vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-15 00:21:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 15

Bind activation marker to release attestation

Browse source
This commit is contained in:
pulse-triage[bot] 2026-08-29 21:11:12 +01:00
parent 1a48d3cbd6
commit 4d60d679f0
5 changed files with 92 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/CODE_SIGNING_POLICY.md
View file

@ -79,8 +79,10 @@ Normal stable publication and stable dry runs select `signpath` directly.
asset set from replacement.
- Customer-facing image aliases, Helm indexes, paid-runtime pointers, and demo
environments are not promoted until `gh release verify <tag> --repo
rcourtman/Pulse` validates GitHub's signed release attestation. Operators can
use the same command to verify the packet independently.
rcourtman/Pulse` validates GitHub's signed release attestation and `gh release
verify-asset <tag> <downloaded-asset> --repo rcourtman/Pulse` binds the
downloaded activation marker to that attestation. Operators can use the same
commands to verify the packet and any downloaded release asset independently.
## Project roles

16
docs/release-control/v6/internal/subsystems/deployment-installability.md
View file

@ -4418,9 +4418,13 @@ fail and compensate the still-mutable publication back to a marker-free draft.
`scripts/verify-github-release-integrity.sh` is the shared post-publication
check. It binds the release database ID, tag, exact source SHA, immutable state,
and single digest-bearing activation marker, then requires `gh release verify`
to validate GitHub's signed release attestation. The source release verdict,
activation-only recovery, and `release-convergence.yml` must all use that
check. Convergence must not acquire the customer-promotion lease or mutate a
floating image tag, Helm index, paid-runtime pointer, or live environment until
the check passes. Repository release immutability must therefore be enabled
before merging or running this activation path.
to validate GitHub's signed release attestation. It must then download the
activation marker from that release and require `gh release verify-asset` to
bind the exact consumed bytes to the signed release attestation. Filename,
stored digest presence, and marker JSON identity are not substitutes for this
asset proof. The source release verdict, activation-only recovery, and
`release-convergence.yml` must all use that check. Convergence must not acquire
the customer-promotion lease or mutate a floating image tag, Helm index,
paid-runtime pointer, or live environment until the check passes. Repository
release immutability must therefore be enabled before merging or running this
activation path.