base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Preserve exact evidence bytes in private publication records

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-02 22:35:53 +00:00
parent 109596bc3b
commit 781341a0ba
4 changed files with 157 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/integrations/publication-records.md
View File

@@ -34,8 +34,18 @@ stopped before they were captured; loading preserves that partial evidence and
does not fill fields from the current checkout. Additional fields in a
supported version are ignored. A missing or unsupported version, malformed or
multiple JSON documents, or fields with invalid structural types are reported
as record-format errors. The codec supports version 1; no migration from an
unsupported version is performed.
as record-format errors. The codec supports versions 1 and 2; no migration from
an unsupported version is performed.
Ordinary UTF-8 evidence uses version 1. Evidence containing other pathname or
endpoint bytes uses version 2 with the same `evidence` object and an additional
`evidence_bytes` object. Each entry in `evidence_bytes` uses an evidence field
name and a standard base64 string containing its exact bytes. That entry
supplies the field's value when loading; the writer omits its lossy string form
from `evidence`. Unknown field names are ignored. This representation applies
to every evidence field and preserves the same identity as typed Go evidence.
Older CLIs that support only version 1 report an unsupported version for these
byte-containing records; use a CLI supporting version 2 to load them.
The `endpoint` value is stored exactly as captured and may contain credentials.
Private records are sensitive. Do not copy them into public logs or source