From 4913ff9c75d02bb6dafd441cc9ee6094d785dd57 Mon Sep 17 00:00:00 2001 From: Postil Maintainer Date: Thu, 27 Aug 2026 06:41:53 +0000 Subject: [PATCH] Qualify the v0.9.4 release --- bench/baseline.attestation.json | 1 + bench/baseline.json | 194 +++++++++++++++++++++++++++++++- install.sh | 4 +- tests/install.rs | 16 ++- 4 files changed, 210 insertions(+), 5 deletions(-) create mode 100644 bench/baseline.attestation.json diff --git a/bench/baseline.attestation.json b/bench/baseline.attestation.json new file mode 100644 index 0000000..90635f7 --- /dev/null +++ b/bench/baseline.attestation.json @@ -0,0 +1 @@ +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHUTCCBtegAwIBAgIUO3oYzI34IhMkdm+R9KPQqfWVNhowCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwODI3MDYxMTExWhcNMjYwODI3MDYyMTExWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAErzOf1Ty6SIAI3Z9E0EgGtEKji7x/sCTL5Qj1LOPqBCzQMF9M3luhgo1mT/khPN9bh0tMyVnqcs8RYl2rp+5Hh6OCBfYwggXyMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUfgJAnFRpls4M7dB+9mtJ5c1vWWUwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wcgYDVR0RAQH/BGgwZoZkaHR0cHM6Ly9naXRodWIuY29tL3Bvc3RpbC1kZXYvcG9zdGlsLWNsaS8uZ2l0aHViL3dvcmtmbG93cy9iZW5jaG1hcmstY2FsaWJyYXRpb24ueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMB8GCisGAQQBg78wAQIEEXdvcmtmbG93X2Rpc3BhdGNoMDYGCisGAQQBg78wAQMEKDE1ZjBhYzczZDFiMjNkZDM4ZTljMDVhNmNkMWM0ZmE1MzNkMTYzNjcwIwYKKwYBBAGDvzABBAQVQmVuY2htYXJrIGNhbGlicmF0aW9uMCMGCisGAQQBg78wAQUEFXBvc3RpbC1kZXYvcG9zdGlsLWNsaTAdBgorBgEEAYO/MAEGBA9yZWZzL2hlYWRzL21haW4wOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMHQGCisGAQQBg78wAQkEZgxkaHR0cHM6Ly9naXRodWIuY29tL3Bvc3RpbC1kZXYvcG9zdGlsLWNsaS8uZ2l0aHViL3dvcmtmbG93cy9iZW5jaG1hcmstY2FsaWJyYXRpb24ueW1sQHJlZnMvaGVhZHMvbWFpbjA4BgorBgEEAYO/MAEKBCoMKDE1ZjBhYzczZDFiMjNkZDM4ZTljMDVhNmNkMWM0ZmE1MzNkMTYzNjcwHQYKKwYBBAGDvzABCwQPDA1naXRodWItaG9zdGVkMDgGCisGAQQBg78wAQwEKgwoaHR0cHM6Ly9naXRodWIuY29tL3Bvc3RpbC1kZXYvcG9zdGlsLWNsaTA4BgorBgEEAYO/MAENBCoMKDE1ZjBhYzczZDFiMjNkZDM4ZTljMDVhNmNkMWM0ZmE1MzNkMTYzNjcwHwYKKwYBBAGDvzABDgQRDA9yZWZzL2hlYWRzL21haW4wGgYKKwYBBAGDvzABDwQMDAoxMjQ2NjkyMjA4MC0GCisGAQQBg78wARAEHwwdaHR0cHM6Ly9naXRodWIuY29tL3Bvc3RpbC1kZXYwGQYKKwYBBAGDvzABEQQLDAkyNzgwNzUwOTEwdAYKKwYBBAGDvzABEgRmDGRodHRwczovL2dpdGh1Yi5jb20vcG9zdGlsLWRldi9wb3N0aWwtY2xpLy5naXRodWIvd29ya2Zsb3dzL2JlbmNobWFyay1jYWxpYnJhdGlvbi55bWxAcmVmcy9oZWFkcy9tYWluMDgGCisGAQQBg78wARMEKgwoMTVmMGFjNzNkMWIyM2RkMzhlOWMwNWE2Y2QxYzRmYTUzM2QxNjM2NzAhBgorBgEEAYO/MAEUBBMMEXdvcmtmbG93X2Rpc3BhdGNoMFwGCisGAQQBg78wARUETgxMaHR0cHM6Ly9naXRodWIuY29tL3Bvc3RpbC1kZXYvcG9zdGlsLWNsaS9hY3Rpb25zL3J1bnMvMzMwNDM3NTk1NDYvYXR0ZW1wdHMvMTAWBgorBgEEAYO/MAEWBAgMBnB1YmxpYzA+BgorBgEEAYO/MAEYBDAMLnJlcG86cG9zdGlsLWRldi9wb3N0aWwtY2xpOnJlZjpyZWZzL2hlYWRzL21haW4wgYkGCisGAQQB1nkCBAIEewR5AHcAdQDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAaBB2AV9AAAEAwBGMEQCIDLjeZVjmnpF4fBL+vBoT+OjqqlOTlMqh6Dw9IjMEtesAiB+avtUhlWET+AZlQTQsvUmcn83R6kGxJwX2GvFfEiCODAKBggqhkjOPQQDAwNoADBlAjEAsCFVvMHi86UYMBiaWd4LddwCCVg2/V4dkzdJ0D/3Jqsnmm7jph8Dy0u2y2cDWTK0AjBB6ENvVSRAFlFOsc6fKpjmC8MhY+cTe9IhfIkpjElbduPWmPKW43Q6eQYu80UKw1s="},"tlogEntries":[{"logIndex":"2613473720","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1787811071","inclusionPromise":{"signedEntryTimestamp":"MEUCIQCYoqg6pq7eeh+WQlBO/AyWTgjzq5Nmcb2Vvfc1xGHaKAIgb841SNKtLFLZ01qWm4P7Bg5ijp9UpjJCtrtn4bkngcM="},"inclusionProof":{"logIndex":"2491569458","rootHash":"CyDBUGaKm1LFmjlzR9RU2gOe078sRserUDQpYkN4L5Q=","treeSize":"2491569469","hashes":["jg2AXvIG63Q6OcEWR21Q/vPMbkjYb6e9Kbssp2mC9B4=","d020jsQR+7P+E5q0sUqlebFrrPXX8zZAs+HeHrh3xxE=","dno9AdoIO9dImjf0zPLn2CYlh7B7vNuVcYw2dkSzAN4=","UmRFIEhEY0fcptT0EvGkKYi5sz+2dOecxmDjLPDRWFQ=","JNX+ptcR91Jm0nLApEwYYHJ9+/C43DXssAYPAuLMRm0=","unSWT06Qb2eE4GBe37VdHPnLf+cz/VA7e7OghdMdmK4=","jn7H8seAONmpcjVZabj1cu52X8bgoYs3TxK5NTnafSQ=","yiBU3loi3u3Kxfk+4VnpnRBc4q9/EEqKRuGH3aJRqlY=","7RWiHRbKMQudY0JetYOmZBxD+gA5F+zCZlHubE/j9ss=","s7ceUJtatzFZRqGIHDI2GZ1y6cvJYoKlXmaZb6KuCGo=","MRwfS06eofPAiKj3I8pslKipyy89BLsp5GEK0wJLva0=","7TfDCaMWgEwSJEZd/e33b24919rF4IDJLmbqNNRNhZs=","0HfdxDt/zGugZLIuHasrdLEW9s8OaTykSSqBEDFQXdw=","SndbMKVtcTenAkwi2JBfGzD+mhexp1qJbRIY+A1JRIU=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2491569469\nCyDBUGaKm1LFmjlzR9RU2gOe078sRserUDQpYkN4L5Q=\n\n— rekor.sigstore.dev wNI9ajBFAiEA44wEyVGcoTCVvUH43KFOxI7nh4QZ7pELbgeL+a+zK9kCIETh9lbKMU0z58Zwqr02ON7SL9jaIaOYtDiulXIOOv6U\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiOWYyZmFiZjcyZWVhNDA0OTg2NjcyNzg0MTUxMzkxZGE4YTk0NzIxMWEzMzYwYTM4MTIyOTYwMDhkOWNiNzk5YiJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjM2OWRmMTY4OGQ0MjZmNDYxMjUxNTVmMWE2ZGI0YjVmMjExZjEzNzM1OTdhNDU1MTQyNmFmZGI4OTEwNmQxOWEifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRRENZU0pFVVJtejNTaW04eUtLOTZJb2x2WkRUaFdiOFBZOHlhZVBIaGE2MndJZ1ZGc2FsUWtKZWFWMDJHSnBDaW55MnRsTXNldnhGaGdUL1A1dndJOVpLU3M9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VoVlZFTkRRblJsWjBGM1NVSkJaMGxWVHpOdldYcEpNelJKYUUxclpHMHJVamxMVUZGeFpsZFdUbWh2ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwOUVTVE5OUkZsNFRWUkZlRmRvWTA1TmFsbDNUMFJKTTAxRVdYbE5WRVY0VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVnllazltTVZSNU5sTkpRVWt6V2psRk1FVm5SM1JGUzJwcE4zZ3ZjME5VVERWUmFqRUtURTlRY1VKRGVsRk5SamxOTTJ4MWFHZHZNVzFVTDJ0b1VFNDVZbWd3ZEUxNVZtNXhZM000VWxsc01uSndLelZJYURaUFEwSm1XWGRuWjFoNVRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVm1aMHBCQ201R1VuQnNjelJOTjJSQ0t6bHRkRW8xWXpGMlYxZFZkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMk5uV1VSV1VqQlNRVkZJTDBKSFozZGFiMXByWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBURE5DZG1NelVuQmlRekZyV2xoWmRncGpSemw2WkVkc2MweFhUbk5oVXpoMVdqSnNNR0ZJVm1sTU0yUjJZMjEwYldKSE9UTmplVGxwV2xjMWFtRkhNV2hqYlhOMFdUSkdjMkZYU25sWldGSndDbUl5TkhWbFZ6RnpVVWhLYkZwdVRYWmhSMVpvV2toTmRtSlhSbkJpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVbllLWVRKV2RVeHRSbXBrUjJ4MlltNU5kVm95YkRCaFNGWnBaRmhPYkdOdFRuWmlibEpzWW01UmRWa3lPWFJOUWpoSFEybHpSMEZSVVVKbk56aDNRVkZKUlFwRldHUjJZMjEwYldKSE9UTllNbEp3WXpOQ2FHUkhUbTlOUkZsSFEybHpSMEZSVVVKbk56aDNRVkZOUlV0RVJURmFha0pvV1hwamVscEVSbWxOYWs1ckNscEVUVFJhVkd4cVRVUldhRTV0VG10TlYwMHdXbTFGTVUxNlRtdE5WRmw2VG1wamQwbDNXVXRMZDFsQ1FrRkhSSFo2UVVKQ1FWRldVVzFXZFZreWFIUUtXVmhLY2tsSFRtaGlSMnhwWTIxR01HRlhPWFZOUTAxSFEybHpSMEZSVVVKbk56aDNRVkZWUlVaWVFuWmpNMUp3WWtNeGExcFlXWFpqUnpsNlpFZHNjd3BNVjA1ellWUkJaRUpuYjNKQ1owVkZRVmxQTDAxQlJVZENRVGw1V2xkYWVrd3lhR3haVjFKNlRESXhhR0ZYTkhkUGQxbExTM2RaUWtKQlIwUjJla0ZDQ2tOQlVYUkVRM1J2WkVoU2QyTjZiM1pNTTFKMllUSldkVXh0Um1wa1IyeDJZbTVOZFZveWJEQmhTRlpwWkZoT2JHTnRUblppYmxKc1ltNVJkVmt5T1hRS1RVaFJSME5wYzBkQlVWRkNaemM0ZDBGUmEwVmFaM2hyWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBURE5DZG1NelVuQmlRekZyV2xoWmRncGpSemw2WkVkc2MweFhUbk5oVXpoMVdqSnNNR0ZJVm1sTU0yUjJZMjEwYldKSE9UTmplVGxwV2xjMWFtRkhNV2hqYlhOMFdUSkdjMkZYU25sWldGSndDbUl5TkhWbFZ6RnpVVWhLYkZwdVRYWmhSMVpvV2toTmRtSlhSbkJpYWtFMFFtZHZja0puUlVWQldVOHZUVUZGUzBKRGIwMUxSRVV4V21wQ2FGbDZZM29LV2tSR2FVMXFUbXRhUkUwMFdsUnNhazFFVm1oT2JVNXJUVmROTUZwdFJURk5lazVyVFZSWmVrNXFZM2RJVVZsTFMzZFpRa0pCUjBSMmVrRkNRM2RSVUFwRVFURnVZVmhTYjJSWFNYUmhSemw2WkVkV2EwMUVaMGREYVhOSFFWRlJRbWMzT0hkQlVYZEZTMmQzYjJGSVVqQmpTRTAyVEhrNWJtRllVbTlrVjBsMUNsa3lPWFJNTTBKMll6TlNjR0pETVd0YVdGbDJZMGM1ZW1SSGJITk1WMDV6WVZSQk5FSm5iM0pDWjBWRlFWbFBMMDFCUlU1Q1EyOU5TMFJGTVZwcVFtZ0tXWHBqZWxwRVJtbE5hazVyV2tSTk5GcFViR3BOUkZab1RtMU9hMDFYVFRCYWJVVXhUWHBPYTAxVVdYcE9hbU4zU0hkWlMwdDNXVUpDUVVkRWRucEJRZ3BFWjFGU1JFRTVlVnBYV25wTU1taHNXVmRTZWt3eU1XaGhWelIzUjJkWlMwdDNXVUpDUVVkRWRucEJRa1IzVVUxRVFXOTRUV3BSTWs1cWEzbE5ha0UwQ2sxRE1FZERhWE5IUVZGUlFtYzNPSGRCVWtGRlNIZDNaR0ZJVWpCalNFMDJUSGs1Ym1GWVVtOWtWMGwxV1RJNWRFd3pRblpqTTFKd1lrTXhhMXBZV1hjS1IxRlpTMHQzV1VKQ1FVZEVkbnBCUWtWUlVVeEVRV3Q1VG5wbmQwNTZWWGRQVkVWM1pFRlpTMHQzV1VKQ1FVZEVkbnBCUWtWblVtMUVSMUp2WkVoU2R3cGplbTkyVERKa2NHUkhhREZaYVRWcVlqSXdkbU5IT1hwa1IyeHpURmRTYkdScE9YZGlNMDR3WVZkM2RGa3llSEJNZVRWdVlWaFNiMlJYU1haa01qbDVDbUV5V25OaU0yUjZUREpLYkdKdFRtOWlWMFo1WVhreGFsbFhlSEJaYmtwb1pFZHNkbUpwTlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFVLVFVSblIwTnBjMGRCVVZGQ1p6YzRkMEZTVFVWTFozZHZUVlJXYlUxSFJtcE9lazVyVFZkSmVVMHlVbXROZW1oc1QxZE5kMDVYUlRKWk1sRjRXWHBTYlFwWlZGVjZUVEpSZUU1cVRUSk9la0ZvUW1kdmNrSm5SVVZCV1U4dlRVRkZWVUpDVFUxRldHUjJZMjEwYldKSE9UTllNbEp3WXpOQ2FHUkhUbTlOUm5kSENrTnBjMGRCVVZGQ1p6YzRkMEZTVlVWVVozaE5ZVWhTTUdOSVRUWk1lVGx1WVZoU2IyUlhTWFZaTWpsMFRETkNkbU16VW5CaVF6RnJXbGhaZG1OSE9Yb0taRWRzYzB4WFRuTmhVemxvV1ROU2NHSXlOWHBNTTBveFltNU5kazE2VFhkT1JFMHpUbFJyTVU1RVdYWlpXRkl3V2xjeGQyUklUWFpOVkVGWFFtZHZjZ3BDWjBWRlFWbFBMMDFCUlZkQ1FXZE5RbTVDTVZsdGVIQlpla0VyUW1kdmNrSm5SVVZCV1U4dlRVRkZXVUpFUVUxTWJrcHNZMGM0Tm1OSE9YcGtSMnh6Q2t4WFVteGthVGwzWWpOT01HRlhkM1JaTW5od1QyNUtiRnBxY0hsYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQyZFphMGREYVhOSFFWRlJRakZ1YTBNS1FrRkpSV1YzVWpWQlNHTkJaRkZFWkZCVVFuRjRjMk5TVFcxTldraG9lVnBhZW1ORGIydHdaWFZPTkRoeVppdElhVzVMUVV4NWJuVnFaMEZCUVdGQ1Fnb3lRVlk1UVVGQlJVRjNRa2ROUlZGRFNVUk1hbVZhVm1wdGJuQkdOR1pDVEN0MlFtOVVLMDlxY1hGc1QxUnNUWEZvTmtSM09VbHFUVVYwWlhOQmFVSXJDbUYyZEZWb2JGZEZWQ3RCV214UlZGRnpkbFZ0WTI0NE0xSTJhMGQ0U25kWU1rZDJSbVpGYVVOUFJFRkxRbWRuY1docmFrOVFVVkZFUVhkT2IwRkVRbXdLUVdwRlFYTkRSbFoyVFVocE9EWlZXVTFDYVdGWFpEUk1aR1IzUTBOV1p6SXZWalJrYTNwa1NqQkVMek5LY1hOdWJXMDNhbkJvT0VSNU1IVXllVEpqUkFwWFZFc3dRV3BDUWpaRlRuWldVMUpCUm14R1QzTmpObVpMY0dwdFF6aE5hRmtyWTFSbE9VbG9aa2xyY0dwRmJHSmtkVkJYYlZCTFZ6UXpVVFpsVVZsMUNqZ3dWVXQzTVhNOUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9XX19"}],"timestampVerificationData":{}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYmFzZWxpbmUuanNvbiIsImRpZ2VzdCI6eyJzaGEyNTYiOiIwMzY3NWI4NDdhYTM0MmUzM2YwODkwMmMwYWQwMjE0YzkyNjUwMjk2NDU2YTg2NTVhZTBlYTY0MDVlOGQ1MDI5In19XSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vc2xzYS5kZXYvcHJvdmVuYW5jZS92MSIsInByZWRpY2F0ZSI6eyJidWlsZERlZmluaXRpb24iOnsiYnVpbGRUeXBlIjoiaHR0cHM6Ly9hY3Rpb25zLmdpdGh1Yi5pby9idWlsZHR5cGVzL3dvcmtmbG93L3YxIiwiZXh0ZXJuYWxQYXJhbWV0ZXJzIjp7IndvcmtmbG93Ijp7InJlZiI6InJlZnMvaGVhZHMvbWFpbiIsInJlcG9zaXRvcnkiOiJodHRwczovL2dpdGh1Yi5jb20vcG9zdGlsLWRldi9wb3N0aWwtY2xpIiwicGF0aCI6Ii5naXRodWIvd29ya2Zsb3dzL2JlbmNobWFyay1jYWxpYnJhdGlvbi55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjEyNDY2OTIyMDgiLCJyZXBvc2l0b3J5X293bmVyX2lkIjoiMjc4MDc1MDkxIiwicnVubmVyX2Vudmlyb25tZW50IjoiZ2l0aHViLWhvc3RlZCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vcG9zdGlsLWRldi9wb3N0aWwtY2xpQHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiIxNWYwYWM3M2QxYjIzZGQzOGU5YzA1YTZjZDFjNGZhNTMzZDE2MzY3In19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9wb3N0aWwtZGV2L3Bvc3RpbC1jbGkvLmdpdGh1Yi93b3JrZmxvd3MvYmVuY2htYXJrLWNhbGlicmF0aW9uLnltbEByZWZzL2hlYWRzL21haW4ifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL3Bvc3RpbC1kZXYvcG9zdGlsLWNsaS9hY3Rpb25zL3J1bnMvMzMwNDM3NTk1NDYvYXR0ZW1wdHMvMSJ9fX19","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIQDCYSJEURmz3Sim8yKK96IolvZDThWb8PY8yaePHha62wIgVFsalQkJeaV02GJpCiny2tlMsevxFhgT/P5vwI9ZKSs="}]}} diff --git a/bench/baseline.json b/bench/baseline.json index e169857..aedef5b 100644 --- a/bench/baseline.json +++ b/bench/baseline.json @@ -25,8 +25,198 @@ } }, "openai/gpt-5.6-luna": { - "populated": false, - "instructions": "Record a signed, predeclared ten-slot calibration cohort before release comparison." + "populated": true, + "generatedAt": "2026-08-27T06:11:10.841Z", + "reviewMode": "exhaustive", + "sourceRunAt": "2026-08-27T06:01:50.581Z", + "providerContractEnforced": true, + "screeningProfileSha256": "5fb983c12387db48da3fe6fc8b5d5c11d155b264b4d636176bec659cdff1e34a", + "upstreamProviderIdentity": "Azure", + "calibration": { + "reportCount": 10, + "cohortId": "219d191d-6ff0-435e-b2bc-171b6619abae", + "manifestSha256": "dd33fc1d4fa1744aba158133ee1ef553ab61b668c272ab5e3369b9e477a32f00", + "sourceSha": "15f0ac73d1b23dd38e9c05a6cd1c4fa533d16367", + "workflowRunId": "33043759546", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "providerContractSha256": "7a9a044ddc7636aabe10542846df2ed0974490bae4a41c65353c381a2d105316", + "comparisonCohortSha256": "0ed8268fa4524dacf4fbd1f894a2e57ad57db4d2cdd3d432fb2dd4ec681de9da", + "reports": [ + { + "slot": 1, + "nonce": "a11945d1-ad24-4f14-8e81-08bf593f2acb", + "runId": "calibration-33043759546-01", + "ranAt": "2026-08-27T05:53:26.665Z", + "rawSha256": "29f062735e597574d6c6cae8f3ec36fe33d841d9b4770ee3f527f8f65b951c31", + "semanticSha256": "d6bc094d19f0823097a116bd3c58089ca1aa4a11961977d7d048703424652009", + "receiptRawSha256": "8fe3acdf5d1f87382d0ee929894ce77bb06af84750a7530e7422fac8995e8cbd", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 52, + "falsePositives": 0, + "gateVerdictCorrect": 58, + "totalCostUsdDecimal": "0.059019477", + "p50LatencyMs": 6159, + "p95LatencyMs": 12582 + }, + { + "slot": 2, + "nonce": "71379839-0f98-493c-aa64-ee1e52714446", + "runId": "calibration-33043759546-02", + "ranAt": "2026-08-27T05:55:13.094Z", + "rawSha256": "4dd8c3ec396f22bebc0858bdef7c181a211ae8118b7922795a5dead0a0c0d612", + "semanticSha256": "7384f657a7bf121dc38e7195cdc80a95a95ec1d7463a67151ced94186c4c259f", + "receiptRawSha256": "48a85688a079c8c76cd7d64556d2a4dc153ab90cb3f9c9de4892544a2c72683e", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 54, + "falsePositives": 0, + "gateVerdictCorrect": 63, + "totalCostUsdDecimal": "0.055745206", + "p50LatencyMs": 5871, + "p95LatencyMs": 10365 + }, + { + "slot": 3, + "nonce": "7f54ad55-3f44-4755-8c3b-d79415a4cdb6", + "runId": "calibration-33043759546-03", + "ranAt": "2026-08-27T05:56:52.165Z", + "rawSha256": "6f30fe4cfe8d8e8998461e5e8328cb1d876ac2784899b676b8123c7802688c49", + "semanticSha256": "69311c715553f9cdcad1eb5b7837b78ff0e3325b106d84ceb65df5e63e0a6501", + "receiptRawSha256": "0bd2e889c51e9d578a883679525b18cc1838d6a3c4617c768c3519a158118979", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 52, + "falsePositives": 0, + "gateVerdictCorrect": 56, + "totalCostUsdDecimal": "0.054068212", + "p50LatencyMs": 5797, + "p95LatencyMs": 10047 + }, + { + "slot": 4, + "nonce": "d03a8cb0-d4e5-4772-b05b-584c2b028cbd", + "runId": "calibration-33043759546-04", + "ranAt": "2026-08-27T05:58:35.273Z", + "rawSha256": "e8b58eac040118824c3d79831d07afb0273d281c21e4ea54bdf66a5e07e1ff90", + "semanticSha256": "2e8c556bbba6a50cde508fcfb89b78b4168f0a5cb92cf25cc875fa0f83479c99", + "receiptRawSha256": "84da4bcddd2acc816f928d1ae424d5280b04cd1a3a3e1bac95ff7449885e2150", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 49, + "falsePositives": 0, + "gateVerdictCorrect": 59, + "totalCostUsdDecimal": "0.054958387", + "p50LatencyMs": 6290, + "p95LatencyMs": 12734 + }, + { + "slot": 5, + "nonce": "f7467355-7d47-40d1-bc91-208a6792786c", + "runId": "calibration-33043759546-05", + "ranAt": "2026-08-27T06:00:12.793Z", + "rawSha256": "08c030c66bf4fb9c381f8df76d4d8d1001f8eb86b1fc495b2afa9cfbebcdf40e", + "semanticSha256": "bb91244c80160daea57ddcc115d671a28825e201ba2a23811a5e99448903566c", + "receiptRawSha256": "650fa662320c897d17f9bc94bde9696a6774ebb47d18137e88ee831dcf21079b", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 53, + "falsePositives": 0, + "gateVerdictCorrect": 60, + "totalCostUsdDecimal": "0.053942845", + "p50LatencyMs": 5725, + "p95LatencyMs": 12349 + }, + { + "slot": 6, + "nonce": "3b335787-5dbe-45e1-ab0d-0eb787fa9a44", + "runId": "calibration-33043759546-06", + "ranAt": "2026-08-27T06:01:50.581Z", + "rawSha256": "775d99511fdf62f5b6f9e8b8d86e5766c43e460daf94790c6dbaaebb7577bef7", + "semanticSha256": "569e1ac2ce1577113d8fdc829dd2a8e72b936518059e362aa7f1895ebb822515", + "receiptRawSha256": "87fba9aa97aa8cfa8a2617e5ba9e3d8b2d7a624799ab91722fc5b24854080a0c", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 52, + "falsePositives": 0, + "gateVerdictCorrect": 59, + "totalCostUsdDecimal": "0.05252742", + "p50LatencyMs": 6319, + "p95LatencyMs": 11196 + }, + { + "slot": 7, + "nonce": "7cab3556-3c22-4641-865d-22ba95a214ce", + "runId": "calibration-33043759546-07", + "ranAt": "2026-08-27T06:03:36.846Z", + "rawSha256": "376b28a361d8e2921af520d42334bcb0fd2f34ab12edff8106cbfc1ffe7f97f8", + "semanticSha256": "7a8f811b63eca491ae01504d7288e6026c639f6b72b5247fdafc51ef6cd2c62b", + "receiptRawSha256": "8b739e8537fc48c2c556c1d6eb6d02b577282b891a73332811e522f8d06a4d7f", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 53, + "falsePositives": 0, + "gateVerdictCorrect": 59, + "totalCostUsdDecimal": "0.052805478", + "p50LatencyMs": 6225, + "p95LatencyMs": 14294 + }, + { + "slot": 8, + "nonce": "a6be4afb-b1f8-470b-ac23-9fe0a7b08140", + "runId": "calibration-33043759546-08", + "ranAt": "2026-08-27T06:05:17.225Z", + "rawSha256": "3595bba9c2aab74f055c1474301d97acc8cc933160967a57a645e59d016f4a7f", + "semanticSha256": "fa7efa27ba7611271ae3e262a85180dcc427b52b21fbc1bb9dd3a283e8f80461", + "receiptRawSha256": "b4722f958a129da8867def9b5e4ed00c43054c2a2656110579dfb259dadcd4fd", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 51, + "falsePositives": 0, + "gateVerdictCorrect": 59, + "totalCostUsdDecimal": "0.052895579", + "p50LatencyMs": 6242, + "p95LatencyMs": 10534 + }, + { + "slot": 9, + "nonce": "2017c34b-185c-4da9-b960-d2b07556bf79", + "runId": "calibration-33043759546-09", + "ranAt": "2026-08-27T06:07:13.518Z", + "rawSha256": "8b55c204175c789f4dd781042d14bc1a046bf4f41781a57bdd4b6d0c02844598", + "semanticSha256": "92a776f78fee63825801b93692610973f2e63231528174931848ec8e0aee618f", + "receiptRawSha256": "ce1b9d01d20d0aab0e81540af884b626ee21447d9315fe584f6042d215a3d1d3", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 51, + "falsePositives": 0, + "gateVerdictCorrect": 60, + "totalCostUsdDecimal": "0.052961953", + "p50LatencyMs": 6281, + "p95LatencyMs": 10746 + }, + { + "slot": 10, + "nonce": "0c47557b-5fcb-4944-8673-76cd2ab06187", + "runId": "calibration-33043759546-10", + "ranAt": "2026-08-27T06:08:51.385Z", + "rawSha256": "19e386ac7de44b9077b061e0a9600e024512316c9d6548b943705b48f8659f11", + "semanticSha256": "0448d6dfcf0be06d1a10457971aac600d1e9793c49bcfc27eb8db832a929f5d5", + "receiptRawSha256": "21f664f91bd21922859ed2f453d0fa7dceb40dae4a1f3508ebd48c77d270b551", + "binarySha256": "e1c268f7ee78fb1f84235a615492754cf24082660af3a1d0d69bc67af0c98b24", + "detected": 51, + "falsePositives": 0, + "gateVerdictCorrect": 59, + "totalCostUsdDecimal": "0.051552589", + "p50LatencyMs": 5639, + "p95LatencyMs": 13219 + } + ] + }, + "totalCases": 70, + "scoredCases": 70, + "defectCases": 57, + "detectionRate": 0.9087719298245615, + "falsePositives": 0, + "gateVerdictCorrectness": 0.8428571428571429, + "meanCostUsdPerCase": 0.0008431353857142858, + "maximumRunCostUsdDecimal": "0.059019477", + "costCaseCount": 70, + "latencyMs": { + "p50": 6192, + "p95": 11772.5 + } } } } diff --git a/install.sh b/install.sh index c65f2df..c6eae68 100755 --- a/install.sh +++ b/install.sh @@ -128,7 +128,7 @@ if have cosign && [ "${POSTIL_SKIP_SIG:-0}" != "1" ]; then if cosign verify-blob "$tmp/$archive" \ --signature "$tmp/$archive.sig" \ --certificate "$tmp/$archive.pem" \ - --certificate-identity-regexp "https://github.com/${REPO}/\.github/workflows/release\.yml@refs/tags/.*" \ + --certificate-identity "https://github.com/${REPO}/.github/workflows/release.yml@refs/tags/${VERSION}" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ >/dev/null 2>&1; then echo "Signature verified (Sigstore keyless)." @@ -165,4 +165,4 @@ case ":$PATH:" in *) echo "Add ${BIN_DIR} to your PATH to run 'postil' directly." ;; esac "${BIN_DIR}/postil" --version || true -echo "Next: export your key (POSTIL_API_KEY=...) and run 'postil doctor'." +echo "Next: run 'postil login', then run 'postil review' in a repository." diff --git a/tests/install.rs b/tests/install.rs index 6386bf1..af32fd0 100644 --- a/tests/install.rs +++ b/tests/install.rs @@ -64,6 +64,7 @@ struct InstallerFixture { tools: PathBuf, artifacts: PathBuf, bin: PathBuf, + cosign_arguments: PathBuf, } impl InstallerFixture { @@ -77,6 +78,7 @@ impl InstallerFixture { let artifacts = root.path().join("artifacts"); let payload = root.path().join("payload"); let bin = root.path().join("bin"); + let cosign_arguments = root.path().join("cosign-arguments"); for directory in [&tools, &artifacts, &payload, &bin] { fs::create_dir(directory).unwrap(); } @@ -116,7 +118,10 @@ impl InstallerFixture { ), ); if with_cosign { - write_executable(&tools.join("cosign"), "#!/bin/sh\nexit 0\n"); + write_executable( + &tools.join("cosign"), + "#!/bin/sh\nprintf '%s\\n' \"$@\" > \"$POSTIL_TEST_COSIGN_ARGS\"\n", + ); } Self { @@ -124,6 +129,7 @@ impl InstallerFixture { tools, artifacts, bin, + cosign_arguments, } } @@ -136,6 +142,7 @@ impl InstallerFixture { .args(extra_arguments) .env("PATH", &self.tools) .env("POSTIL_TEST_ARTIFACTS", &self.artifacts) + .env("POSTIL_TEST_COSIGN_ARGS", &self.cosign_arguments) .env_remove("POSTIL_SKIP_SIG"); command.output().unwrap() } @@ -192,6 +199,13 @@ fn require_cosign_verifies_the_signature_before_installing() { assert!(output.status.success(), "{output:?}"); let stdout = String::from_utf8(output.stdout).unwrap(); assert!(stdout.contains("Signature verified (Sigstore keyless).")); + assert!(stdout.contains("Next: run 'postil login', then run 'postil review' in a repository.")); + assert!(!stdout.contains("POSTIL_API_KEY")); + let cosign_arguments = fs::read_to_string(&fixture.cosign_arguments).unwrap(); + assert!(cosign_arguments.contains( + "--certificate-identity\nhttps://github.com/postil-dev/postil-cli/.github/workflows/release.yml@refs/tags/v-test\n" + )); + assert!(!cosign_arguments.contains("--certificate-identity-regexp")); assert!( !String::from_utf8(output.stderr) .unwrap()