Binary attestations: phase 2 – reproducible Fastly builds

.github/workflows/format.yml

@@ -124,6 +124,12 @@ jobs:
       - name: Run host-target CLI clippy
         run: cargo clippy --package trusted-server-cli --target x86_64-unknown-linux-gnu --all-targets --all-features -- -D warnings
 
+      - name: Run host-target release producer clippy
+        run: cargo clippy --package trusted-server-release --target x86_64-unknown-linux-gnu --all-targets --all-features --locked -- -D warnings
+
+      - name: Lint native JS release build fixtures
+        run: cargo clippy --package trusted-server-js --target x86_64-unknown-linux-gnu --all-targets --all-features --locked -- -D warnings
+
       # The codegen crate is a workspace member but is not a default member and
       # is not covered by any adapter-scoped alias, so lint it explicitly.
       - name: Run host-target OpenRTB codegen clippy
@@ -247,7 +253,7 @@ jobs:
           node-version: ${{ steps.node-version.outputs.node-version }}
 
       - name: Run shellcheck
-        run: shellcheck scripts/release/phase1-build.sh
+        run: shellcheck scripts/release/phase1-build.sh scripts/release/bootstrap.sh scripts/release/build.sh scripts/release/build-js.sh
 
       - name: Test release producer scripts
         run: node --test scripts/release/phase1.test.mjs

.github/workflows/release.yml

@@ -15,6 +15,7 @@ jobs:
     uses: ./.github/workflows/release-build.yml
     permissions:
       contents: read
+      actions: read
       id-token: write
       attestations: write
   release:

.github/workflows/test.yml

@@ -196,6 +196,23 @@ jobs:
       - name: Run host-target CLI tests
         run: ./scripts/test-cli.sh
 
+      - name: Run release producer primitive and process tests
+        run: |
+          set -euo pipefail
+          cargo test --package trusted-server-release --target x86_64-unknown-linux-gnu --locked --test commands -- --list > "$RUNNER_TEMP/ordinary-command-tests.txt"
+          grep -Fx 'ordinary_comparison_failure_prevents_signing_and_publication_sentinels: test' "$RUNNER_TEMP/ordinary-command-tests.txt"
+          cargo test --package trusted-server-release --target x86_64-unknown-linux-gnu --locked
+          cargo test --package trusted-server-release --target x86_64-unknown-linux-gnu --locked --test commands ordinary_comparison_failure_prevents_signing_and_publication_sentinels -- --exact > "$RUNNER_TEMP/ordinary-negative-result.txt"
+          cat "$RUNNER_TEMP/ordinary-negative-result.txt"
+          grep -E '^test result: ok\. 1 passed; 0 failed; 0 ignored;' "$RUNNER_TEMP/ordinary-negative-result.txt"
+
+      - name: Run checked and ordinary JS release build fixtures
+        shell: bash
+        run: |
+          cargo test --package trusted-server-js --target x86_64-unknown-linux-gnu --locked --test release_prebuilt -- --list > "$RUNNER_TEMP/js-release-tests.txt"
+          grep -Fx 'ordinary_release_without_prebuilt_builds_private_bundles: test' "$RUNNER_TEMP/js-release-tests.txt"
+          cargo test --package trusted-server-js --target x86_64-unknown-linux-gnu --locked --test release_prebuilt
+
       # The codegen crate is not a default member and no adapter alias builds it,
       # so its tests only run if invoked explicitly on the host target.
       - name: Run host-target OpenRTB codegen tests
@@ -351,6 +368,11 @@ jobs:
         run: |
           cargo clippy --manifest-path crates/trusted-server-cli/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')" --all-targets -- -D warnings
 
+      - name: Run producer process supervision on macOS
+        if: runner.os == 'macOS'
+        run: |
+          cargo test --package trusted-server-release --target "$(rustc -vV | sed -n 's/host: //p')" --locked --bin trusted-server-release process::
+
       - name: Set up Chrome for browser fixture tests
         if: runner.os == 'macOS'
         id: setup-chrome

AGENTS.md

@@ -377,7 +377,9 @@ Every PR must pass:
 13. CI Node pin guard: `node --test scripts/check-ci-node-pin.test.mjs && node scripts/check-ci-node-pin.mjs` with the `.tool-versions` Node (every CI job that compiles Rust sets up the `.tool-versions` Node before its first cargo step)
 14. Fastly absolute-deadline network fixtures under Viceroy (the harness builds the adapter test binary itself): `node crates/trusted-server-adapter-fastly/tests/deadline-origin.mjs "$(command -v viceroy)"`
 15. Worker auction-deadline runtime fixtures (`worker-auction-deadlines.yml`): build and lint the runtime fixture, then run it under the local runtime. For Cloudflare, `cargo build --locked -p trusted-server-adapter-cloudflare --example deadline-runtime --target wasm32-unknown-unknown --features cloudflare` and `node scripts/test-worker-auction-deadlines.mjs cloudflare --runtime "$(command -v wrangler)"` (requires wrangler and the `Cargo.lock` wasm-bindgen CLI). For Spin, `cargo build --locked -p trusted-server-adapter-spin --example deadline-runtime --target wasm32-wasip1 --features spin` and `node scripts/test-worker-auction-deadlines.mjs spin --runtime "$(command -v spin)"`. CI lints each fixture with the same `cargo clippy` arguments plus `-- -D warnings`
-16. Release producer checks: `node --test scripts/release/phase1.test.mjs && shellcheck scripts/release/phase1-build.sh`
+16. Release producer helpers: `node --test scripts/release/phase1.test.mjs && shellcheck scripts/release/phase1-build.sh scripts/release/bootstrap.sh scripts/release/build.sh scripts/release/build-js.sh`
+17. Native release producer tests and lint: `cargo test --package trusted-server-release --target <host-triple> --locked` and `cargo clippy --package trusted-server-release --target <host-triple> --all-targets --all-features --locked -- -D warnings` (CI uses `x86_64-unknown-linux-gnu`).
+18. Native checked/ordinary JS release fixtures: `cargo test --package trusted-server-js --target <host-triple> --locked --test release_prebuilt` and `cargo clippy --package trusted-server-js --target <host-triple> --all-targets --all-features --locked -- -D warnings` (CI uses `x86_64-unknown-linux-gnu`).
 
 CI also runs these HTML EOF checks. Run them locally only when changing EOF
 finalization, publisher or HTML-processor code:

CHANGELOG.md

@@ -9,10 +9,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Add an ordinary Fastly release byte-equality gate and a real provenance-attested `trusted-server-fastly.wasm.rebuild-check.json`. Merging Phase 2 activates a second fresh Fastly build plus comparison on the next release tag; mismatch prevents signing and publication. The ordinary profile remains unqualified, native reproduction is not a release gate, and the four binary names and signer identity stay unchanged.
 - Add Phase 1 attested release binaries: the Fastly wasm and the `ts` CLI for Linux x86-64 and macOS (ARM64 and x86-64), with SPDX 2.3 inventories, provenance/SBOM bundles, immutable verification and a GNU glibc 2.34 startup check. Reproducibility, other adapters and the custom verifier remain later work; production publication requires maintainer settings.
 
 ### Changed
 
+- **Breaking:** Cargo builds of `trusted-server-js` now fail whenever `TSJS_SKIP_BUILD` is set to any value, including empty or `0`; previously only `TSJS_SKIP_BUILD=1` was rejected. Remove it from shell profiles and `.env` files, and use `TSJS_PREBUILT_DIR` to embed prebuilt bundles instead.
 - Attested release binaries report `x-ts-version` as the full 40-character source commit; deploy-pipeline builds keep the tag, branch or short-commit value described below.
 - **Breaking:** `ts --version` now prints `ts package=<version> source=<commit> target=<triple> variant=default` instead of `ts <version>`. Update scripts that parse the old output.
 - The Lockr browser module no longer polls for private SDK state or mutates its API host, removing the "Lockr SDK not detected" timeout warning (#1247). Root-relative Lockr XHR API requests and rewritten SDK URLs now stay on the page origin even with an external `<base href>`. Custom or unreplaced legacy SDKs that relied on the removed host rewrite must route their own API calls through `/integrations/lockr/api`; `rewrite_sdk = false` leaves static SDK tags unchanged but does not disable dynamic interception. See the [Lockr migration guide](docs/guide/integrations/lockr.md#migration-from-the-sdk-host-shim).