commit a17c877e8e15f7217143a486255a81f67337bc36
parent 72053f8de902c4c758157d15ac63fba7c0332a2e
Author: triesap <tyson@radroots.org>
Date: Mon, 7 Sep 2026 11:43:58 +0000
contracts: canonicalize the artifact contract
Diffstat:
3 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/contracts/release/lib-artifact-contract.v3.json b/contracts/release/lib-artifact-contract.v3.json
@@ -1 +1 @@
-{"artifact_policy":{"checksums":"required","cyclonedx_version":"1.6","exact_tree_source_archives":"required","fresh_install":"required","git_history_bundles":"forbidden","intoto_statement":"required","notices":"required","reproducibility_build_count":2,"secret_scan":"required","unsigned_packages":"required","unsigned_slsa_provenance":"required"},"contract_version":3,"delivery":{"candidate_class":"unsigned_nonpublishing","developer_id_signing":"forbidden","developer_team_id":"forbidden","distribution_signing":"forbidden","embedded_platform_adhoc_signing":"permitted_non_distribution_only","g2":"unauthorized","notarization":"unauthorized","production_activation":"unauthorized","publication":"unauthorized","signing":"unauthorized"},"implementation_owner_step":298,"output":[{"classification":"production","id":"package","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"app","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"check","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"devshell","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"overlay","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"shared_helpers","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"fixture_test_only_nondefault","id":"fixture_test_only_nondefault","platforms":["macos_aarch64","linux_x86_64"]}],"package_contract":{"app_role":"installed_release_bundle_inspection","artifact_format":"nix_store_derivation","cargo_package":"radroots","flake_app":"apps.<system>.default","flake_package":"packages.<system>.default","identity":"radroots_lib","package_role":"public_library_workspace_release_bundle","package_version":"0.1.0-alpha","product_version":"0.1.0-alpha"},"platforms":["macos_aarch64","linux_x86_64"],"producer":{"command_authority":"repository_flake","kind":"nix_flake","nix_binding":"required","nix_produced":true,"source_task":"nix_build_repository_outputs"},"repository":"oss/lib","schema":"radroots.release.artifact-contract.v3","source_archive":{"binding":"canonical_exact_source_revision_tree_archive","compression":"none","compression_timestamp":"not_applicable","content":"exact_source_revision_tree","directory_entries":"omitted","entry_order":"bytewise_git_path","file_mode":"git_index_100644_or_100755","format":"ustar","gid":0,"git_history":"forbidden","gname":"","hardlinks":"forbidden","mtime_source":"candidate_source_date_epoch","path_prefix":"none","pax_headers":"forbidden","submodules":"forbidden","symlinks":"forbidden","trailer":"two_zero_blocks","uid":0,"uname":""},"source_binding":{"dirty_tree":"forbidden","kind":"exact_clean_git_commit","revision_location":"aggregate_source_revision"},"sqlite":{"high_level_authority":"sqlx_only","incremental_backup_adapter":"sealed_native_sqlx_owned_locked_handle_only","native_linkage_count":1,"second_pool_connection_query_transaction_migration_authority":"forbidden"}}
+{"artifact_policy":{"checksums":"required","cyclonedx_version":"1.6","exact_tree_source_archives":"required","fresh_install":"required","git_history_bundles":"forbidden","intoto_statement":"required","notices":"required","reproducibility_build_count":2,"secret_scan":"required","unsigned_packages":"required","unsigned_slsa_provenance":"required"},"contract_version":3,"delivery":{"candidate_class":"unsigned_nonpublishing","developer_id_signing":"forbidden","developer_team_id":"forbidden","distribution_signing":"forbidden","embedded_platform_adhoc_signing":"permitted_non_distribution_only","g2":"unauthorized","notarization":"unauthorized","production_activation":"unauthorized","publication":"unauthorized","signing":"unauthorized"},"implementation_owner_step":298,"output":[{"classification":"production","id":"package","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"app","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"check","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"devshell","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"overlay","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"production","id":"shared_helpers","platforms":["macos_aarch64","linux_x86_64"]},{"classification":"fixture_test_only_nondefault","id":"fixture_test_only_nondefault","platforms":["macos_aarch64","linux_x86_64"]}],"package_contract":{"app_role":"installed_release_bundle_inspection","artifact_format":"nix_store_derivation","cargo_package":"radroots","flake_app":"apps.<system>.default","flake_package":"packages.<system>.default","identity":"radroots_lib","package_role":"public_library_workspace_release_bundle","package_version":"0.1.0-alpha","product_version":"0.1.0-alpha"},"platforms":["macos_aarch64","linux_x86_64"],"producer":{"command_authority":"repository_flake","kind":"nix_flake","nix_binding":"required","nix_produced":true,"source_task":"nix_build_repository_outputs"},"repository":"oss/lib","schema":"radroots.release.artifact-contract.v3","source_archive":{"binding":"canonical_exact_source_revision_tree_archive","compression":"none","compression_timestamp":"not_applicable","content":"exact_source_revision_tree","directory_entries":"omitted","entry_order":"bytewise_git_path","file_mode":"git_index_100644_or_100755","format":"ustar","gid":0,"git_history":"forbidden","gname":"","hardlinks":"forbidden","mtime_source":"candidate_source_date_epoch","path_prefix":"none","pax_headers":"forbidden","submodules":"forbidden","symlinks":"forbidden","trailer":"two_zero_blocks","uid":0,"uname":""},"source_binding":{"dirty_tree":"forbidden","kind":"exact_clean_git_commit","revision_location":"aggregate_source_revision"},"sqlite":{"high_level_authority":"sqlx_only","incremental_backup_adapter":"sealed_native_sqlx_owned_locked_handle_only","native_linkage_count":1,"second_pool_connection_query_transaction_migration_authority":"forbidden"}}
+\ No newline at end of file
diff --git a/tools/xtask/src/rshr_202_step_298_gate.rs b/tools/xtask/src/rshr_202_step_298_gate.rs
@@ -19,7 +19,7 @@ const EXACT_SOURCES: &[(&str, &str)] = &[
),
(
"contracts/release/lib-artifact-contract.v3.json",
- "bc352a132dd4c0e6f1d2ae7449998833efe1fdda2ab851e512bc9241c49edbf0",
+ "11d8fa7bc96191919a3d20189061aadcee105eefe546290032c2f2bab91b2f77",
),
(
"contracts/architecture/decisions/services_hardening_build_qualification.v3.json",
@@ -43,7 +43,7 @@ const EXACT_SOURCES: &[(&str, &str)] = &[
),
(
"tools/xtask/src/service_build_qualification.rs",
- "20dbae0f446bdd95e99f84d1c27ef4dec422eae8035ead5876adba047db20a9f",
+ "4a440a42c4387421fcf9d6c2d1fa86563822753fc1911f9552f098f38a1cc166",
),
(
"tools/xtask/src/target_qualification.rs",
diff --git a/tools/xtask/src/service_build_qualification.rs b/tools/xtask/src/service_build_qualification.rs
@@ -15,7 +15,7 @@ const MAX_FIXTURE_FILE_BYTES: usize = 1_048_576;
const SOURCE_LOCK_V3_SHA256: &str =
"3bc32c8ca2cecb06c8f8239ab1fe1fcfba93fe3ef0d60e9b078390347d08f817";
const ARTIFACT_CONTRACT_V3_SHA256: &str =
- "bc352a132dd4c0e6f1d2ae7449998833efe1fdda2ab851e512bc9241c49edbf0";
+ "11d8fa7bc96191919a3d20189061aadcee105eefe546290032c2f2bab91b2f77";
const NIX_SYSTEMS_RELATIVE: &str = "build/nix/service/systems.nix";
const NIX_SYSTEMS_BYTES: &[u8] = b"[\n \"aarch64-darwin\"\n \"x86_64-linux\"\n]\n";
