd0..4889a30 100644 --- a/charts/flex-auth/templates/deployment.yaml +++ b/charts/flex-auth/templates/deployment.yaml @@ -83,6 +83,8 @@ spec: {{- if not (and .Values.readback .Values.readback.enabled) }} {{- $binding = required "callerAuth.binding is required when callerAuth.mode is warn or enforce" .Values.callerAuth.binding }} {{- end }} + - --caller-audience + - {{ required "callerAuth.audience is required" .Values.callerAuth.audience | quote }} - --caller-auth-mode - {{ include "flex-auth.callerAuth.mode" . | quote }} - --caller-kubernetes-url diff --git a/docs/native-signer-workload.json b/docs/native-signer-workload.json new file mode 100644 index 0000000..5673647 --- /dev/null +++ b/docs/native-signer-workload.json @@ -0,0 +1,68 @@ +{ + "schema": "access-engine.signer-workload-reference.v1", + "owner_repo": "access-engine", + "existing_workload": "flex-auth", + "authoritative_owner_declaration": "tenancy.yaml#/workload_identity", + "exact_signer_identity_binding": "system:serviceaccount:flex-auth:flex-auth-secrets-engine", + "declaration_scope": "Existing retained Secrets lifecycle PDP pin; declaration of identity source only. Not a new managed workload, credential grant, zone promotion or live admission.", + "observed_runtime": { + "cluster": "railiance01", + "node_internal_ip": "92.205.62.239", + "namespace": "flex-auth", + "release": "flex-auth-secrets-engine", + "deployment": "flex-auth-secrets-engine", + "reviewer_service_account": "flex-auth-secrets-engine", + "source_evidence": "the-custodian/docs/changes/netkingdom-target-2026-10-16/access-native-preparation/live-metadata-r1.json", + "evidence_sha256": "bafce991e02083ac30c8d6ce15f037dc22087bbb5dc8185c472149b46bca47c2" + }, + "identity_roles": { + "signer_workload": "system:serviceaccount:flex-auth:flex-auth-secrets-engine", + "requesting_consumer": "system:serviceaccount:secrets-engine:secrets-engine", + "retained_caller_audience": "flex-auth", + "rule": "Signer custody binds the PDP workload, not the consumer or a human approver. Existing TokenReview reviewer projection does not grant signing-key custody." + }, + "custody_reference": { + "catalog_id": "flex-auth-decision-envelope-signing-key", + "owner_repo": "railiance-platform", + "current_state": "draft/nonresolvable", + "proposed_source_path": "platform/workloads/flex-auth/envelope-signing", + "proposed_private_field": "ED25519_PRIVATE_KEY", + "required_encoding": "unpadded base64url 32-byte Ed25519 seed; mount0440 allowed, group-write and world permissions refused", + "public_fields": [ + "ED25519_PUBLIC_KEY", + "kid" + ], + "proposed_catalog_workload_reference": { + "name": "flex-auth", + "declaration_ref": "access-engine/tenancy.yaml#/workload_identity", + "exact_binding": "system:serviceaccount:flex-auth:flex-auth-secrets-engine", + "resolution": "unknown until owner custody and managed-package admission; do not mark resolvable merely from source binding" + }, + "key_created_or_admitted": false + }, + "managed_package_limit": { + "rapp_declaration_ref": null, + "status": "Existing managed-deployable migration debt remains unknown under security-zones_v0.1 \u00a76; no matching authoritative rapp declaration was established. Existing source tenancy declaration supplies owner identity binding but cannot substitute for managed-package admission.", + "no_fiction": "Do not invent a rapp tuple or describe this Helm-managed Deployment as an independent operational unit to bypass the rule." + }, + "unchanged_limits": [ + "tenancy and zones grades are unchanged", + "service-pilot literal false gate unchanged", + "human variant unchanged", + "legacy twelve lifecycle actions remain the selected policy package", + "no signer Secret name, kid, public fingerprint, custody receipt or rollout permission is supplied" + ], + "consumer_admission": "Secrets owner independently admits public keys/pins and exact installed verifier; this file never bootstraps trust from PDP discovery.", + "native_tool": { + "path": "tools/verify_native_signer_receipt.py", + "requires": "Installed reviewed Secrets Engine package/helper and independent public admission; source request, authenticated response and original source record for one allow and one deny.", + "operation": "Offline captured receipt checks only, no network/token input/key build or protected effect. Current clock validation; no CLI backdating option.", + "result_limits": "Does not prove record durability, real rejected HTTP caller, audit receiver custody, rotation, or authorization to run effect." + }, + "ci": { + "trigger": "Existing ordinary push to main when .forgejo/workflows/image.yaml, Containerfile, cmd/**, internal/**, pkg/**, examples/**, go.mod/go.sum or tools/publish-runtime-images.sh changes; workflow_dispatch also exists. This patch changes the workflow, so an authorized push would trigger it.", + "scope": "Existing container-build runner and already admitted forgejo.coulomb.social/coulomb/flex-auth package only in legacy mode; paired access-engine package publication requires separate existing dispatch authority and is excluded.", + "provenance_preparation": "Download archive/${REF}.tar.gz using full validated GITHUB_SHA; existing publisher labels org.opencontainers.image.revision and reads back registry manifest digest.", + "not_invoked": "No push, workflow dispatch, Docker build, image publication or paid resource allocation in this source preparation." + } +} diff --git a/examples/secrets-engine/signer-receipt-admission.template.json b/examples/secrets-engine/signer-receipt-admission.template.json new file mode 100644 index 0000000..82da075 --- /dev/null +++ b/examples/secrets-engine/signer-receipt-admission.template.json @@ -0,0 +1,17 @@ +{ + "schema": "access-engine.signer-receipt-check.v1", + "trust_file": "/absolute/owner-admitted/public-trust.json", + "verifier": "/absolute/installed/secrets-engine-pdp-verify", + "verifier_sha256": "REPLACE_WITH_INDEPENDENTLY_REVIEWED_INSTALLED_HELPER_SHA256", + "allow_request": "/absolute/sanitized-native-receipts/allow-request.json", + "allow_envelope": "/absolute/sanitized-native-receipts/allow-envelope.json", + "allow_record": "/absolute/sanitized-native-receipts/allow-source-record.json", + "deny_request": "/absolute/sanitized-native-receipts/deny-request.json", + "deny_envelope": "/absolute/sanitized-native-receipts/deny-envelope.json", + "deny_record": "/absolute/sanitized-native-receipts/deny-source-record.json", + "expected_caller": { + "mode": "enforce", + "principal": "system:serviceaccount:secrets-engine:secrets-engine", + "audience": "flex-auth" + } +} diff --git a/tenancy.yaml b/tenancy.yaml index 4df3e90..be2857b 100644 --- a/tenancy.yaml +++ b/tenancy.yaml @@ -11,8 +11,16 @@ role: policy-decision-point workload_identity: name: flex-auth kind: platform-service - responsible_repo: flex-auth + responsible_repo: access-engine identity_bindings: + # Existing retained Secrets PDP pin; identity source, not key admission. + - scheme: kubernetes-service-account + authority: railiance01 + subject: system:serviceaccount:flex-auth:flex-auth-secrets-engine + principal_type: service + environment: prod + evidence: + - docs/native-signer-workload.json - scheme: kubernetes-service-account authority: railiance01 subject: system:serviceaccount:flex-auth:flex-auth-ops-warden diff --git a/tests/test_native_signer_receipt.py b/tests/test_native_signer_receipt.py new file mode 100644 index 0000000..74978a1 --- /dev/null +++ b/tests/test_native_signer_receipt.py @@ -0,0 +1,100 @@ +"""Offline tool regression using the producer's existing synthetic signer only.""" +import copy +from datetime import datetime,timedelta,timezone +import hashlib +import importlib.util +import json +import os +from pathlib import Path +import subprocess +import tempfile +import unittest +from unittest import mock + +ROOT=Path(__file__).resolve().parents[1] +@unittest.skipUnless(os.environ.get('SECRETS_ENGINE_SOURCE_ROOT'), 'requires reviewed Secrets consumer source/bundle for integration checks') +class NativeSignerReceiptTests(unittest.TestCase): + @classmethod + def setUpClass(cls): + global MODULE + spec=importlib.util.spec_from_file_location('signer_receipt',ROOT/'tools/verify_native_signer_receipt.py') + MODULE=importlib.util.module_from_spec(spec);spec.loader.exec_module(MODULE) + consumer=Path(os.environ['SECRETS_ENGINE_SOURCE_ROOT']) + cls.scratch=tempfile.TemporaryDirectory();cls.base=Path(cls.scratch.name) + env={**os.environ,'GOFLAGS':'-buildvcs=false'} + cls.verifier=cls.base/'verify';cls.signer=cls.base/'synthetic-sign' + for binary,package in [(cls.verifier,'.'),(cls.signer,'./testsupport/signer')]: + subprocess.run(['go','build','-p','2','-o',str(binary),package],cwd=consumer/'verifier',env=env,check=True) + cls.now=datetime.now(timezone.utc) + env=json.loads((consumer/'tests/fixtures/pdp-signature/decision_rotate_signed.json').read_text()) + env['provenance']['caller']={'mode':'enforce','principal':'system:serviceaccount:secrets-engine:secrets-engine','audience':'flex-auth','not_after':(cls.now+timedelta(minutes=20)).isoformat()} + env['lifetime']['not_before']=(cls.now-timedelta(seconds=1)).isoformat();env['lifetime']['expires_at']=(cls.now+timedelta(minutes=15)).isoformat() + def sign(envelope): + return json.loads(subprocess.check_output([str(cls.signer)],input=json.dumps(envelope).encode())) + env['diagnostics']['target']={'phase':{'uses':1}} + cls.allow=sign(env) + req=json.loads((ROOT/'examples/secrets-engine/check_request_allow_rotate.json').read_text()) + (cls.base/'allow-request.json').write_text(json.dumps(req)) + denied=copy.deepcopy(req);denied['action']='execute-ccr' + cls.deny=copy.deepcopy(env);cls.deny['effect']='deny';cls.deny['binding']['action']='execute-ccr';cls.deny['binding']['submitted_request_digest']=MODULE.request_digest(denied);cls.deny=sign(cls.deny) + (cls.base/'deny-request.json').write_text(json.dumps(denied)) + provenance=cls.allow['provenance'];cls.trust={key:provenance[key] for key in ('evaluator','mode','policy_package','policy_version','policy_package_digest')} + cls.trust.update(schema='secrets-engine.pdp-trust.v1',keys={'testdata-ed25519':'IVL40Zt5HSRFMkLhXy6rbLfP-ntqXtMAl5YOBpiB2xI'}) + @classmethod + def tearDownClass(cls):cls.scratch.cleanup() + def setUp(self): + for label,envelope in [('allow',self.allow),('deny',self.deny)]: + for kind in ('envelope','record'):(self.base/f'{label}-{kind}.json').write_text(json.dumps(envelope)) + (self.base/'trust.json').write_text(json.dumps(self.trust)) + self.config={'schema':'access-engine.signer-receipt-check.v1','trust_file':str(self.base/'trust.json'),'verifier':str(self.verifier),'verifier_sha256':hashlib.sha256(self.verifier.read_bytes()).hexdigest(),'expected_caller':{'mode':'enforce','principal':'system:serviceaccount:secrets-engine:secrets-engine','audience':'flex-auth'}} + for label in ('allow','deny'): + for kind in ('request','envelope','record'):self.config[f'{label}_{kind}']=str(self.base/f'{label}-{kind}.json') + def test_genuine_signed_receipt_and_refusal_matrix(self): + result=MODULE.verify(self.config,now=self.now) + self.assertTrue(all(result['checks'].values()));self.assertEqual(len(result['checks']),7) + def test_changed_source_record_refuses(self): + record=copy.deepcopy(self.allow);record['effect']='deny';(self.base/'allow-record.json').write_text(json.dumps(record)) + with self.assertRaises(ValueError):MODULE.verify(self.config,now=self.now) + def test_nested_record_number_type_change_refuses(self): + for replacement in (True,1.0): + with self.subTest(replacement_type=type(replacement).__name__): + record=copy.deepcopy(self.allow) + record['diagnostics']['target']['phase']['uses']=replacement + (self.base/'allow-record.json').write_text(json.dumps(record)) + with self.assertRaises(ValueError):MODULE.verify(self.config,now=self.now) + + def test_receipt_hashes_use_the_once_read_verified_bytes(self): + actual_read=MODULE.read + seen={} + original={str(self.base/f'{label}-{suffix}.json'):actual_read(str(self.base/f'{label}-{suffix}.json')) for label in ('allow','deny') for suffix in ('request','envelope','record')} + def once(path): + if path in original: + seen[path]=seen.get(path,0)+1 + self.assertEqual(seen[path],1,'receipt was reopened after verification') + return actual_read(path) + with mock.patch.object(MODULE,'read',side_effect=once): + result=MODULE.verify(self.config,now=self.now) + self.assertEqual(len(seen),6) + for label in ('allow','deny'): + for suffix in ('request','envelope','record'): + self.assertEqual(result['input_sha256'][label+'_'+suffix],hashlib.sha256(original[str(self.base/f'{label}-{suffix}.json')]).hexdigest()) + + def test_oversized_file_read_is_bounded(self): + stream=mock.MagicMock();stream.__enter__.return_value=stream;stream.read.return_value=b'x'*524289 + with mock.patch.object(Path,'open',return_value=stream): + with self.assertRaises(ValueError):MODULE.read('/absolute/oversized.json') + stream.read.assert_called_once_with(524289) + + def test_unadmitted_helper_digest_refuses(self): + self.config['verifier_sha256']='0'*64 + with self.assertRaises(ValueError):MODULE.verify(self.config,now=self.now) + def test_disabled_caller_admission_refuses(self): + self.config['expected_caller']['mode']='disabled' + with self.assertRaises(ValueError):MODULE.verify(self.config,now=self.now) + def test_expired_captured_allow_refuses(self): + with self.assertRaises(MODULE.DecisionError):MODULE.verify(self.config,now=self.now+timedelta(minutes=16)) + def test_wrong_independent_policy_pin_refuses(self): + wrong=copy.deepcopy(self.trust);wrong['policy_package_digest']='sha256:'+'0'*64;(self.base/'trust.json').write_text(json.dumps(wrong)) + with self.assertRaises(MODULE.DecisionError):MODULE.verify(self.config,now=self.now) + +if __name__=='__main__':unittest.main() diff --git a/tools/verify_native_signer_receipt.py b/tools/verify_native_signer_receipt.py new file mode 100644 index 0000000..70be9f2 --- /dev/null +++ b/tools/verify_native_signer_receipt.py @@ -0,0 +1,135 @@ +#!/usr/bin/env python3 +"""Verify captured native decision receipts with the installed Secrets verifier. + +Offline only: no token input, network request, key generation, build or effect. +Use an independently reviewed admission file; success never admits that file. +""" +from __future__ import annotations +import argparse +import copy +from datetime import datetime, timezone +import hashlib +import json +from pathlib import Path +import re + +# These are the consumer's existing verifier/binding functions, not another PDP +# or signature/canonicalization implementation. Install the reviewed bundle first. +from secrets_engine.authorization import request_digest, validate_decision_envelope +from secrets_engine.decision_signature import authenticate_response, load_trust, strict_json +from secrets_engine.errors import DecisionError + +FIELDS = {'schema','trust_file','verifier','verifier_sha256','allow_request','allow_envelope','allow_record','deny_request','deny_envelope','deny_record','expected_caller'} + +def read(path: str) -> bytes: + target = Path(path) + if not target.is_absolute(): + raise ValueError('absolute input path required') + with target.open("rb") as stream: + data = stream.read(524289) + if len(data) > 524288: + raise ValueError('receipt input too large') + return data + +def same_json_types(left, right) -> bool: + """JSON value correspondence only; never signature canonicalization.""" + if type(left) is not type(right): + return False + if isinstance(left, dict): + return left.keys() == right.keys() and all(same_json_types(value,right[key]) for key,value in left.items()) + if isinstance(left, list): + return len(left) == len(right) and all(same_json_types(a,b) for a,b in zip(left,right)) + return left == right + + +def stamp(value: str) -> datetime: + parsed = datetime.fromisoformat(value.replace('Z','+00:00')) + if parsed.tzinfo is None: + raise ValueError('timezone required') + return parsed.astimezone(timezone.utc) + +def verify(config: dict, *, now: datetime | None = None) -> dict: + if not isinstance(config,dict) or set(config) != FIELDS or config['schema'] != 'access-engine.signer-receipt-check.v1': + raise ValueError('unsupported admission fields') + current = now or datetime.now(timezone.utc) + caller = config['expected_caller'] + if caller != {'mode':'enforce','principal':'system:serviceaccount:secrets-engine:secrets-engine','audience':'flex-auth'}: + raise ValueError('retained native caller admission required') + executable = Path(config['verifier']) + if not executable.is_absolute() or not re.fullmatch('[a-f0-9]{64}',config['verifier_sha256']) or hashlib.sha256(executable.read_bytes()).hexdigest() != config['verifier_sha256']: + raise ValueError('installed verifier digest mismatch') + trust_bytes = read(config['trust_file']) + trust = load_trust(Path(config['trust_file'])) + if not same_json_types(trust,strict_json(trust_bytes)): + raise ValueError('trust input changed during verification') + if (trust['evaluator'],trust['mode'],trust['policy_package'],trust['policy_version']) != ('flex-auth/local','standalone','secrets-engine.catalog-lane.lifecycle','v2'): + raise ValueError('signer-only lifecycle package required') + checks = {} + envelopes = {} + inputs = {} + requests = {} + for label in ('allow','deny'): + blobs = {suffix:read(config[label+'_'+suffix]) for suffix in ('request','envelope','record')} + body = blobs['envelope'] + # Strict decode before helper; authenticated typed return alone is acted on. + strict_json(body.decode('utf-8')) + envelope = authenticate_response(body,trust=trust,verifier=executable) + request = strict_json(blobs['request']) + record = strict_json(blobs['record']) + if not same_json_types(record,envelope): + raise ValueError('captured original source record differs from authenticated response') + provenance = envelope['provenance']['caller'] + if any(provenance.get(key) != value for key,value in caller.items()) or stamp(provenance['not_after']) <= current: + raise ValueError('native caller provenance missing or expired') + if label == 'allow': + validate_decision_envelope(envelope,request,accepted_policy_packages={trust['policy_package']},accepted_policy_versions={trust['policy_version']},now=current) + else: + if envelope['effect'] != 'deny' or envelope['binding']['submitted_request_digest'] != request_digest(request): + raise ValueError('deny receipt does not bind exact negative request') + envelopes[label] = envelope + requests[label] = request + for suffix in ('request','envelope','record'): + inputs[label+'_'+suffix] = hashlib.sha256(blobs[suffix]).hexdigest() + checks[label+'_authenticated_bound_and_record_matched'] = True + # These are local refusals against the captured real producer envelope. They + # do not claim a rejected caller was exercised on the native HTTP endpoint. + for label in ('altered','unsigned','unknown_kid','wrong_policy_pin'): + bad = copy.deepcopy(envelopes['allow']); pins = copy.deepcopy(trust) + if label == 'altered': bad['binding']['action'] = 'forged-action' + elif label == 'unsigned': bad['signature'] = {'mode':'unsigned'} + elif label == 'unknown_kid': bad['signature']['kid'] = 'unadmitted-key' + else: pins['policy_package_digest'] = 'sha256:'+'0'*64 + try: + authenticate_response(json.dumps(bad).encode(),trust=pins,verifier=executable) + except DecisionError: + checks[label+'_refused'] = True + else: + raise ValueError('negative authentication case accepted') + try: + expiry=stamp(envelopes['allow']['lifetime']['expires_at']) + request=requests['allow'] + validate_decision_envelope(envelopes['allow'],request,accepted_policy_packages={trust['policy_package']},accepted_policy_versions={trust['policy_version']},now=expiry) + except DecisionError: + checks['expiry_boundary_refused'] = True + else: + raise ValueError('expired allow accepted') + return {'schema':'access-engine.signer-receipt-result.v1','checks':checks,'input_sha256':inputs,'verifier_sha256':config['verifier_sha256'],'trust_file_sha256':hashlib.sha256(trust_bytes).hexdigest(),'boundary':'offline captured signed receipt checks only; no native caller-denial, record durability, receiver custody, trust admission, rotation or protected effect inferred'} + +def main() -> int: + parser=argparse.ArgumentParser(description=__doc__) + parser.add_argument('--admission',type=Path,required=True) + parser.add_argument('--output',type=Path,required=True) + args=parser.parse_args() + try: + config=strict_json(read(str(args.admission))) + result=verify(config) + args.output.write_text(json.dumps(result,indent=2)+'\n') + except (OSError,ValueError,TypeError,KeyError,RecursionError,DecisionError): + # Never dump source objects, unexpected key material or verifier stderr. + print('signer receipt verification refused') + return 1 + print('captured signer receipt checks passed') + return 0 + +if __name__ == '__main__': + raise SystemExit(main()) diff --git a/values/secrets-engine.yaml b/values/secrets-engine.yaml index 5b819bd..391eff9 100644 --- a/values/secrets-engine.yaml +++ b/values/secrets-engine.yaml @@ -13,6 +13,8 @@ args: - /opt/flex-auth/examples/secrets-engine/policy_package.md callerAuth: mode: enforce + # Retained runtime audience is explicit; signer preparation does not rename it. + audience: flex-auth kubernetesURL: https://10.43.0.1 binding: secrets-engine=system:serviceaccount:secrets-engine:secrets-engine consumer: diff --git a/workplans/FLEX-WP-0024-decision-envelope-authenticity.md b/workplans/FLEX-WP-0024-decision-envelope-authenticity.md index 1eaeac5..a26b4f9 100644 --- a/workplans/FLEX-WP-0024-decision-envelope-authenticity.md +++ b/workplans/FLEX-WP-0024-decision-envelope-authenticity.md @@ -184,7 +184,7 @@ This is source preparation only, not signer admission or deployed acceptance. ```task id: FLEX-WP-0024-T06 -status: wait +status: progress priority: high ``` @@ -197,3 +197,32 @@ then update actual deployed status. No signer or runtime trust is admitted by th source review. This task owns the producer-side native gate; SECRETS-WP-0014 owns consumer admission/enforcement. The old fixture completion never established this gate, so the workplan is reopened rather than claiming it already passed. + + +2026-10-16 owner native preparation: T06 is `progress` because Access still owns +signer workload declaration, artifact/provenance and source/provider-join preparation; +no unqualified cross-owner wait is claimed. Read-only actual release metadata and +bounded proposal are in the Custodian +`docs/changes/netkingdom-target-2026-10-16/access-native-preparation/`. +The real Platform custody route `flex-auth-decision-envelope-signing-key` exists but +is draft/nonresolvable; no production kid/public fingerprint, Secret projection or +custody receipt is admitted. Coordinate that named commitment through CUST-WP-0080 +instead of inventing a Platform task/approval. SECRETS-WP-0014-T03 owns installed +consumer native verification and must not form a circular blocking dependency. + +The first proposed native trial only signs the unchanged lifecycle package on the +existing retained release; `execute-ccr` remains denied. Current service-pilot +`runtime_admission := false` remains mandatory: the source ServicePilotInputs is +not yet wired into HTTP, and public service_actor_binding never authenticates the +caller. Later activation needs a complete reviewed provider join, exact policy and +operation admission, artifact digests, owner execution/rollback proposal and native +receipts. Preparation/local synthetic success grants none of those permissions. + + +2026-10-16 source-only native preparation adds the existing Secrets PDP ServiceAccount +to `tenancy.yaml` with evidence in `docs/native-signer-workload.json`, makes the +retained `flex-auth` audience explicit, pins CI archive fetch to the full source +revision, and adds offline native signer receipt verification using the existing +Secrets verifier. No key, trust, image publication or live activation is admitted. +The managed workload's missing rapp declaration remains explicit migration debt; +this source binding does not fabricate a package declaration or raise its grade.