Record exact zlib candidate source review and refinements
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
d47cbd05a5
commit
2fe072a866
22 changed files with 1218 additions and 0 deletions
|
|
@ -0,0 +1,82 @@
|
|||
[
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json",
|
||||
"sha256": "72c2f3d87a45d8a3b77fe0a06dc6c793003e2ee351574b42829a546450f70783"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json",
|
||||
"sha256": "30c685422c4608b045c7027c795033ecfda12ecfab9df7a09f6e7f4f5bb0d898"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py",
|
||||
"sha256": "ed5f303cb063230ba20806b2be3b99d6249e6f62bfca6af0780894fd7b697154"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json",
|
||||
"sha256": "b8d8b9abe82ec5c19023fb9e7af289bbd2b591e079b55ae5a785aca7c5e3c337"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json",
|
||||
"sha256": "380c6172adc36b5907ba5384d14d799e49eda410732dfce1878fbe6db184ff0c"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
|
||||
"sha256": "8597be8f8a861705f3dd4d054506d160b1b16b9b16a687a63505eaf067ebeee5"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
|
||||
"sha256": "1bcff9cf3f073b6053a5ae20d09e9c70dc4da30e0d9ec1520d426a116c8e1a34"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
|
||||
"sha256": "1b95bd1d10d0775b73ba71e10b1ad6396f8c1720a5b52a26111f1db6f4e9ee28"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"sha256": "76c1d2f2b060da9ff06d3627a33b2b7007a7818f0c1472f50d26778fcafd7547"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json",
|
||||
"sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json",
|
||||
"sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json",
|
||||
"sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py",
|
||||
"sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py",
|
||||
"sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json",
|
||||
"sha256": "f450cd2b29b818782d432d010dc0221564d500b61df15413add203c09cdaa19e"
|
||||
},
|
||||
{
|
||||
"original_path": "intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/accepted-66-6af44c10/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"sha256": "7b3f5340c833e6e6641741044369b0251dfe31bb5bf6c1719d07821226a51376"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,114 @@
|
|||
[
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-probes.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "72c2f3d87a45d8a3b77fe0a06dc6c793003e2ee351574b42829a546450f70783"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-source-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "30c685422c4608b045c7027c795033ecfda12ecfab9df7a09f6e7f4f5bb0d898"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/independent_overlay_probes.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ed5f303cb063230ba20806b2be3b99d6249e6f62bfca6af0780894fd7b697154"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/mapping.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "b8d8b9abe82ec5c19023fb9e7af289bbd2b591e079b55ae5a785aca7c5e3c337"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "380c6172adc36b5907ba5384d14d799e49eda410732dfce1878fbe6db184ff0c"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8597be8f8a861705f3dd4d054506d160b1b16b9b16a687a63505eaf067ebeee5"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bcff9cf3f073b6053a5ae20d09e9c70dc4da30e0d9ec1520d426a116c8e1a34"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1b95bd1d10d0775b73ba71e10b1ad6396f8c1720a5b52a26111f1db6f4e9ee28"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "76c1d2f2b060da9ff06d3627a33b2b7007a7818f0c1472f50d26778fcafd7547"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/audit-refinement.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/source-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/test_artifact_audit.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/intermediate-64509029-whiteout-probe.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "f450cd2b29b818782d432d010dc0221564d500b61df15413add203c09cdaa19e"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-platform-final-review-stage/railiance-platform/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "7b3f5340c833e6e6641741044369b0251dfe31bb5bf6c1719d07821226a51376"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"source_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0",
|
||||
"maker_tests_independently_passed": 8,
|
||||
"independent_synthetic_probes": {
|
||||
"OO_refusal_before_read": true,
|
||||
"root_directory_removed_refused": true,
|
||||
"root_opaque_refused": true,
|
||||
"nested_opaque_parent_preserved_descendant_refused": true,
|
||||
"nested_removed_directory_refused": true
|
||||
},
|
||||
"all66_hashes_match": true,
|
||||
"initial27_exact_archive_verified": true,
|
||||
"actual_candidate_changed_by_refinement": false,
|
||||
"native_actions": false
|
||||
}
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R2",
|
||||
"work_record": "RPF-IN-0008",
|
||||
"role": "railiance-platform technical owner only",
|
||||
"status": "technical-agreement-source-candidate-preparation-only",
|
||||
"source_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0",
|
||||
"source_paths": 66,
|
||||
"initial_conditional_review_manifest_sha256": "380c6172adc36b5907ba5384d14d799e49eda410732dfce1878fbe6db184ff0c",
|
||||
"intermediate_source_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"history": "Exact initial four owner files plus original manifest/map archived durably at initial-380c6172; intermediate645 checker/test/proof/source-manifest and independent failed reason retained. Same completed IN8 anchor precedes review.",
|
||||
"refinements_verified": [
|
||||
"Optimization refused before artifact reads/output under -O and independently -OO.",
|
||||
"Directory mode/UID/GID included; drift negatives pass.",
|
||||
"Leading dot whiteout names preserved; root/nested deletion and opaque boundaries refuse fixture drift for correct effective paths.",
|
||||
"Existing source/package provenance, exact763c base, four-file context and bounded existing owner publication/credential routes unchanged."
|
||||
],
|
||||
"actual_local_candidate": {
|
||||
"daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
|
||||
"registry_digest": null,
|
||||
"context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"effective_changed_files": [
|
||||
"lib/apk/db/installed",
|
||||
"usr/lib/libz.so.1.3.2"
|
||||
],
|
||||
"directories": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"nine_base_layers_preserved": true,
|
||||
"runtime_policy_module_unchanged": true,
|
||||
"fullscan_same_snapshot_baseline_findings": 1,
|
||||
"fullscan_same_snapshot_local_candidate_findings": 0,
|
||||
"raw_runtime_config_bytes_identical": false,
|
||||
"closed_default_normalization_semantics_unchanged": true,
|
||||
"initial_or_intermediate_candidate_failed": false
|
||||
},
|
||||
"validation": {
|
||||
"source_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0",
|
||||
"maker_tests_independently_passed": 8,
|
||||
"independent_synthetic_probes": {
|
||||
"OO_refusal_before_read": true,
|
||||
"root_directory_removed_refused": true,
|
||||
"root_opaque_refused": true,
|
||||
"nested_opaque_parent_preserved_descendant_refused": true,
|
||||
"nested_removed_directory_refused": true
|
||||
},
|
||||
"all66_hashes_match": true,
|
||||
"initial27_exact_archive_verified": true,
|
||||
"actual_candidate_changed_by_refinement": false,
|
||||
"native_actions": false
|
||||
},
|
||||
"remaining_gates": [
|
||||
"Actual owner CI source-pinned publication and immutable registry descriptor/layer/config/source readback.",
|
||||
"Actual published full unsuppressed pinned scan/SBOM/runtime/purpose proof; local artifact zero does not extend to a different artifact.",
|
||||
"Concrete separately reviewed native target/data-retaining protocol and fresh founder disposition; old purpose R2 approval does not authorize zlib release."
|
||||
],
|
||||
"scope_limits": {
|
||||
"owner_source_write": false,
|
||||
"registry_publish": false,
|
||||
"native_workload_changed": false,
|
||||
"database_access": false,
|
||||
"credentials_read": false,
|
||||
"human_native_approval": false,
|
||||
"T05_complete": false,
|
||||
"other_owner_role": false
|
||||
},
|
||||
"checker_scope": "Agreement concerns this exact bounded candidate and challenged proof boundary; does not certify a general-purpose OCI extraction or signature verifier."
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
"""Synthetic public-artifact boundary probes; no native/provider/database use."""
|
||||
import importlib.util,json,subprocess,sys,tempfile
|
||||
from pathlib import Path
|
||||
root=Path(sys.argv[1])
|
||||
spec=importlib.util.spec_from_file_location("fixtures",root/"test_artifact_audit.py")
|
||||
f=importlib.util.module_from_spec(spec);spec.loader.exec_module(f)
|
||||
def layer(entries):
|
||||
b=f.io.BytesIO()
|
||||
with f.tarfile.open(fileobj=b,mode="w") as t:
|
||||
for name,data in entries:f.add(t,name,data)
|
||||
return b.getvalue()
|
||||
results={}
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
r=subprocess.run([sys.executable,"-OO",str(f.CHECKER),str(Path(tmp)/"absent")],capture_output=True,text=True)
|
||||
results["OO_refusal_before_read"]=r.returncode!=0 and "REFUSED: optimized Python" in r.stderr and "FileNotFoundError" not in r.stderr
|
||||
for name,base,overlay,expected in [
|
||||
("removed_directory",[("usr",None)],[(".wh.usr",b"")],"usr"),
|
||||
("root_opaque",[("usr",None)],[(".wh..wh..opq",b"")],"usr"),
|
||||
("nested_opaque",[("usr",None),("usr/inner",None)],[("usr/.wh..wh..opq",b"")],"usr/inner"),
|
||||
("nested_removed_directory",[("usr",None),("usr/inner",None)],[("usr/.wh.inner",b"")],"usr/inner"),
|
||||
]:
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
p=Path(tmp);f.fixture(p);b=layer(base)
|
||||
f.archive(p/"base-image.tar",[b],["base"])
|
||||
f.archive(p/"image.tar",[b,layer(overlay),layer([])],["base","overlay","cleanup"])
|
||||
r=subprocess.run([sys.executable,str(f.CHECKER),str(p)],capture_output=True,text=True)
|
||||
results[name]=r.returncode!=0 and repr({expected}) in r.stderr and not (p/"artifact-comparison.json").exists()
|
||||
print(json.dumps(results,sort_keys=True))
|
||||
if not all(results.values()):raise SystemExit(1)
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
[
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
|
||||
"sha256": "8597be8f8a861705f3dd4d054506d160b1b16b9b16a687a63505eaf067ebeee5"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
|
||||
"sha256": "1bcff9cf3f073b6053a5ae20d09e9c70dc4da30e0d9ec1520d426a116c8e1a34"
|
||||
},
|
||||
{
|
||||
"original_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
|
||||
"sha256": "1b95bd1d10d0775b73ba71e10b1ad6396f8c1720a5b52a26111f1db6f4e9ee28"
|
||||
},
|
||||
{
|
||||
"original_path": "intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"archived_path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/initial-380c6172/owner-snapshot/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"sha256": "76c1d2f2b060da9ff06d3627a33b2b7007a7818f0c1472f50d26778fcafd7547"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
[
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/conditional-source-review.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8597be8f8a861705f3dd4d054506d160b1b16b9b16a687a63505eaf067ebeee5"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/directory-metadata-probe.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bcff9cf3f073b6053a5ae20d09e9c70dc4da30e0d9ec1520d426a116c8e1a34"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
|
||||
"staged_path": "/tmp/infd-zlib-platform-review-stage/railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/source-review-probes.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1b95bd1d10d0775b73ba71e10b1ad6396f8c1720a5b52a26111f1db6f4e9ee28"
|
||||
},
|
||||
{
|
||||
"repo": "railiance-platform",
|
||||
"path": "intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"staged_path": "/tmp/infd-zlib-platform-review-stage/railiance-platform/intakes/RPF-IN-0008-infd-zlib-candidate-review.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "76c1d2f2b060da9ff06d3627a33b2b7007a7818f0c1472f50d26778fcafd7547"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R1",
|
||||
"work_record": "RPF-IN-0008",
|
||||
"role": "railiance-platform technical owner only",
|
||||
"status": "narrow-proof-helper-refinement-requested",
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"paths": 27,
|
||||
"all_manifest_hashes_match": true,
|
||||
"all13_local_evidence_hashes_match": true,
|
||||
"source_test_methods_independently_passed": 4,
|
||||
"actual_local_scan_base": "one MEDIUM CVE-2026-85091",
|
||||
"actual_local_scan_candidate": "zero findings all severities stated DB snapshot",
|
||||
"independent_directory_metadata_delta": {},
|
||||
"sound_boundaries": [
|
||||
"Exact763c current purpose base; signed official package/index hashes verified in offline named package upgrade against base keys, no allow-untrusted, no broader APK/Python/base refresh.",
|
||||
"Current local final regular files differ only libz and APK installed DB; independent local export analysis confirms no directory metadata delta. Nine base layers/app36/policy9d/runtime/keys/world/Python/OpenSSL retained, closed serialization default caveat visible.",
|
||||
"Workflow fixed owner/exactGITHUB_SHA+publicsourcearchive/fourcontext hash checks, existing admitted registry capability passwordstdin/private Dockerconfig cleanup; no borrowedcredential/newgrant/no nativeKubernetes or database action.",
|
||||
"Workflow publishes candidate only; post-CI actual immutable registry descriptor/layer/config/source proof and fullscan/SBOM remain mandatory before separate nativefounderproposal. LocalimageID78bfdcc/config625d notregistrydigest and localzero doesnotextendactualCIartifact.",
|
||||
"Current native763c remains legitimate inheritedMEDIUM/manualT05dueOct18, purposeR2approval/currentDB/journals immutable and not reused for remediation."
|
||||
],
|
||||
"required_refinement": {
|
||||
"source": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"issue": "Seven assertion gates disappear with optimization; generated effective runtime / scan-zero claims can remain unconditional.",
|
||||
"required": "Explicit sys.flags.optimize refusal before artifact archive/JSON/output IO (or non-assert guards), with regression proving no evidence output under -O. Include directory metadata in reusable full filesystem proof or retain explicit independent supplemental proof before actual published artifact approval."
|
||||
},
|
||||
"publication_scan_boundary": "CI does not itself perform pinned fullscan/SBOM before push. This is adequately disclosed for source-only candidate publication; no clean published artifact/native release is acknowledged by this review. Source guard and actual artifact proof must be valid before any native proposal.",
|
||||
"scope_limits": {
|
||||
"candidate_publication_executed": false,
|
||||
"native_changes": false,
|
||||
"database_access": false,
|
||||
"credentials_read": false,
|
||||
"owner_source_write": false,
|
||||
"human_native_release_approval": false,
|
||||
"T05_complete": false,
|
||||
"other_owner_role": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"public_local_exports_only": true,
|
||||
"native_action": false,
|
||||
"directory_metadata_changes": {}
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"paths": 27,
|
||||
"all_manifest_hashes_match": true,
|
||||
"all13_local_evidence_hashes_match": true,
|
||||
"actual_raw_scan_findings": {
|
||||
"base-trivy-full.json": [
|
||||
[
|
||||
"CVE-2026-85091",
|
||||
"MEDIUM"
|
||||
]
|
||||
],
|
||||
"trivy-full.json": []
|
||||
},
|
||||
"artifact_helper_assert_count": 7,
|
||||
"artifact_helper_optimized_code_keeps_assertion_errors": false,
|
||||
"local_candidate_registry_digest": null,
|
||||
"publication_or_native_action": false
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
---
|
||||
id: RPF-IN-0008
|
||||
kind: intake
|
||||
type: intake
|
||||
title: "Platform source review of separate INFD zlib candidate publication"
|
||||
repo: railiance-platform
|
||||
lane: supervised
|
||||
status: closed
|
||||
owner: railiance-platform
|
||||
requested_by: the-custodian
|
||||
origin: handoff
|
||||
origin_ref: INFD-WP-0009-T05
|
||||
priority: high
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
tags: [security, cross-owner, review]
|
||||
---
|
||||
|
||||
Bounded new Platform review of source candidate manifest `8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66`: official zlib package/index provenance, exact current763c base and minimal layer/runtime changes, local scan/SBOM proof, source-pinned ownerCI publication/credential boundaries. Distinct from completed purpose-actuator RPF-IN-0007 and its approvedR2 trial. No native rollout/data action, owner source write, registry publish or carried-forward human approval. Native763c still has disclosed inheritedMEDIUM/T05 dueOct18; source candidate is unpublished. This owner work record precedes formal review.
|
||||
|
||||
## Completed initial source review
|
||||
|
||||
Initial technical review `RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R1` validates exact27-path8d345 source/localproofs and publication owner boundary. Source proof helper must refuse optimized Python before artifact IO; directory coverage verified independently for current artifacts and required on actual published readback. Four source methods pass; raw scans confirm base1MED/candidate0 on stated DB. Current local candidate remains unpublished; no native authorization transferred. Review refinement remains in promoted INFD-WP-0009-T05, separate from unpromoted verifier residual and completed IN7. Completed owner work record precedes formal entry.
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{
|
||||
"candidate_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"source_only": true,
|
||||
"synthetic_fixture_only": true,
|
||||
"native_actions": false,
|
||||
"probe": "directory whiteout normalization",
|
||||
"refused": true,
|
||||
"correct_effective_removed_directory_reason": false,
|
||||
"incorrect_dot_stripped_whiteout_reason": true,
|
||||
"finding": "lstrip dot normalization prevents declared whiteout branch from interpreting rootfs deletion",
|
||||
"current_local_candidate_failed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
{
|
||||
"base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779",
|
||||
"candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f",
|
||||
"candidate_registry_digest": null,
|
||||
"base_layers_preserved": 9,
|
||||
"new_layers": 2,
|
||||
"effective_runtime_config_identical": true,
|
||||
"raw_config_bytes_identical": false,
|
||||
"serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.",
|
||||
"labels_before": {
|
||||
"org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173",
|
||||
"org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"labels_after": {
|
||||
"org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a",
|
||||
"org.opencontainers.image.revision": "uncommitted-T05-local-preparation",
|
||||
"social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
|
||||
},
|
||||
"final_changed_files": {
|
||||
"lib/apk/db/installed": {
|
||||
"before": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
420,
|
||||
0,
|
||||
0,
|
||||
"f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001"
|
||||
]
|
||||
},
|
||||
"usr/lib/libz.so.1.3.2": {
|
||||
"before": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57"
|
||||
],
|
||||
"after": [
|
||||
"file",
|
||||
493,
|
||||
0,
|
||||
0,
|
||||
"ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_metadata_compared": true,
|
||||
"directory_count_base": 313,
|
||||
"directory_count_candidate": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"sbom_package_count_base": 44,
|
||||
"sbom_package_count_candidate": 44,
|
||||
"sbom_only_delta": {
|
||||
"zlib": [
|
||||
"1.3.2-r0",
|
||||
"1.3.2-r1"
|
||||
]
|
||||
},
|
||||
"full_scan_baseline_findings": 1,
|
||||
"full_scan_candidate_allseverity_findings": 0,
|
||||
"db_snapshot_same": true,
|
||||
"native_workload_changed": false,
|
||||
"candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
|
||||
"candidate_local_image_config_id_kind": "Docker-save OCI export config SHA; distinct from legacy daemon imageID; closed default serialization differs."
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"proposal_id": "INFD-WP-0009-T05/zlib-85091-r1",
|
||||
"same_trial": true,
|
||||
"original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66",
|
||||
"original_local_verification_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1",
|
||||
"reason": "Platform source-review guard gaps; original actual candidate/build/scan did not fail",
|
||||
"changes": [
|
||||
"Explicit optimized Python refusal before any archive/JSON read",
|
||||
"Filesystem audit includes final directory mode/UID/GID metadata",
|
||||
"Three synthetic tests: optimized malformed artifact refuses before read; unchanged directory passes; mode/UID/GID mutation refuses"
|
||||
],
|
||||
"actual_existing_artifact_reaudit": "Passed; no directory metadata differences, same two changed files",
|
||||
"candidate_image_unchanged": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
|
||||
"four_file_build_context_unchanged": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"registry_publication": false,
|
||||
"native_changes": false,
|
||||
"checker_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794",
|
||||
"tests_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71",
|
||||
"comparison_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89",
|
||||
"verification_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92"
|
||||
}
|
||||
|
|
@ -0,0 +1,408 @@
|
|||
[
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": ".forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/.dockerignore",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/Containerfile",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/pins.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/check_build_inputs.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/check_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/compare_runtime.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "tools/zlib_overlay/test_candidate.py",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py",
|
||||
"original_sha256": null,
|
||||
"staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9"
|
||||
},
|
||||
{
|
||||
"repo": "informed-decision",
|
||||
"path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md",
|
||||
"original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223",
|
||||
"staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
"""Synthetic artifact boundaries; never access owner/native databases."""
|
||||
from pathlib import Path
|
||||
import io,json,subprocess,sys,tarfile,tempfile,unittest
|
||||
CHECKER=Path(__file__).with_name('verify_local_artifacts.py')
|
||||
def add(t,name,data=None,metadata=(0o755,0,0)):
|
||||
m=tarfile.TarInfo(name);m.mode,m.uid,m.gid=metadata
|
||||
if data is None:m.type=tarfile.DIRTYPE;t.addfile(m)
|
||||
else:m.size=len(data);t.addfile(m,io.BytesIO(data))
|
||||
def archive(path,layers,ids):
|
||||
with tarfile.open(path,'w') as t:
|
||||
add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':[f'{i}.tar' for i in range(len(layers))]}]).encode())
|
||||
add(t,'config.json',json.dumps({'rootfs':{'diff_ids':ids},'config':{}}).encode())
|
||||
for i,data in enumerate(layers):add(t,f'{i}.tar',data)
|
||||
def layer(metadata):
|
||||
b=io.BytesIO()
|
||||
with tarfile.open(fileobj=b,mode='w') as t:add(t,'usr',metadata=metadata)
|
||||
return b.getvalue()
|
||||
def fixture(root,metadata=(0o755,0,0)):
|
||||
base=layer((0o755,0,0));candidate=layer(metadata)
|
||||
archive(root/'base-image.tar',[base],['base'])
|
||||
archive(root/'image.tar',[base,candidate,layer(metadata)],['base','overlay','cleanup'])
|
||||
for name,version in [('base-sbom.cdx.json','1.3.2-r0'),('sbom.cdx.json','1.3.2-r1')]:
|
||||
(root/name).write_text(json.dumps({'components':[{'name':'zlib','version':version,'purl':'pkg:apk/zlib'}]}))
|
||||
for name,findings in [('base-trivy-full.json',[{'VulnerabilityID':'CVE-2026-85091','Severity':'MEDIUM'}]),('trivy-full.json',[])]:
|
||||
(root/name).write_text(json.dumps({'Results':[{'Vulnerabilities':findings}]}))
|
||||
class ArtifactAuditTests(unittest.TestCase):
|
||||
def execute(self,root,optimize=False):
|
||||
return subprocess.run([sys.executable,*(['-O'] if optimize else []),str(CHECKER),str(root)],capture_output=True,text=True)
|
||||
def test_optimized_tampered_artifacts_refused_before_read(self):
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root=Path(tmp);(root/'base-image.tar').write_bytes(b'tampered not an archive')
|
||||
r=self.execute(root,True)
|
||||
self.assertNotEqual(r.returncode,0);self.assertIn('REFUSED: optimized Python',r.stderr)
|
||||
self.assertNotIn('ReadError',r.stderr);self.assertFalse((root/'artifact-comparison.json').exists())
|
||||
def test_matching_directory_metadata_passes(self):
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
root=Path(tmp);fixture(root);r=self.execute(root)
|
||||
self.assertEqual(r.returncode,0,r.stderr)
|
||||
proof=json.loads((root/'artifact-comparison.json').read_text())
|
||||
self.assertTrue(proof['directory_metadata_compared']);self.assertEqual(proof['directory_metadata_delta'],{})
|
||||
def test_directory_mode_uid_gid_drift_refuses(self):
|
||||
for metadata in [(0o777,0,0),(0o755,10001,0),(0o755,0,10001)]:
|
||||
with self.subTest(metadata=metadata),tempfile.TemporaryDirectory() as tmp:
|
||||
root=Path(tmp);fixture(root,metadata);r=self.execute(root)
|
||||
self.assertNotEqual(r.returncode,0);self.assertIn("{'usr'}",r.stderr)
|
||||
self.assertFalse((root/'artifact-comparison.json').exists())
|
||||
if __name__=='__main__':unittest.main()
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
from pathlib import Path
|
||||
import hashlib,io,json,tarfile,sys
|
||||
if sys.flags.optimize:
|
||||
raise SystemExit("REFUSED: optimized Python disables required artifact validation")
|
||||
root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build')
|
||||
def image(path):
|
||||
with tarfile.open(path) as archive:
|
||||
manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1
|
||||
configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes)
|
||||
files={}
|
||||
for name in manifest[0]['Layers']:
|
||||
with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer:
|
||||
for member in layer:
|
||||
path=member.name.lstrip('./');p=Path(path)
|
||||
if p.name=='.wh..wh..opq':
|
||||
folder=p.parent.as_posix();files={key:value for key,value in files.items() if not key.startswith(folder+'/')};continue
|
||||
if p.name.startswith('.wh.'):
|
||||
removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue
|
||||
if member.isfile():
|
||||
data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest())
|
||||
elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None)
|
||||
elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname)
|
||||
else:continue
|
||||
files[path]=value
|
||||
return config,hashlib.sha256(configbytes).hexdigest(),files
|
||||
base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar')
|
||||
assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids']
|
||||
changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)}
|
||||
expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'}
|
||||
assert set(changed)<=expected,set(changed)
|
||||
a,b=base['config'].copy(),candidate['config'].copy()
|
||||
labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{})
|
||||
a.pop('Image',None);b.pop('Image',None)
|
||||
defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None}
|
||||
for key,value in defaults.items():
|
||||
a.setdefault(key,value);b.setdefault(key,value)
|
||||
assert a==b,(a,b)
|
||||
components=[]
|
||||
for name in ['base-sbom.cdx.json','sbom.cdx.json']:
|
||||
data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')})
|
||||
sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)}
|
||||
assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta
|
||||
vulns=[]
|
||||
for name in ['base-trivy-full.json','trivy-full.json']:
|
||||
data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])])
|
||||
assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM'
|
||||
assert not vulns[1]
|
||||
proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False}
|
||||
(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed)))
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
---
|
||||
id: RPF-IN-0008
|
||||
kind: intake
|
||||
type: intake
|
||||
title: "Platform source review of separate INFD zlib candidate publication"
|
||||
repo: railiance-platform
|
||||
lane: supervised
|
||||
status: closed
|
||||
owner: railiance-platform
|
||||
requested_by: the-custodian
|
||||
origin: handoff
|
||||
origin_ref: INFD-WP-0009-T05
|
||||
priority: high
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
tags: [security, cross-owner, review]
|
||||
---
|
||||
|
||||
Bounded new Platform review of source candidate manifest `8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66`: official zlib package/index provenance, exact current763c base and minimal layer/runtime changes, local scan/SBOM proof, source-pinned ownerCI publication/credential boundaries. Distinct from completed purpose-actuator RPF-IN-0007 and its approvedR2 trial. No native rollout/data action, owner source write, registry publish or carried-forward human approval. Native763c still has disclosed inheritedMEDIUM/T05 dueOct18; source candidate is unpublished. This owner work record precedes formal review.
|
||||
|
||||
## Completed initial source review
|
||||
|
||||
Initial technical review `RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R1` validates exact27-path8d345 source/localproofs and publication owner boundary. Source proof helper must refuse optimized Python before artifact IO; directory coverage verified independently for current artifacts and required on actual published readback. Four source methods pass; raw scans confirm base1MED/candidate0 on stated DB. Current local candidate remains unpublished; no native authorization transferred. Review refinement remains in promoted INFD-WP-0009-T05, separate from unpromoted verifier residual and completed IN7. Completed owner work record precedes formal entry.
|
||||
|
||||
## Completed amended-source review preparation
|
||||
|
||||
Same bounded review completed against the amended source. Exact initial conditional source review and four-file workrecord/probe snapshot are archived under `initial-380c6172`; initial failed optimized-proof boundary remains historical. Seven maker tests and independent optimized/deletion boundary probes reviewed. This completed workrecord is staged before the final formal review. Published-image readback and separate native authorization remain outside this source review.
|
||||
|
||||
## Completed final exact-source review
|
||||
|
||||
Final frozen66-path source `3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0` completed after optimization, directory metadata and whiteout-boundary refinements. Eight maker tests and five independent synthetic boundary probes pass. All66 hashes match. Actual existing local candidate remains unpublished with unchanged two-file delta,313 directory records and stated scan snapshot. This workrecord update precedes the formal narrow-source agreement; original380c conditional and645 failed proof-boundary evidence remain archived. No native result, approval, publication or T05 completion is recorded.
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
|
||||
"all74_hashes_match": true,
|
||||
"maker_test_methods_independently_passed": 9,
|
||||
"independent_cli_order_cases_passed": 8,
|
||||
"independent_prior_negative_cases_passed": 5,
|
||||
"order_case_assertion": "Full CLI success plus emitted libz replacement file hash equals current-layer synthetic bytes for root/nested regular/opaque whiteouts before and after additions.",
|
||||
"fixtures_only": true,
|
||||
"native_actions": false,
|
||||
"actual_candidate_image_unchanged": true
|
||||
}
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R3",
|
||||
"work_record": "RPF-IN-0008",
|
||||
"role": "railiance-platform technical owner only",
|
||||
"status": "technical-agreement-source-candidate-preparation-only",
|
||||
"source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
|
||||
"source_paths": 74,
|
||||
"initial_conditional_review_manifest_sha256": "380c6172adc36b5907ba5384d14d799e49eda410732dfce1878fbe6db184ff0c",
|
||||
"intermediate_source_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
|
||||
"history": "Exact previous16 review files plus original manifest/map archived at accepted-66-6af44c10. This includes original380c four-file snapshot and645 failed boundary evidence. Prior agreement preserved as intermediate, superseded for source-whiteout semantics. Same completed IN8 trial anchor updated before entry; no new privilege or success.",
|
||||
"refinements_verified": [
|
||||
"Optimization refused before artifact reads/output under -O and independently -OO.",
|
||||
"Directory mode/UID/GID included; drift negatives pass.",
|
||||
"Leading dot whiteout names preserved; root/nested deletion and opaque boundaries refuse fixture drift for correct effective paths.",
|
||||
"Existing source/package provenance, exact763c base, four-file context and bounded existing owner publication/credential routes unchanged.",
|
||||
"Markers apply only to previous-layer state; current-layer additions merged after masking. Eight independent full CLI cases verify replacement hashes survive root/nested regular/opaque markers in both stream orders."
|
||||
],
|
||||
"actual_local_candidate": {
|
||||
"daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
|
||||
"registry_digest": null,
|
||||
"context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
|
||||
"effective_changed_files": [
|
||||
"lib/apk/db/installed",
|
||||
"usr/lib/libz.so.1.3.2"
|
||||
],
|
||||
"directories": 313,
|
||||
"directory_metadata_delta": {},
|
||||
"nine_base_layers_preserved": true,
|
||||
"runtime_policy_module_unchanged": true,
|
||||
"fullscan_same_snapshot_baseline_findings": 1,
|
||||
"fullscan_same_snapshot_local_candidate_findings": 0,
|
||||
"raw_runtime_config_bytes_identical": false,
|
||||
"closed_default_normalization_semantics_unchanged": true,
|
||||
"initial_or_intermediate_candidate_failed": false
|
||||
},
|
||||
"validation": {
|
||||
"source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
|
||||
"all74_hashes_match": true,
|
||||
"maker_test_methods_independently_passed": 9,
|
||||
"independent_cli_order_cases_passed": 8,
|
||||
"independent_prior_negative_cases_passed": 5,
|
||||
"order_case_assertion": "Full CLI success plus emitted libz replacement file hash equals current-layer synthetic bytes for root/nested regular/opaque whiteouts before and after additions.",
|
||||
"fixtures_only": true,
|
||||
"native_actions": false,
|
||||
"actual_candidate_image_unchanged": true
|
||||
},
|
||||
"remaining_gates": [
|
||||
"Actual owner CI source-pinned publication and immutable registry descriptor/layer/config/source readback.",
|
||||
"Actual published full unsuppressed pinned scan/SBOM/runtime/purpose proof; local artifact zero does not extend to a different artifact.",
|
||||
"Concrete separately reviewed native target/data-retaining protocol and fresh founder disposition; old purpose R2 approval does not authorize zlib release."
|
||||
],
|
||||
"scope_limits": {
|
||||
"owner_source_write": false,
|
||||
"registry_publish": false,
|
||||
"native_workload_changed": false,
|
||||
"database_access": false,
|
||||
"credentials_read": false,
|
||||
"human_native_approval": false,
|
||||
"T05_complete": false,
|
||||
"other_owner_role": false
|
||||
},
|
||||
"checker_scope": "Agreement concerns this exact bounded candidate and challenged proof boundary; does not certify a general-purpose OCI extraction or signature verifier.",
|
||||
"previous_agreement_manifest_sha256": "6af44c102084f7cdf09268264c5fd7bb0b0b354723edb10b7da2c1800ab726d4",
|
||||
"previous_source_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0"
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
"""CLI proof regression using temporary synthetic public image archives only."""
|
||||
import importlib.util,subprocess,tempfile,json,hashlib,sys
|
||||
from pathlib import Path
|
||||
root=Path(sys.argv[1]);spec=importlib.util.spec_from_file_location("fixture",root/"test_artifact_audit.py");f=importlib.util.module_from_spec(spec);spec.loader.exec_module(f)
|
||||
def layer(entries):
|
||||
b=f.io.BytesIO()
|
||||
with f.tarfile.open(fileobj=b,mode="w") as t:
|
||||
for name,data in entries:f.add(t,name,data)
|
||||
return b.getvalue()
|
||||
results={};target="usr/lib/libz.so.1.3.2";new=b"synthetic-new"
|
||||
for marker in [".wh..wh..opq","usr/lib/.wh..wh..opq",".wh.usr","usr/lib/.wh.libz.so.1.3.2"]:
|
||||
for first in [True,False]:
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
p=Path(tmp);f.fixture(p);base=layer([(target,b"synthetic-old")]);entries=[(marker,b""),(target,new)]
|
||||
if not first:entries.reverse()
|
||||
f.archive(p/"base-image.tar",[base],["base"]);f.archive(p/"image.tar",[base,layer(entries),layer([])],["base","overlay","cleanup"])
|
||||
r=subprocess.run([sys.executable,str(f.CHECKER),str(p)],capture_output=True,text=True)
|
||||
proof=json.loads((p/"artifact-comparison.json").read_text()) if r.returncode==0 else {}
|
||||
after=proof.get("final_changed_files",{}).get(target,{}).get("after")
|
||||
results[marker+":"+str(first)]=r.returncode==0 and after is not None and after[0]=="file" and after[-1]==hashlib.sha256(new).hexdigest()
|
||||
print(json.dumps(results,sort_keys=True))
|
||||
if not all(results.values()):raise SystemExit(1)
|
||||
35
intakes/RPF-IN-0008-infd-zlib-candidate-review.md
Normal file
35
intakes/RPF-IN-0008-infd-zlib-candidate-review.md
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
---
|
||||
id: RPF-IN-0008
|
||||
kind: intake
|
||||
type: intake
|
||||
title: "Platform source review of separate INFD zlib candidate publication"
|
||||
repo: railiance-platform
|
||||
lane: supervised
|
||||
status: closed
|
||||
owner: railiance-platform
|
||||
requested_by: the-custodian
|
||||
origin: handoff
|
||||
origin_ref: INFD-WP-0009-T05
|
||||
priority: high
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
tags: [security, cross-owner, review]
|
||||
---
|
||||
|
||||
Bounded new Platform review of source candidate manifest `8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66`: official zlib package/index provenance, exact current763c base and minimal layer/runtime changes, local scan/SBOM proof, source-pinned ownerCI publication/credential boundaries. Distinct from completed purpose-actuator RPF-IN-0007 and its approvedR2 trial. No native rollout/data action, owner source write, registry publish or carried-forward human approval. Native763c still has disclosed inheritedMEDIUM/T05 dueOct18; source candidate is unpublished. This owner work record precedes formal review.
|
||||
|
||||
## Completed initial source review
|
||||
|
||||
Initial technical review `RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R1` validates exact27-path8d345 source/localproofs and publication owner boundary. Source proof helper must refuse optimized Python before artifact IO; directory coverage verified independently for current artifacts and required on actual published readback. Four source methods pass; raw scans confirm base1MED/candidate0 on stated DB. Current local candidate remains unpublished; no native authorization transferred. Review refinement remains in promoted INFD-WP-0009-T05, separate from unpromoted verifier residual and completed IN7. Completed owner work record precedes formal entry.
|
||||
|
||||
## Completed amended-source review preparation
|
||||
|
||||
Same bounded review completed against the amended source. Exact initial conditional source review and four-file workrecord/probe snapshot are archived under `initial-380c6172`; initial failed optimized-proof boundary remains historical. Seven maker tests and independent optimized/deletion boundary probes reviewed. This completed workrecord is staged before the final formal review. Published-image readback and separate native authorization remain outside this source review.
|
||||
|
||||
## Completed final exact-source review
|
||||
|
||||
Final frozen66-path source `3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0` completed after optimization, directory metadata and whiteout-boundary refinements. Eight maker tests and five independent synthetic boundary probes pass. All66 hashes match. Actual existing local candidate remains unpublished with unchanged two-file delta,313 directory records and stated scan snapshot. This workrecord update precedes the formal narrow-source agreement; original380c conditional and645 failed proof-boundary evidence remain archived. No native result, approval, publication or T05 completion is recorded.
|
||||
|
||||
## Completed lower-layer-only whiteout refinement review
|
||||
|
||||
Same IN8 preparation trial completed against frozen74-path source `724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec`. Whiteout markers now mask prior-layer state before merging current additions. Nine maker tests and thirteen independent CLI probes pass, including eight root/nested regular/opaque whiteout order variants that check the actual emitted replacement-file hash. All74 hashes match; existing local candidate remains unchanged/unpublished. Exact preceding16-file agreement snapshot and manifest/map are archived at `accepted-66-6af44c10` before supersession. This completed anchor precedes formal review and does not create a new success or native authority.
|
||||
Loading…
Add table
Add a link
Reference in a new issue