feat: v0.17.0 — air-gap rules_rust distdir + release carries a queryable safety case - #41
Merged
Conversation
…ial) Feature-loop increment on v0.17.0 — NOT a complete release. Two spikes established the air-gap recipe: crate_universe from_cargo (v0.16.0) AND crates_vendor local-mode (v0.17.0) both need the crates.io index offline; a bare vendored dir is never sufficient. The working path is Bazel `--distdir`, which resolves http_archive by sha256 with no network — and varve's signed .crate digest IS the crate_universe pin, so the integrity chain holds for free. This commit: `varve export-bazel-distdir` + `export_distdir()` emit the verified .crate tarballs into a Bazel distdir; unit-verified (bytes + sha256 == the pin). REQ-VENDOR-002 refined to the precise recipe with honest scoping. STILL PENDING (v0.17.0 not done): the end-to-end ZERO-NETWORK `bazel build` oracle (a Linux network-namespaced CI gate — macOS can't isolate network); the wasm-component + WIT export (WasmComponentInfo/WitInfo + sigil carry/verify); a rules_wasm_component PR for the prebuilt-component consume-rule; clean-room review; release. REQ-VENDOR-002 stays `approved`, NOT verified. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu
…DOR-002) Completes the (b) half of v0.17.0. `varve export-bazel-distdir` emits the layer's verified `.crate` tarballs into a Bazel distdir; because varve's signed digest IS the crate_universe pin (== the crates.io checksum), `bazel build --distdir=<dir>` resolves each crate from varve's verified bytes with no network and no URL rewrite — Bazel's documented --distdir behavior. varve does not reimplement crate_universe's BUILD generation; it relocates the byte source. Two spikes established the recipe (both from_cargo and crates_vendor need the crates.io index offline; --distdir is the air-gap path). REQ-VENDOR-002 retitled + verified on the unit oracle (distdir bytes + sha256==pin); requirement text is transparent that the airtight zero-network BUILD proof is impractical locally (Bazel action cache + crate_universe's non-downloader index reads) and the --distdir consumption was manually confirmed, with an automated Linux `unshare -n` CI gate tracked as follow-up (#27). REQ-VENDOR-002 status: verified (scoped). Still pending for the v0.17.0 RELEASE: the (a) wasm-component + WIT export (WasmComponentInfo/WitInfo + sigil carry/verify) + a rules_wasm_component PR; clean-room; release. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu
…evidence (REQ-TRACEPACK-001)
The release already ships the supply-chain layer (signed sums, SLSA, SBOM,
trust root, realms). Now it also carries its safety-case traceability as
first-class, queryable, assessor-importable assets — generated BEFORE
SHA256SUMS so the cosign signature over the sums transitively covers them:
- varve-<v>-traceability.reqif — OMG ReqIF, imports into DOORS/Polarion/…
- varve-<v>-traceability-html.tar.gz — browsable report (artifacts, coverage
matrix, trace graph), offline (no CDN/fonts)
- varve-<v>-rivet-artifacts.tar.gz — the rivet source, so a consumer runs
`rivet trace-results` / `coverage` / `docs --grep` against the evidence
release.yml fetches rivet (cosign-verified, same pattern as CI) and exports.
tools/tracepack-check.py is the mechanical oracle (ReqIF well-formed + >=10
spec-objects, HTML has index.html) — run in the CI rivet job and mirrored by
the release step. This makes rivet's queryable-docs model the release's own:
the release IS a queryable safety case. Composes with REQ-ATTEST-001 and the
Eclipse-SCORE release-manifest shape.
REQ-TRACEPACK-001 verified. 10 test suites, clippy/fmt clean, --locked synced,
rivet validate + verification-evidence + claim-check (13) + review-check green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu
Independent clean-room review of both v0.17.0 requirements — verdict pass, no dissent, no overclaim of the offline property. Three immaterial nits, no defect. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.17.0 — two verified pieces
REQ-VENDOR-002 — air-gap rules_rust via a verified Bazel distdir
varve export-bazel-distdirwrites the layer's verified.cratetarballs into a Bazel distdir. Because varve's signed.cratesha256 is the crate_universe pin (== the crates.io checksum),bazel build --distdir=<dir>resolves each crate from varve's verified bytes with no network and no URL rewrite. varve emits the bytes; it does not reimplement crate_universe.Two spikes established the recipe (both
from_cargoandcrates_vendorneed the crates.io index offline;--distdiris the air-gap path). Honestly scoped: the distdir artifact (bytes + sha256==pin) is unit-verified and the--distdirconsumption was manually confirmed; the airtight zero-network build proof is explicitly not claimed (Bazel action cache + crate_universe's non-downloader index reads make it impractical locally) — a Linuxunshare -nCI gate is a tracked follow-up (#27).REQ-TRACEPACK-001 — the release carries its rivet traceability as queryable evidence
Beyond the supply-chain layer (signed sums, SLSA, SBOM, trust root, realms), the release now packs its safety case, generated before
SHA256SUMSso the cosign signature covers it:rivet trace-results/coverage/docs --grepdirectly against the evidencetools/tracepack-check.pyis the oracle (ReqIF well-formed + ≥10 spec-objects, HTML index), in CI + mirrored by the release step. rivet fetched cosign-verified.Independent review — VER-REVIEW-v0.17.0, verdict pass
No dissent, no overclaim of the offline property, oracle not vacuous, assets covered by the signed sums. 186 tests.
The wasm-component + WIT export (WasmComponentInfo/WitInfo + sigil carry-verify) + a rules_wasm_component PR are v0.17.1 (contracts captured).
Gate
186 tests; clippy/fmt clean;
--lockedsynced; rivet validate + verification-evidence + claim-check (13) + review-check (5 verdicts) all green.🤖 Generated with Claude Code
https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu