lib

Core libraries for Radroots
git clone https://radroots.dev/git/lib.git
Log | Files | Refs | README

services_hardening_release_artifacts.v4.json (4499B)

      1 {
      2   "schema": "radroots.services-hardening.release-artifacts-decisions.v4",
      3   "contract_version": 4,
      4   "decision_state": "active",
      5   "owner_step": 305,
      6   "predecessor": {
      7     "schema": "radroots.services-hardening.release-artifacts-decisions.v3",
      8     "filename": "services_hardening_release_artifacts.v3.json",
      9     "transition": "forward_only_replace"
     10   },
     11   "command": "cargo xtask service-release-artifacts",
     12   "modes": ["check", "write"],
     13   "required_arguments": ["mode", "service_root", "lib_root", "input_root", "output_root", "target", "source_date_epoch", "candidate_digest"],
     14   "service_metadata_path": "Cargo.toml.workspace.metadata.radroots.service_release",
     15   "service_metadata_fields": ["service", "service_package", "binary_name", "version"],
     16   "service_license_path": "Cargo.toml.workspace.package.license_or_package.license",
     17   "source_lock_schema": "radroots.service.source-lock.v3",
     18   "source_lock_definition": "contracts/architecture/decisions/services_hardening_source_lock.v3.json",
     19   "artifact_contract_binding": "source_lock_exact_regular_file_bytes_in_same_service_revision",
     20   "artifact_admission_contract": "contracts/architecture/decisions/services_hardening_artifact_admission.v1.json",
     21   "supported_targets": ["aarch64-apple-darwin", "x86_64-unknown-linux-gnu"],
     22   "candidate_binding": "explicit_sha256_candidate_identity_digest",
     23   "lib_root_binding": "canonical_public_lib_git_root_containing_the_locked_revision",
     24   "binary_admission": "exact_format_architecture_linkage_structural_and_native_bounded_help_smoke",
     25   "oci_admission": "safe_materialization_exact_manifest_config_AGPL_labels_layers_and_entrypoint",
     26   "input_inventory": ["config.example.toml", "config.schema.json", "nixos-module.nix", "oci-image.tar.gz", "service-binary", "systemd.service"],
     27   "excluded_parent_owned_inputs": ["backup_restore_runbook", "operator_runbook"],
     28   "service_root_inventory": ["LICENSE-APACHE", "LICENSE-MIT", "radroots.service.source-lock.v3.toml"],
     29   "output_inventory": ["LICENSE-APACHE", "LICENSE-MIT", "SHA256SUMS", "THIRD-PARTY-LICENSES.txt", "THIRD-PARTY-NOTICES.txt", "artifact-manifest.v2.json", "artifact-scan.v1.json", "binary.tar.gz", "config.example.toml", "config.schema.json", "lib-source.tar", "nixos-module.nix", "oci-image.tar.gz", "oci-image.v1.json", "provenance.intoto.jsonl", "radroots.service.source-lock.v3.toml", "sbom.cdx.json", "service-source.tar", "source-archives.v3.json", "systemd.service"],
     30   "canonical_json": "compact_utf8_json_with_one_final_lf",
     31   "checksum_format": "sha256_lower_hex_two_spaces_path_lf_sorted_by_path",
     32   "source_archive_format": "canonical_uncompressed_ustar_exact_git_revision_tree_without_history",
     33   "sbom_format": "cyclonedx_json_1_6_complete_cargo_nix_and_artifact_closure",
     34   "license_evidence": "exact_dependency_attribution_with_bounded_license_texts",
     35   "provenance_posture": "candidate_derived_unsigned_intoto_statement_slsa_v1_exact_manifest_subjects",
     36   "protected_material_scan_scope": "all_artifact_bytes_and_bounded_nested_binary_oci_layer_and_source_archive_payloads",
     37   "confidentiality_state": "derived_only_from_the_exact_artifact_scan_record",
     38   "source_cleanliness": "no_tracked_staged_or_untracked_changes",
     39   "revision_stability": "same_service_head_before_and_after_generation",
     40   "no_protected_material": true,
     41   "maximums": {
     42     "text_input_bytes": 1048576,
     43     "generated_document_bytes": 16777216,
     44     "service_cargo_lock_bytes": 16777216,
     45     "service_flake_lock_bytes": 4194304,
     46     "binary_bytes": 536870912,
     47     "source_archive_bytes": 1073741824,
     48     "source_archive_member_bytes": 67108864,
     49     "source_archive_members": 65536,
     50     "oci_bytes": 2147483648,
     51     "artifact_scan_expanded_bytes": 17179869184,
     52     "cargo_metadata_bytes": 33554432,
     53     "packages": 8192,
     54     "workspace_packages": 64
     55   },
     56   "required_negative_vectors": ["cyclonedx_schema_drift", "missing_dependency_component", "unreconciled_artifact_subject", "missing_or_mismatched_license_text", "invented_candidate_digest", "git_history_bundle", "secret_in_binary", "secret_in_oci_layer", "secret_in_source_archive", "sensitive_archive_path", "scan_confidentiality_mismatch"],
     57   "negative_error_codes": ["invalid_contract", "invalid_service_root", "dirty_service_source", "invalid_service_metadata", "invalid_input_root", "invalid_input_artifact", "invalid_source_lock", "invalid_source_bundle", "invalid_package_inventory", "protected_material_detected", "invalid_output_root", "stale_output", "generation_failure"]
     58 }