services_hardening_safe_artifact_io.v1.json (8429B)
1 { 2 "schema": "radroots.services-hardening.safe-artifact-io-decisions.v1", 3 "contract_version": 1, 4 "decision_state": "active", 5 "owner": "tools/xtask", 6 "self_test_command": "cargo xtask safe-artifact-io-self-test", 7 "platform_scope": { 8 "implementation": [ 9 "macos_aarch64", 10 "linux_x86_64" 11 ], 12 "source_gate": [ 13 "macos_aarch64" 14 ], 15 "cross_platform_promotion_owner": "step-297" 16 }, 17 "scope": { 18 "claims": [ 19 "descriptor_bound_regular_file_io", 20 "bounded_exact_directory_snapshots", 21 "generic_parse_only_tar_gzip_admission", 22 "service_release_artifacts_adoption", 23 "result_level_release_preflight_aggregation" 24 ], 25 "nonclaims": [ 26 "semantic_oci_or_binary_archive_validation_before_step_304", 27 "transitive_safe_io_inside_every_preflight_lane", 28 "panic_signal_hang_or_abort_containment_without_step_292_process_isolation", 29 "cross_platform_runtime_promotion_before_step_297" 30 ] 31 }, 32 "filesystem_model": { 33 "absolute_root_walk": "open_from_filesystem_root_one_component_at_a_time", 34 "open_flags": [ 35 "O_CLOEXEC", 36 "O_NOFOLLOW", 37 "O_NONBLOCK" 38 ], 39 "intermediate_type": "directory", 40 "leaf_type": "regular_file", 41 "regular_link_count": "exactly_one", 42 "absolute_ancestor_identity": "device_inode_and_directory_type", 43 "regular_identity": "device_inode_type_mode_owner_link_count_length_mtime_ctime", 44 "permission_mode": "mode_bits_0o7777_including_special_bits", 45 "read_completion": "observed_bytes_equal_admitted_length", 46 "post_operation_binding": "reopen_complete_path_and_compare_ancestor_and_leaf_identities", 47 "hardlink_compatibility": "callers_must_privately_materialize_single_link_inputs_before_admission", 48 "trusted_root_normalization": "caller_may_canonicalize_a_trusted_root_before_descriptor_admission", 49 "diagnostic_paths": "redacted" 50 }, 51 "create_new_materialization": { 52 "output_parent_binding": "descriptor_bound_complete_absolute_chain", 53 "output_chain_security": "every_directory_root_or_effective_uid_owned_and_no_group_or_world_write_mode_bits", 54 "output_chain_acl_precondition": "caller_guarantees_no_write_granting_acl_for_other_credentials_on_every_chain_directory", 55 "output_name": "direct_openat_create_exclusive_nofollow_cloexec", 56 "output_mode": "retained_descriptor_fchmod_0600", 57 "data": "fixed_buffer_stream_and_simultaneous_sha256", 58 "durability": "sync_retained_output_then_sync_parent", 59 "finalization": "capture_full_output_identity_after_write_and_sync_before_post_sync_hook", 60 "post_operation": "compare_retained_and_reopened_output_to_finalized_identity_and_revalidate_parent_chain_and_security", 61 "success_linearization": "final_rebound_and_complete_chain_security_check", 62 "caller_use": "final_revalidate_before_use", 63 "failure": "never_unlink_rename_or_rollback_after_successful_create", 64 "failed_output_trust": "untrusted_caller_owned_residue_requires_quarantine_and_fresh_retry_path", 65 "threat_boundary": "same_effective_credential_or_acl_authorized_mutation_after_final_revalidation_is_outside_strict_pathname_persistence" 66 }, 67 "hard_maximums": { 68 "buffered_read_bytes": 67108864, 69 "streaming_file_bytes": 17179869184, 70 "traversal_entries": 65536, 71 "traversal_files": 65536, 72 "traversal_total_bytes": 68719476736, 73 "traversal_depth": 64, 74 "path_bytes": 4096, 75 "archive_compressed_bytes": 2147483648, 76 "archive_expanded_bytes": 17179869184, 77 "archive_members": 65536, 78 "archive_member_bytes": 17179869184, 79 "archive_payload_bytes": 17179869184 80 }, 81 "traversal": { 82 "entry_count": "every_non_dot_member_encountered_including_excluded_directories", 83 "file_count": "admitted_regular_files", 84 "total_bytes": "checked_sum_of_admitted_regular_lengths", 85 "depth": "root_is_zero_each_descended_directory_adds_one", 86 "path_bytes": "raw_platform_path_bytes_relative_to_root", 87 "ordering": "raw_member_name_bytes_ascending", 88 "special_members": "reject", 89 "excluded_directories": "retain_name_type_and_device_inode_binding_but_do_not_descend", 90 "snapshot_binding": "exact_sorted_membership_and_member_identity_for_root_and_every_descended_directory", 91 "snapshot_consumption": "read_hash_and_copy_require_the_traversed_file_identity", 92 "final_revalidation": "reopen_complete_bindings_and_reenumerate_exact_memberships" 93 }, 94 "archive_admission": { 95 "format": "one_gzip_member_containing_one_nonempty_tar_stream", 96 "gzip_header": "minimal_ten_byte_header_with_zero_flags_optional_and_reserved_flags_rejected", 97 "operation": "parse_only_never_unpack", 98 "compressed_hash": "sha256_of_every_compressed_input_byte", 99 "tar_iteration": "raw_entries", 100 "tar_termination": "two_or_more_512_byte_zero_blocks", 101 "allowed_members": [ 102 "regular_file", 103 "zero_length_directory" 104 ], 105 "rejected_members": [ 106 "symlink", 107 "hardlink", 108 "fifo", 109 "character_device", 110 "block_device", 111 "sparse", 112 "pax_extension", 113 "gnu_extension", 114 "unknown_type" 115 ], 116 "paths": "utf8_relative_nonempty_components_no_dot_no_dotdot_no_backslash_no_nul", 117 "regular_trailing_slash": "reject", 118 "duplicates": "reject", 119 "file_directory_prefix_conflicts": "reject", 120 "gzip_trailing_or_concatenated_data": "reject", 121 "member_body": "drain_to_eof_and_require_actual_equals_declared", 122 "semantic_archive_qualification": "deferred_to_step_304" 123 }, 124 "aggregate_preflight": { 125 "required_lanes": [ 126 "catalog", 127 "service_source_lock_contract", 128 "service_build_qualification_contract", 129 "service_release_artifacts_contract", 130 "public_native_group", 131 "preview_group", 132 "tools_group", 133 "dto_roots", 134 "protocol_freshness", 135 "artifact_contracts", 136 "release_contracts" 137 ], 138 "execution": "invoke_each_required_lane_exactly_once_in_required_order_after_returned_results", 139 "pass": "exact_order_exact_presence_unique_no_unexpected_and_every_state_pass", 140 "nonpass_states": [ 141 "failed", 142 "interrupted", 143 "skipped", 144 "unavailable" 145 ], 146 "missing_duplicate_unexpected_or_reordered": "fail_closed", 147 "lane_internal_safety": "owned_by_later_migration_steps_and_step_297", 148 "panic_signal_hang_abort": "not_a_returned_lane_state_requires_step_292_process_isolation" 149 }, 150 "adoption": { 151 "service_release_artifacts_inputs": "one_exact_flat_snapshot_retained_through_all_snapshot_bound_copies_and_final_revalidation", 152 "service_release_artifacts_output_inventory": "one_exact_flat_snapshot_for_all_hashes_and_final_revalidation", 153 "service_release_artifacts_archives": "generated_binary_and_supplied_oci_tar_gzip_are_generically_admitted", 154 "service_release_artifacts_copy": "descriptor_bound_create_new_no_rollback_copy", 155 "other_preflight_lane_internals": "not_claimed_by_step_293" 156 }, 157 "diagnostic_safety": { 158 "paths_and_member_names": "redacted", 159 "archive_bytes": "redacted", 160 "operating_system_error_text": "redacted", 161 "source_error_chain": "absent" 162 }, 163 "required_vectors": [ 164 "buffered_read_cap", 165 "streaming_file_cap", 166 "traversal_entry_cap", 167 "traversal_file_cap", 168 "traversal_total_byte_cap", 169 "traversal_file_byte_cap", 170 "traversal_depth_cap", 171 "traversal_path_cap", 172 "symlink", 173 "fifo", 174 "hardlink", 175 "leaf_replacement", 176 "in_place_mutation", 177 "parent_replacement", 178 "late_member_insertion", 179 "excluded_directory_replacement", 180 "artifact_special_mode", 181 "create_new_success_0600", 182 "create_new_untrusted_error_residue", 183 "output_name_swap_preserves_replacement", 184 "output_post_sync_mutation", 185 "output_chain_security", 186 "archive_compressed_cap", 187 "archive_expanded_cap", 188 "archive_member_count_cap", 189 "archive_member_byte_cap", 190 "archive_payload_cap", 191 "archive_depth_cap", 192 "archive_path_cap", 193 "archive_special_member", 194 "archive_escape", 195 "archive_duplicate", 196 "archive_prefix_conflict", 197 "archive_truncated", 198 "archive_concatenated", 199 "archive_malformed", 200 "gzip_optional_or_reserved_header", 201 "aggregate_missing", 202 "aggregate_failed", 203 "aggregate_interrupted", 204 "aggregate_skipped", 205 "aggregate_unavailable", 206 "aggregate_duplicate", 207 "aggregate_unexpected", 208 "aggregate_reordered", 209 "redaction" 210 ] 211 }