Commit 3159327a authored by Konstantinos Togias's avatar Konstantinos Togias
Browse files

ci: bind qualification receipts and provenance to the supported candidate

parent b6de99dd

.gitlab-ci.yml

+2 −0
Changes for .gitlab-ci.yml: 2 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -183,6 +183,8 @@ publish-package: 
    paths:

      - .cache/ci/release-check.json

      - .cache/ci/manifest.json

      - .cache/ci/sbom.json

      - .cache/ci/security-summary.json

    expire_in: never



srm-consumer:

ci/README.md

+7 −0
Changes for ci/README.md: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -36,3 +36,10 @@ Final 2.0.0 additionally needs exact-wheel SRM and live E2E qualification. 
GitLab Runner downloads artifacts before before_script. Its initial TMPDIR is the

existing project directory; individual verification commands then create and use

.cache/ci/tmp. This keeps temporary files off tmpfs without breaking downloads.



Python support is bounded to >=3.10,<3.14, matching the classifiers and tested

matrix; the current pinned pydantic-core cannot build with Python 3.14. Release

qualification files are maintainer-reviewed receipts, not signed attestations or

a claimed SLSA level. Each SRM/E2E receipt must carry the same SDK SHA/checksum

and a pipeline URL in its owning ETSI project. Keep final publication blocked

until the release scope and the corresponding live evidence are agreed.

ci/release.py

+7 −0
Changes for ci/release.py: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -32,6 +32,13 @@ def check_evidence(evidence, manifest, wheel_hash): 
        item = evidence.get(component, {})

        if item.get("status") != "passed" or not item.get("pipeline_url"):

            raise ValueError(f"Successful {component} qualification is required")

        expected_project = "service-resource-manager" if component == "srm" else "ansible"

        group = "code" if component == "srm" else "deploy"

        prefix = f"https://labs.etsi.org/rep/oop/{group}/{expected_project}/-/pipelines/"

        if not re.fullmatch(re.escape(prefix) + r"[0-9]+", item["pipeline_url"]):

            raise ValueError(f"Unexpected {component} qualification pipeline")

        if item.get("sdk_sha") != manifest["source_sha"] or item.get("wheel_sha256") != wheel_hash:

            raise ValueError(f"The {component} receipt belongs to another SDK artifact")

        if not re.fullmatch(r"[0-9a-f]{40}", item.get("source_sha", "")):

            raise ValueError(f"Missing exact {component} source revision")

ci/verify.py

+5 −0
Changes for ci/verify.py: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -60,6 +60,11 @@ def artifact_manifest(): 
        "schema_version": 1,

        "source_sha": subprocess.check_output(["git", "rev-parse", "HEAD"], text=True).strip(),

        "pipeline_id": os.getenv("CI_PIPELINE_ID"),

        "repository": os.getenv("CI_PROJECT_URL"),

        "pipeline_url": os.getenv("CI_PIPELINE_URL"),

        "build_job_url": os.getenv("CI_JOB_URL"),

        "toolchain_sha256": sha256(ROOT / "ci/toolchain.json"),

        "build_image": os.getenv("CI_JOB_IMAGE"),

        "build_job_id": os.getenv("CI_JOB_ID"),

        "python": platform.python_version(),

        "lock_sha256": sha256(ROOT / "ci/requirements.lock"),

pyproject.toml

+1 −1
Changes for pyproject.toml: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -27,7 +27,7 @@ authors = [ 
  { name="Adrian Pino", email="adrian.pino@i2cat.net" }

]

readme = "README.md"

requires-python = ">=3.10"

requires-python = ">=3.10,<3.14"

license = { text = "Apache-2.0" }

classifiers = [

  "Operating System :: OS Independent",