base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Preserve exact evidence bytes in private publication records

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-02 22:35:53 +00:00
parent 109596bc3b
commit 781341a0ba
4 changed files with 157 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/integrations/publication-records.md
View File

@@ -34,8 +34,18 @@ stopped before they were captured; loading preserves that partial evidence and
does not fill fields from the current checkout. Additional fields in a
supported version are ignored. A missing or unsupported version, malformed or
multiple JSON documents, or fields with invalid structural types are reported
as record-format errors. The codec supports version 1; no migration from an
unsupported version is performed.
as record-format errors. The codec supports versions 1 and 2; no migration from
an unsupported version is performed.
Ordinary UTF-8 evidence uses version 1. Evidence containing other pathname or
endpoint bytes uses version 2 with the same `evidence` object and an additional
`evidence_bytes` object. Each entry in `evidence_bytes` uses an evidence field
name and a standard base64 string containing its exact bytes. That entry
supplies the field's value when loading; the writer omits its lossy string form
from `evidence`. Unknown field names are ignored. This representation applies
to every evidence field and preserves the same identity as typed Go evidence.
Older CLIs that support only version 1 report an unsupported version for these
byte-containing records; use a CLI supporting version 2 to load them.
The `endpoint` value is stored exactly as captured and may contain credentials.
Private records are sensitive. Do not copy them into public logs or source

7
docs/roadmap/remediation.md
View File

@@ -384,6 +384,13 @@ documentation.
## R10: Preserve endpoint bytes across the private-record handoff — P2
**Completed:** Private records retain ordinary version-1 JSON and select a
version-2 base64 byte representation for non-UTF-8 fields. Both versions load;
unknown fields remain ignorable and malformed known byte fields report format
errors. Round-trip tests passed for all evidence fields, and real Git
observations distinguish the original byte path from a replacement-character
decoy consistently before and after loading. The record-format guide is updated.
**Relevant code:** `internal/publish/record.go:77` and its evidence decoding;
the string fields in `internal/publish/reconcile.go`'s `Evidence`; the existing
Git endpoint resolution/query path in `internal/git/remote.go` and `tag.go`.