Skip to content

ci: enforce CT evidence variant ownership - #94

Merged
loadingalias merged 1 commit into
mainfrom
fix/ct-evidence-variants
Aug 26, 2026
Merged

ci: enforce CT evidence variant ownership#94
loadingalias merged 1 commit into
mainfrom
fix/ct-evidence-variants

Conversation

@loadingalias

Copy link
Copy Markdown
Owner

Summary

  • declare the existing AES-128, AES-256, and ChaCha20 header-protection evidence variants
  • reject evidence units whose variants are outside their primitive declaration during ordinary manifest validation
  • add a controlled manifest mutation regression so normal checks catch the defect before remote evidence execution

Validation

  • scripts/ct/python.sh scripts/ct/evidence_validation_test.py
  • just ct-validate --target riscv64gc-unknown-linux-gnu --manifest-only
  • just ct-validate --target riscv64gc-unknown-linux-gnu --manifest-only --strict-coverage
  • just check
  • just push

Reject undeclared evidence variants during ordinary manifest validation so malformed coverage cannot reach an expensive target-specific evidence lane.
@loadingalias
loadingalias merged commit 8c00ab2 into main Aug 26, 2026
17 checks passed
@loadingalias
loadingalias deleted the fix/ct-evidence-variants branch August 26, 2026 17:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant