f5eb83ca94
Introduce a dormant MutationEnvelope beside the current closure token. Server, Agent, and helper now agree on length-prefixed manifest and authorization bytes, with one shared fixture pinning the hash, key identity, and Ed25519 signature.\n\nExecutor-affecting provenance, location, target, backend, and backend payload now have a signed home before any runtime path migrates. Exact duplicates stay visible in the hash; ordering does not. Current APT/DNF and Windows behavior remains untouched.
51 lines
4 KiB
JSON
51 lines
4 KiB
JSON
{
|
|
"manifest": {
|
|
"protocol_version": 1,
|
|
"operation_id": "550e8400-e29b-41d4-a716-446655440010",
|
|
"target_id": "body-7c0f",
|
|
"backend": "pacman",
|
|
"operation": "install",
|
|
"resolved_actions": [
|
|
{
|
|
"kind": "package",
|
|
"identity": "zsh@5.9-2",
|
|
"payload": "{\"artifact_sha256\":\"2222222222222222222222222222222222222222222222222222222222222222\",\"execution_location\":{\"kind\":\"cache\",\"value\":\"/var/cache/redflag/zsh.pkg.tar.zst\"},\"repository\":\"core\"}"
|
|
},
|
|
{
|
|
"kind": "package",
|
|
"identity": "acl@2.3.2-1",
|
|
"payload": "{\"artifact_sha256\":\"1111111111111111111111111111111111111111111111111111111111111111\",\"execution_location\":{\"kind\":\"cache\",\"value\":\"/var/cache/redflag/acl.pkg.tar.zst\"},\"repository\":\"core\"}"
|
|
}
|
|
],
|
|
"evidence": [
|
|
{
|
|
"kind": "repository-metadata",
|
|
"digest": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
|
|
},
|
|
{
|
|
"kind": "producer",
|
|
"digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
|
}
|
|
]
|
|
},
|
|
"authorization": {
|
|
"protocol_version": 1,
|
|
"authorization_id": "550e8400-e29b-41d4-a716-446655440011",
|
|
"manifest_hash": "",
|
|
"authority_kind": "fleet-server",
|
|
"authority_id": "redflag-prod",
|
|
"target_id": "body-7c0f",
|
|
"issued_at": 1700000000,
|
|
"not_before": 1700000001,
|
|
"expires_at": 1700000600,
|
|
"decision": "allow",
|
|
"key_id": "",
|
|
"signature": ""
|
|
},
|
|
"test_seed": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
|
|
"expected_manifest_canonical_hex": "32353a726564666c61672e6d75746174696f6e2d6d616e6966657374313a3133363a35353065383430302d653239622d343164342d613731362d343436363535343430303130393a626f64792d37633066363a7061636d616e373a696e7374616c6c313a323234323a32333a726564666c61672e7265736f6c7665642d616374696f6e373a7061636b61676531313a61636c40322e332e322d313138393a7b2261727469666163745f736861323536223a2231313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131222c22657865637574696f6e5f6c6f636174696f6e223a7b226b696e64223a226361636865222c2276616c7565223a222f7661722f63616368652f726564666c61672f61636c2e706b672e7461722e7a7374227d2c227265706f7369746f7279223a22636f7265227d3233393a32333a726564666c61672e7265736f6c7665642d616374696f6e373a7061636b616765393a7a736840352e392d323138393a7b2261727469666163745f736861323536223a2232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232222c22657865637574696f6e5f6c6f636174696f6e223a7b226b696e64223a226361636865222c2276616c7565223a222f7661722f63616368652f726564666c61672f7a73682e706b672e7461722e7a7374227d2c227265706f7369746f7279223a22636f7265227d313a323130383a31363a726564666c61672e65766964656e636531393a7265706f7369746f72792d6d6574616461746136343a6262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626262626239363a31363a726564666c61672e65766964656e6365383a70726f647563657236343a61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161",
|
|
"expected_manifest_hash": "240028bf48a3e8ffe33e115ffe5b85c4160bc8d69193d8bf7782b039a3c0e202",
|
|
"expected_authorization_canonical_hex": "33303a726564666c61672e6d75746174696f6e2d617574686f72697a6174696f6e313a3133363a35353065383430302d653239622d343164342d613731362d34343636353534343030313136343a3234303032386266343861336538666665333365313135666665356238356334313630626338643639313933643862663737383262303339613363306532303231323a666c6565742d73657276657231323a726564666c61672d70726f64393a626f64792d3763306631303a3137303030303030303031303a3137303030303030303131303a31373030303030363030353a616c6c6f7733323a3536343735616137353436333437346330323835646635646266326263616237",
|
|
"expected_key_id": "56475aa75463474c0285df5dbf2bcab7",
|
|
"expected_signature": "58ac223facbbc819f0854a134f97bb38cc8d54722ed6c02ec13f16485be3f1b8db4e400ae0644b2c96595c139a0ca745ee04087d7b87254b55eca9f5389f7401"
|
|
}
|