GovOPlaN/govoplan
1
0
Fork 0
Code Issues 10 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Bind installed releases to signed artifact receipts

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-22 20:42:05 +02:00
parent 4dc0c8d013
commit 9c0650b2ed
13 changed files with 2179 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
tools/assessments/govoplan_assessment/capability_fit.py
View File

@@ -59,6 +59,10 @@ def review_capability_fit(
workspace_root: Path | None = None,
installed_evidence: dict[str, Any] | None = None,
installed_evidence_schema: dict[str, Any] | None = None,
installer_receipt: dict[str, Any] | None = None,
installer_receipt_schema: dict[str, Any] | None = None,
installer_authority_keyring: dict[str, Any] | None = None,
installer_authority_keyring_schema: dict[str, Any] | None = None,
boundary_evidence: dict[str, Any] | None = None,
boundary_evidence_schema: dict[str, Any] | None = None,
boundary_authority_keyring: dict[str, Any] | None = None,
@@ -377,6 +381,24 @@ def review_capability_fit(
verification_time=evidence_verification_time,
verification_mode=evidence_verification_mode,
catalog_trusted=catalog_dependency_trusted,
catalog_artifacts=(
catalog.get("release", {}).get("artifacts")
if isinstance(catalog.get("release"), dict)
and "artifacts" in catalog.get("release", {})
else None
),
catalog_sha256=canonical_hash(catalog),
catalog_channel=_text(catalog.get("channel")),
catalog_sequence=_integer(catalog.get("sequence")),
installer_receipt=installer_receipt,
installer_receipt_schema=installer_receipt_schema,
installer_authority_keyring=installer_authority_keyring,
installer_authority_keyring_schema=installer_authority_keyring_schema,
forbidden_installer_public_keys=public_key_material_from_keyrings(
published_keyring,
trusted_keyring,
boundary_authority_keyring or {},
),
)
findings.extend(
Finding(item.severity, item.code, item.message, item.assessment_ids)
@@ -398,6 +420,7 @@ def review_capability_fit(
forbidden_authority_public_keys=public_key_material_from_keyrings(
published_keyring,
trusted_keyring,
installer_authority_keyring or {},
),
)
findings.extend(
@@ -939,7 +962,7 @@ def build_report(
**boundary_scope,
}
return {
"report_version": "0.4.0",
"report_version": "0.5.0",
"status": status,
"assessment_id": assessment.get("assessment_id"),
"assessment_release": assessment.get("release", {}).get("ref")
@@ -977,7 +1000,11 @@ def render_review(report: dict[str, Any]) -> str:
(
"Scope: schema, signed release metadata, optional local tag provenance, "
+ (
"and locally observed installed-composition consistency evidence; release origin remains a separate proof boundary."
(
"and locally observed installed-composition evidence independently bound to signed release origin."
if release_origin_checked
else "and locally observed installed-composition consistency evidence; release origin remains a separate proof boundary."
)
if installed_checked
else (
"and supplied installed-composition evidence that did not establish local proof."