Enforce lockfile provenance continuity and anti-downgrade policies - #4881
Draft
mosuem wants to merge 1 commit into
Draft
Enforce lockfile provenance continuity and anti-downgrade policies#4881mosuem wants to merge 1 commit into
mosuem wants to merge 1 commit into
Conversation
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 24, 2026 12:18
f2bbdce to
65e92a7
Compare
mosuem
marked this pull request as draft
August 24, 2026 12:21
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
3 times, most recently
from
August 24, 2026 12:49
fb97489 to
c3fbf24
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 24, 2026 12:52
c3fbf24 to
1cd2d61
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
2 times, most recently
from
August 24, 2026 13:04
2a0b5fa to
8fb1df5
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 24, 2026 13:28
8fb1df5 to
9cc5bc0
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 24, 2026 15:05
9cc5bc0 to
569ce87
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 24, 2026 15:40
569ce87 to
e10f8c2
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 24, 2026 15:46
e10f8c2 to
34f7323
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
2 times, most recently
from
August 24, 2026 15:53
9259683 to
f7ab21c
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 24, 2026 15:57
f7ab21c to
ded877b
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
2 times, most recently
from
August 24, 2026 16:22
2633a2f to
b47a8f8
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 24, 2026 16:26
b47a8f8 to
d4b2094
Compare
Base automatically changed from
refresh-sigstore-trusted-root
to
verify-sigstore-attestation
August 24, 2026 16:26
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
2 times, most recently
from
August 25, 2026 08:43
1cb8639 to
d2732a7
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 25, 2026 08:45
d2732a7 to
bab3ae9
Compare
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 25, 2026 09:53
bab3ae9 to
f787ebf
Compare
mosuem
changed the base branch from
verify-sigstore-attestation
to
refresh-sigstore-trusted-root
August 25, 2026 10:48
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
2 times, most recently
from
August 25, 2026 16:11
e1e2fe3 to
76c99be
Compare
- Store verified Sigstore provenance repository in ResolvedHostedDescription and pubspec.lock. - Cache provenance in $PUB_CACHE/hosted-provenance/. - Enforce ProvenancePolicy.enforcePolicy during SolveResult.downloadCachedPackages against _previousLockFile to prohibit downgrading from signed to unsigned packages and detect repository switches. - Add unit tests for provenance parsing, serialization, and policy enforcement.
mosuem
force-pushed
the
enforce-lockfile-provenance
branch
from
August 26, 2026 11:06
76c99be to
e4b4a69
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack created with GitHub Stacks CLI • Give Feedback 💬