Infrastructure · Verification
ReleaseArtifactVerification
Test the exact artifact consumers receive, and bind the evidence to its digest
Definition
Mechanism
Before a release is declared verified, the artifact that will actually be distributed or deployed, such as a package, image, bundle, compiled bytecode, document or dataset, is identified by a content digest, installed, deployed or opened the way a consumer receives it, and exercised there. Each piece of evidence records the digest it ran against, as Verification states what it was checked against. Evidence gathered on a source tree, a development build or another digest counts for the artifact only for a property the build is stated to preserve, with that assumption recorded, as when a proof about source is carried to bytecode built by a pinned compiler; a reproducible build shows that builds match, not that a property survives the build. Packaging and installation, or opening for a document or dataset, are always checked on the artifact itself, and a changed digest invalidates the evidence until it is rerun or its assumption is restated. Tests that replace production components with stand-ins state which components they replaced.
Invariants
- Every verification claim names the digest it ran against.
- Evidence gathered on anything other than the released digest counts only for a property the build is stated to preserve, with that assumption recorded.
- Packaging and installation, or opening for a document or dataset, are checked on the released artifact itself.
- Evidence that ran with stand-ins for production components names the substitutions.
Risks
Failure modes
Source-tree pass
tests pass on the repository and are counted for the artifact, though the build changes what they covered through flags, missing files or a stale lock file.
Stand-in coverage
a test harness replaces a production component, so the production path is never exercised although the test count suggests it was.
Rebuilt after testing
the artifact is rebuilt after verification, so the deployed digest was never tested.
Environment gap
the artifact is exercised in an environment unlike the consumer's, with different permissions, configuration or neighbours.
Relationships
Builds on
References
Mind
Confirming alignment with truth or spec
Nothing in this library builds on this pattern yet.