diff --git a/docs/superpowers/specs/2026-11-04-publisher-attestation-design.md b/docs/superpowers/specs/2026-11-04-publisher-attestation-design.md new file mode 100644 index 000000000..6dbccc7d4 --- /dev/null +++ b/docs/superpowers/specs/2026-11-04-publisher-attestation-design.md @@ -0,0 +1,519 @@ +# Publisher attestation + +**Date:** 2026-11-04. **Status:** Proposed contract for maintainer and user review; no implementation or provider qualification is claimed. + +**Issues:** [#161](https://github.com/IABTechLab/trusted-server/issues/161), [#1427](https://github.com/IABTechLab/trusted-server/issues/1427). **Predecessor:** binary attestation [#1235](https://github.com/IABTechLab/trusted-server/issues/1235), [#1435](https://github.com/IABTechLab/trusted-server/pull/1435), [#1449](https://github.com/IABTechLab/trusted-server/pull/1449), and subsequent release-evidence work. + +**Repository baseline:** `origin/main` at `51730bdaf841e4d7bb96c2258e5e98169bdff9a7`. Release-branch observations are dependencies, not functionality assumed to exist on this baseline. This specification introduces no code, credentials, enrollment, remote writes, or release authorization. + +## Read this first + +Publisher attestation answers: **who is responsible for this website's deployment, what software was independently checked, and how recently?** The publisher keeps its key. Its server answers a fresh random challenge with a signed identity statement. A separately chosen verifier checks host/key authorization and, when a qualified Fastly method is available, compares the deployed executable with an authenticated official release. It then signs a short-lived assessment. Consumers choose which verifiers and policies they trust. + +The signed response alone is a declaration. A registry assessment can add independent evidence, but a package fingerprint match cannot be promoted into proof of installed official code. Public production Axum is supported for declarations; independently checked executable deployment starts with Fastly and remains qualification-gated. + +V1 consumers normally rely on assessment expiry, at most 15 minutes from the oldest observation. Optional live status can detect a reported withdrawal sooner but adds a registry availability and privacy dependency. The signed identity projection describes five public identity values; registries do not inspect a publisher's whole business configuration for that check. Auction/bid attestation comes later. + +| Read next | Purpose | +| --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | +| This document | Publisher endpoint, common wire rules, runtime integration and acceptance boundaries | +| [Registry protocol and operations](2026-11-04-publisher-attestation-registry-design.md) | Enrollment, assessments, consumer policy, optional status, governance and registry-side operation | +| [Fastly qualification](2026-11-04-publisher-attestation-fastly-qualification-design.md) | Evidence needed before anyone may assert an installed official executable | + +```mermaid +flowchart LR + L[Authenticated official release bytes] --> V[Independent verifier] + P[Publisher signed challenge response] --> V + F[Qualified Fastly deployment evidence] --> V + V --> A[Short-lived signed assessment] + A --> C[Consumer applies its own trust policy] + P --> C +``` + +## 1. Decision and assurance boundary + +Publisher attestation connects a publisher host, its operator, a specific deployment, and an authorized public key to signed evidence and independent, time-bounded verifier assessments. It answers who made the declaration, what an independent party checked, how, and when. It does not establish continuous measured execution. + +The selected architecture is publisher-produced evidence plus portable assessments from zero, one, or multiple independent verifiers. Publishers retain their keys. Consumers independently configure trusted verifier keys and acceptance policies. A registry is an optional directory and presentation service; it is not a mandatory administrator or key custodian. + +The complete work includes independent deployment appraisal. An evidence-only milestone is useful, but MUST be labelled self-declared and MUST NOT be presented as an independently verified official deployment. + +The intended strong result is: + +> An identified verifier checked authorization for a publisher host and key, observed a specified production service/version, authenticated its selected executable against an eligible official release, and issued an assessment with an explicit observation time and expiry. + +That result is available only after the selected provider method passes qualification. A provider package fingerprint match alone does not currently establish that result. The companion [Fastly binding qualification specification](2026-11-04-publisher-attestation-fastly-qualification-design.md) owns that gate. + +### 1.1 Alternatives considered + +| Approach | Benefit | Cost or limitation | Decision | +| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- | -------------------------------------------------------------- | +| Publisher evidence plus independent, portable assessments | Allows custom builds, multiple verifiers, and consumer choice; separates declarations from observation | Requires enrollment, provider qualification, and explicit freshness policy | Selected | +| Operator signatures alone | Small endpoint; useful identity and challenge evidence | Cannot independently establish installed official bytes or honest configuration | Permitted delivery milestone, not the complete assurance claim | +| One administrator generates publisher keys and approves every deployment | One operational authority and policy | Concentrates impersonation capability and governance; unnecessary for interoperability | Rejected | +| Hardware/provider-enforced measured execution and signing | Could strengthen code-to-key binding | No qualified capability established here | Future separately specified assurance method | + +### 1.2 Scope + +In scope: host and operator authorization; deployment identity; publisher evidence; runtime key custody and rotation; independently verified release inputs; Fastly deployment observations; custom-build treatment; configuration claim boundaries; verifier assessment and withdrawal contracts; reference verification; safe networking; privacy; compatibility; acceptance tests; and operational responsibilities. + +Out of scope: auction/bid signing, message-body integrity, auction execution proofs, bid replay caches, auction key delegation, transaction schemas, inventory truth, consent-input truth, legal-entity certification, broad configuration compliance certification, a hosted commercial registry, a registry dashboard, or hardware attestation. This work reserves stable deployment/key/assessment identifiers for future consumers; it does not design the next roadmap layer. + +Fastly is the first target for independently checked executable deployment. Axum production and staging deployments are supported under the declaration profile after normal endpoint verification, public HTTPS, and real host/key enrollment; their installed code and environment remain declared. Axum also supplies isolated development transport. Cloudflare, Spin, and reusable Fastly require their own runtime qualification for the applicable profile. No new official adapter distribution is implied. + +### 1.3 Normative language and ownership + +MUST, MUST NOT, SHOULD, and MAY express requirements in the sense of BCP 14. Stable PA identifiers identify requirement groups. These wire/schema changes are revisions of an unshipped proposal and require coordinated implementation; they do not claim compatibility with a deployed earlier draft. The wire version is `1`; schema names and message types below are proposed private protocol identifiers, not claims of IANA registration. + +| Owner | Responsibility | +| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | +| Release producer and Layer 1 verifier | Authenticate executable bytes, source/workflow identity, official publication, and applicable release eligibility | +| Publisher/operator | Authorize enrollment, control DNS and deployment, provision runtime keys, maintain configuration and permissions | +| Attester in Trusted Server | Produce typed, fresh evidence from one actual request-used snapshot | +| Independent verifier | Authenticate enrollment, collect provider observations, apply a named policy, sign assessments and status | +| Consumer/relying party | Supply independent trust roots, check bindings/freshness/status, and decide acceptance | +| Registry/directory | Distribute signed objects and clearly label their assurance; optional | + +### 1.4 RFC 9334 roles + +| RATS role | Concrete participant and scope | +| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Attester | The runtime serving publisher evidence for the requested host | +| Verifier | The independent component appraising that evidence and qualified provider observations | +| Relying Party | The consumer deciding whether the signed assessment meets its policy | +| Reference Value Provider | The release authority publishing authenticated official executable identities; #1435/#1449 contribute that Layer 1 work, rather than being participants themselves | +| Endorser | The authority supplying authenticated statements about artifact origin or approved reference values; release provenance does not endorse a publisher key or prove remote execution | +| Verifier Owner / Relying Party Owner | The parties configuring appraisal policy and consumer acceptance respectively | + +These roles may be performed by different organizations or combined. RFC 9334 does not require one administrator or prescribe this private wire format. + +### 1.5 Platform feasibility and supported claims + +| Deployment | Target v1 evidence/profile | Required qualification or limitation | +| ------------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | +| Fastly production/staging | Publisher declaration; official-deployment profile only for production | Endpoint/runtime verification; strong executable binding still requires the companion gate | +| Axum production/staging | `publisher-declaration-v1`, `assurance: declared` | Public HTTPS, real DNS/key enrollment; service fields may be null; environment/code remain declarations | +| Axum loopback development | Isolated declaration fixtures | Separate test trust; cannot use development authorization in production | +| Reusable Fastly | Same intended profiles after lifecycle qualification | Actual retained snapshot, key expiry and refresh/recycling must be demonstrated | +| Cloudflare / Spin | Future separately qualified endpoint support | No implicit provider measurement or production-assessment support from this spec | + +This is a target support table, not a statement that endpoints are implemented today. + +## 2. Terminology and threat model + +### PA-IDENTITY: keep the identities distinct + +**Publisher host** is the public DNS name being checked, such as `news.example.com`. **Backend origin** is the upstream content source and is not publisher identity. **Publisher ID** is an opaque UUID assigned by the publisher; it is not evidence of legal identity. **Operator ID** is a stable HTTPS identifier for a separately claimed operator, or null when the publisher acts for itself. A non-null identifier requires independent technical authorization; it is not legal-entity certification or trusted merely because it is a URL. Verifiers MUST NOT fetch arbitrary operator-ID URLs. + +**Deployment ID** is a publisher-assigned UUID stable for one intended logical deployment. Separate production/staging deployments MUST use different deployment IDs and keys. Cloning a service does not authorize reuse of an enrollment. **Binding ID** is the digest of the exact version/configuration/key descriptor defined below. A new service version, attestation key, or covered configuration value changes the binding ID. Assessment renewal does not change it. + +Consumers MUST compare the full binding, not assume UUID uniqueness makes assertions true. Enrollment authorizes the tuple `(host, publisher_id, operator_id, deployment_id, provider, service_id, environment, attestation_key_thumbprint)`; versions and binding IDs are separately checked at assessment time. + +### 2.1 Attacker capabilities and residual trust + +Assume an attacker can copy endpoints and assessments, replay or relay challenges, manipulate unsigned discovery, control a custom binary and its reported metadata, change publisher configuration or service versions, upload unusual packages, obtain a publisher runtime key through deployment control, submit malicious enrollment/package URLs, and operate an untrusted verifier. Assume network outages and partial provider observations. + +| Threat | Required control | Remaining limitation | +| --------------------------------------------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | +| Forged publisher or verifier signature | Pinned keys, strict typed signatures, key-purpose separation | A stolen trusted key can sign | +| Evidence copied to another host | Expected host, independent authorization, fresh challenge, authenticated HTTPS | A live same-host relay is not measured execution proof | +| A clean attestation path hides different traffic handling | Explicit endpoint-only claim; provider service/version observations | No proof that all site traffic follows this path | +| Custom code reports an official commit | Independently authenticated executable binding | Self-reported headers/build facts are not measurements | +| Alternate code uses an endorsed key | Monitoring, short-lived assessments, withdrawal, isolated key scope | Operator-controlled software keys are not exclusive to approved code | +| Ambiguous package produces matching fingerprint | Provider binding qualification, structural evidence, stronger selected-module identity | Local package inspection alone cannot constrain a malicious remote upload | +| Configuration changes without activation | Actual snapshot binding and coverage declaration | Uncovered/dynamic settings and propagation remain outside the claim | +| SSRF or credential leakage | Fixed provider authority, constrained enrollment targets, bounded fetches, redaction | Trust in configured resolver/provider remains | +| Compromised verifier or misleading directory | Consumer-pinned trust roots/policies; signed provenance of assessments | An accepted verifier can lie | + +Consumers still rely on Fastly reporting its state truthfully, on verifier collection and signing being honest, on the release authority, and on the declared clock/status assumptions. No result promises absence of vulnerabilities, continuous execution, honest publisher inputs, or secret non-extractability. + +Monitoring reduces exposure; it does not close the code-to-key gap. Binding version 42 does not invalidate its signed assessment when version 43 activates. A consumer rejects the mismatch only after trustworthy newer evidence/status reaches it, or the old assessment expires. No finite probe set proves universal routing or parser behavior. + +### What this does not prove + +- A nonce/signature proves a fresh answer from a key holder; it cannot prevent a live relay or prove exclusive use of that key by official code. +- An installed executable observation is time-bounded and trusts the provider/verifier. It does not establish uninterrupted execution or simultaneous state at every POP. +- Official release bytes do not certify configuration, business rules, consent inputs, page content, inventory truth, or absence of vulnerabilities. +- V1 does not verify that Trusted Server is the outermost layer for all site traffic. An endpoint probe and domain mapping are insufficient to establish that property. +- Expiry-only acceptance cannot promise immediate withdrawal. Known withdrawal is honored, but an uninformed consumer can accept until the existing assessment expires. +- Protocol identity/DNS control does not certify a legal entity, contractual relationship, or legal compliance. Governance/liability choices belong to registry agreements and task-force approval. + +## 3. Protocol artifacts and common encoding + +### PA-WIRE: one strict signed envelope + +Evidence, assessments, and status use compact JWS. The response body is the compact ASCII serialization, not a JSON object with an unsigned readable evidence copy. The protected header contains exactly `alg`, `kid`, and `typ`: + +| Field | Version 1 rule | +| ----- | ---------------------------------------------------------------------------------------------------------------- | +| `alg` | Exactly `Ed25519` as registered by RFC 9864; no polymorphic algorithm identifier | +| `kid` | Base64url, unpadded SHA-256 JWK thumbprint of the signing public key | +| `typ` | Exactly `ts-publisher-evidence+jws`, `ts-publisher-assessment+jws`, or `ts-publisher-status+jws`, as appropriate | + +All header fields are protected. Reject unprotected headers, detached payloads, `none`, HMAC, legacy `EdDSA`, alternate curves, embedded trust keys, key URLs, certificate URLs, `crit`, compression, and unencoded payload extensions. Signature length is exactly 64 bytes. Public keys are JWK objects containing exactly `kty: "OKP"`, `crv: "Ed25519"`, and a canonical unpadded base64url `x` encoding 32 bytes. Private JWK material MUST NOT appear on a public surface. The transport uses JWS rules; implementations MUST NOT introduce the fork's separate context-prefix format under the same message type. + +Sign and verify the original JWS segments; never reserialize a decoded payload to check its signature. Parse UTF-8 JSON with duplicate-member rejection, including nested objects, bounded depth 16, and no trailing data. Unknown members anywhere in a version 1 payload are rejected. The closed schemas below use an explicit `extensions` object, initially required empty; a nonempty extension requires a later supported profile/version. Arrays are limited to 16 entries unless a smaller limit is stated. Claim strings have a 256-byte UTF-8 limit unless specified otherwise. This bound is not applied to compact JWS serialization or its encoded segments. An assessment-list item is an explicitly exempt compact-JWS string of at most 32,768 ASCII bytes; the list remains bounded to 16 items and 524,288 total response bytes. These transport bounds also apply to unsigned discovery/list responses. Their decoded claim strings retain the ordinary bound. Structural JSON Schema `maxLength` counts Unicode code points, so receivers must independently enforce the UTF-8 byte and raw-response bounds before accepting data. Integers are nonnegative JSON integers no greater than `9007199254740991`. Time fields are UTC Unix seconds, not milliseconds. + +Use SHA-256, lowercase 64-character hex, for document/content identifiers, except `kid` as above and Fastly's explicitly labelled SHA-512 fingerprint. `digest` means `{ "algorithm": "sha256", "value": }`. Canonical descriptor/projection hashes use JCS over the defined public JSON value. JWS signatures themselves do not require JCS. Object digests of signed objects hash the exact compact JWS bytes; do not hash a readable rendering. + +The JOSE and canonicalization rules are based on RFC 7515, RFC 8037 as updated by RFC 9864, RFC 7638, RFC 8725, and RFC 8785. RFC 9864 replaces the deprecated polymorphic `EdDSA` identifier with `Ed25519` for this new protocol; a library that cannot enforce that protected identifier is not conforming and must not silently substitute it. Some deployed JOSE libraries may support only the older `EdDSA` name; integrators must qualify or update those libraries before enabling v1. Renaming an incoming protected header breaks its signature and is forbidden. These standards define encoding and validation primitives; the publisher claim semantics here are project requirements. + +The accompanying [wire schema](schemas/publisher-attestation-v1.schema.json) uses JSON Schema draft-07 with local references and no remote schema fetch. It omits a `$schema` URI, so validators must select draft-07 explicitly. Its definitions cover protected headers, signed payloads, discovery/list envelopes, enrollment challenges, and stored public metadata. The [public verification vectors](fixtures/publisher-attestation-v1-vectors.json) retain exact signed bytes, public keys, expected context, and positive/negative outcomes; no signing private key is retained. They are protocol fixtures, not provider observations or official-deployment qualification. + +Schema validation is necessary but insufficient. Duplicate JSON members, canonical base64url, actual UTF-8 byte lengths, canonical host handling, JWK thumbprints, JCS/digest equality, signature/type/key agreement, time intervals, operator authorization, policy eligibility, status, and cross-object equality require the separate semantic checks specified here. Consumers reject a schema-valid object that fails any applicable semantic check. A valid signature on an unknown/legacy algorithm identifier or wrong message type is still rejected. Published vectors must be checked through two independent cryptographic implementations and include changed-signature, changed-context, stale, and mismatched-binding cases before wire freeze. + +### PA-BINDING: exact deployment descriptor + +The `binding` object is closed and has these required fields: + +| Field | Type and meaning | +| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | +| `schema` | Literal `ts-publisher-binding-v1` | +| `host` | Canonical authorized publisher host | +| `publisher_id` | Canonical lowercase UUID | +| `operator_id` | HTTPS identifier with no userinfo/query/fragment, or null for publisher self-operation | +| `deployment_id` | Canonical lowercase UUID | +| `environment` | `production`, `staging`, or `development` | +| `platform` | Object: `provider` (`fastly` or `axum`), `service_id` (string or null), `service_version` (positive integer or null), `staging` (boolean or null) | +| `attestation_key` | Object: `kid`, public `jwk`, `not_before`, `not_after` | +| `configuration` | Object: `schema` literal `ts-publisher-identity-v1`, `digest`, and `projection` defined in section 7 | +| `extensions` | Empty object | + +`binding_id` is the lowercase 64-character hexadecimal string SHA-256 of JCS(`binding`), not a nested digest object. `attestation_key.kid` MUST equal its JWK thumbprint and the evidence signing header `kid`. Its validity interval MUST be nonempty and contain the entire evidence lifetime. Fastly service identity is adapter-observed runtime identity, still a declaration to an external verifier until corroborated. Axum production/staging/development declaration bindings use null service ID, version, and staging fields when the adapter has no independent provider identity. The declared environment is an operator setting, not a provider measurement. Fastly official-deployment bindings require independently corroborated non-null service/version identity. Axum can never satisfy the Fastly official-deployment profile. Unknown staging MUST be null, never silently false. Fastly staging must agree with the declared environment; `development` cannot pass production policy. + +The descriptor MUST NOT include verifier assessment IDs, verifier list order, latest store state fetched after the request, private configuration hashes, or a claimed self-measurement of the binary. This avoids circular identity and changing the binding whenever an assessment renews. + +### PA-EVIDENCE: publisher payload + +| Required field | Type and rule | +| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `schema` | `ts-publisher-evidence-v1` | +| `binding` | Exact descriptor above | +| `binding_id` | Matching descriptor digest | +| `nonce` | Canonical base64url encoding of exactly 32 random bytes supplied by the caller | +| `issued_at`, `expires_at` | `issued_at < expires_at <= issued_at + 60`, within signing-key validity | +| `build_report` | Object with `declared_class` (`custom` or `unspecified`) and nullable `source_commit` (40 lowercase hex), `package_version` (string), `target` (string), and `variant` (string) | +| `extensions` | Empty object | + +All five `build_report` members are required; only the four build-fact members may be null when unavailable. `declared_class` is an operator declaration; `unspecified` does not mean official. These are declarations, not an installed-artifact digest. Use existing immutable owning-product build facts when present; do not add operator/tag/time inputs to Layer 1 builds. An external tag belongs in verified release evidence, not a new compiled publisher input. + +The caller supplies expected host, nonce, environment, and trust policy out of band. No payload-selected verifier URL or public key can establish trust. A verifier MUST correlate the nonce to one outstanding collection operation, expire it after 60 seconds, and consume it once. A valid signature does not establish authorization before enrollment checks. + +### Reader example: declarations and assessments are different + +The following is an annotated **excerpt of a decoded publisher payload**, not a complete valid wire object or a signature to copy: + +```json +{ + "schema": "ts-publisher-evidence-v1", + "build_report": { + "declared_class": "custom", + "source_commit": null, + "package_version": "0.1.0", + "target": "aarch64-unknown-linux-gnu", + "variant": "default" + } +} +``` + +`custom` is the publisher's own declaration. A verifier's separate `build.assurance: declared` keeps that visible. `fingerprint_only` means a narrower provider hash comparison; it still cannot carry `provenance: official`. Only independently bound selected executable bytes plus eligible authenticated release evidence can support `artifact_bound` and `official`. Complete signed examples and rejection cases are in the linked public vectors; a structurally valid object still needs semantic, policy and cryptographic checks. + +### PA-ASSESSMENT and PA-STATUS: registry-issued objects + +The normative assessment/status fields, policy outcomes and optional status mode are defined in the [registry protocol](2026-11-04-publisher-attestation-registry-design.md#pa-assessment-verifier-payload). The shared wire schema and typed JWS rules remain common to both documents. Publisher evidence never signs a registry verdict into its own descriptor. + +## 4. Enrollment and independent trust bootstrap + +[Registry enrollment and consumer trust](2026-11-04-publisher-attestation-registry-design.md#pa-enrollment-authorize-before-endorsing) define publisher DNS/key proof, optional separate operator proof, finite renewal, issuer trust and exit. Production Axum declaration uses the same real host/key proof; loopback shortcuts are development-only. The publisher advertises untrusted issuer hints in discovery, while consumers configure actual trust independently. + +## 5. Publisher HTTP surface and runtime behavior + +### PA-HTTP: fixed, small endpoint + +| Request | Response | +| ------------------------------------------------------------------------------------ | ------------------------------------------------------ | +| `GET /_ts/attestation.jws?nonce=` | `200 application/jose` with evidence compact JWS | +| `GET /_ts/attestation/keys.json` | `200 application/json` with versioned public discovery | +| Missing/invalid nonce, repeated nonce parameter in one request, unknown query member | `400` with bounded generic error code | +| Disabled attestation or unsupported method on either exact reserved path | `404`; no origin fallback and no signing | +| Enabled but unavailable key/identity/clock or snapshot mismatch | `503`; no unsigned success payload | +| Invalid or mismatched host selection | `421`; no signing or origin fallback | +| Deployment/platform admission rate limit exceeded | `429`; no signed payload | + +Only GET is supported. HEAD and OPTIONS return 404; browser clients need no custom request headers. Only the two exact paths in the table are reserved; neighboring paths retain existing routing and may reach the publisher fallback. No whole-prefix takeover or configurable endpoint is introduced in version 1. The evidence endpoint requires exactly one `nonce` parameter with the canonical encoding above. A repeated parameter in one request is malformed; the stateless edge does not maintain a global used-nonce cache. Single-use outstanding challenges are tracked by the caller/verifier that generated them. The keys endpoint accepts no query parameters. Request bodies are rejected with 400. Nonce-free evidence is not a conforming freshness check. + +All responses on these paths, including errors and public discovery, MUST have `Cache-Control: no-store, private`, `Surrogate-Control: no-store`, and `X-Content-Type-Options: nosniff`. No ETag, Last-Modified, Set-Cookie, authentication redirect, or shared-cache lifetime is emitted. Conditional requests do not produce 304. Responses are independent of reader cookies and contain no user IDs or client IP. Wildcard CORS is permitted for these public GET resources with no credentials; credentialed CORS is prohibited. A human-readable status page is not required. Any later UI must explain declarations versus verifier results and cannot present its own rendering as verification. + +Discovery is `{ "schema": "ts-publisher-key-discovery-v1", "host": , "keys": [...], "verifiers": [...] }`. `verifiers` is a unique list of at most 16 HTTPS issuer identifiers configured by the publisher, empty by default. An entry advertises a possible source of assessments, not proof that the issuer endorses this host. Consumers match it to independently configured issuer/trust information before any lookup; it never supplies a trust key or authority to fetch arbitrary URLs. `keys` holds one to four entries, and each contains only `kid`, public `jwk`, `not_before`, and `not_after`. Include active and overlap keys; no private key, secret reference, provider token, or mutable URL-as-key-authority. Discovery is untrusted until matched to enrollment/assessment, and cannot replace retained historical key records. It contains no verifier trust roots. + +### PA-ROUTING: trusted host selection before evidence + +Version 1 protocol boundaries accept canonical lowercase ASCII DNS names only. Enrollment/configuration/signed claims and lookup paths reject Unicode; optional operator UI tooling may convert an internationalized name before submission, show the resulting ASCII name for confirmation, and must not change it again inside the protocol. No Unicode database version or IDNA mapping library is a runtime protocol dependency. Names beginning `xn--` are treated as opaque ASCII DNS labels; this profile neither converts them nor certifies their Unicode spelling. Identity comparisons use the exact same ASCII name across publisher authority, enrollment DNS, TLS/SNI, and registry lookup. + +For trusted ingress authority only, lowercase ASCII and remove one final ASCII dot before comparing with enrolled canonical host. Reject a second terminal dot, empty labels, userinfo, percent escapes, wildcards, IP literals, invalid ports, and ambiguous/conflicting authority sources. Labels are 1–63 octets and the host at most 253 ASCII octets, with letters/digits/hyphens and no leading/trailing hyphen. Prefixed DNS challenge owners must separately fit DNS limits. Production uses HTTPS port 443; another port is not silently treated as the same origin. Host and URI authority, when both present, must agree after this normalization. Client-supplied forwarded headers never select signed host identity. Retain the original trusted ingress host before module header rewriting. International-name conversion rules belong to operator tooling and its compatibility tests, not a second implicit identity equivalence rule. + +Resolve the intended host's settings through the existing trusted configuration selector, then require configured attestation host and publisher authorization to match that ingress host. Unknown/mismatched hosts MUST NOT borrow another host's settings or sign a statement; return 421 when host selection is invalid. Multi-host deployments require explicit per-host bindings. This spec does not depend on an unmerged configuration-by-host implementation; the first release may require one enrolled host per configured deployment. + +Dispatch evidence after ingress sanitization and host/snapshot resolution, but before Edge Cookie creation, consent processing, device classification, bot challenges, request filters, publisher backend calls, and auctions. An explicit attestation exception to generic authentication is needed so a verifier can reach the public endpoint; it applies only to these exact read-only paths and is covered by route tests. Normal routes retain existing authentication and filtering. + +This needs an explicit startup seam as well as a route exception. The baseline constructs auction/integration state and resolves ordinary application secrets before normal dispatch. Implementation must acquire the verified nonsecret configuration snapshot and attestation identity independently of those unrelated initialization steps, then dispatch the evidence request without creating the auction application. When ordinary application construction succeeds, both paths must use the same loader normalization and snapshot provenance; retained sandboxes must not mix snapshots. An unrelated bidder/secret initialization failure is not an attestation-key failure and must not force the proof path through that failing component. Evidence describes the attestation request's actual snapshot, not a guarantee that ordinary site traffic is healthy. Invalid own host/identity configuration still fails safely. + +Response finalization MUST enforce attestation headers last, including when generic `response_headers` configuration or middleware tries to loosen privacy. A diagnostic endpoint is not a path to execute arbitrary modules or sign arbitrary bytes. Provider identity and trusted host come from adapter-owned data, not custom integration headers. + +### PA-CONFIG: proposed operator configuration + +```toml +[attestation] +enabled = true +host = "news.example.com" +publisher_id = "11111111-1111-4111-8111-111111111111" +operator_id = "https://operator.example.com/publisher-attestation" +deployment_id = "22222222-2222-4222-8222-222222222222" +environment = "production" +active_key = "publisher-evidence-2026-11" +discovery_keys = ["publisher-evidence-2026-11"] +verifiers = [] +build_class = "unspecified" +``` + +This is a proposed configuration contract, not a claim that these fields already load. Omitted `operator_id` normalizes to null for self-operation; the wire descriptor/projection/challenge still includes the explicit null member so its digest is unambiguous. Default is absent/disabled; `build_class` defaults to `unspecified` and accepts only `unspecified` or `custom`. Unknown keys are rejected. `verifiers` defaults to an empty list and contains at most 16 unique HTTPS issuer identifiers; it is public discovery metadata only and never changes signature trust. Host, IDs, environment, and the selected key metadata must validate when enabled. The selected name is an opaque local key reference, never a private key. `discovery_keys` defaults to a list containing `active_key`; an explicit list must contain 1–4 unique valid local key names and include `active_key`. The discovery endpoint performs bounded metadata reads of those exact names, ordered by thumbprint in its public response; it never enumerates a provider store. Missing, malformed, duplicate-thumbprint, or inconsistent metadata in that list returns discovery 503 rather than publishing a partial set. Evidence signing reads only the active key metadata/secret and may still succeed when an overlap entry is unavailable. Disabled mode ignores the list without store reads. Key metadata and private key bytes live in dedicated runtime stores described next. It MUST NOT permit overriding observed provider/service/version, choosing a signature algorithm, choosing arbitrary signed claims, or supplying a purported official checksum. + +Disabled attestation reads no attestation stores. Invalid structural configuration fails ordinary configuration validation with redacted errors; a temporarily missing/malformed key at runtime fails only the attestation endpoint. The config loader MUST NOT eagerly resolve the endpoint's optional private key as a required site-wide secret. Endpoint admission validates the effective metadata and secret together, so a partially propagated rotation returns 503 rather than mislabelling the signing key. + +## 6. Key custody, provisioning, and recovery + +### PA-KEYS: dedicated publisher keys + +Publisher evidence keys are distinct from Layer 1 release signatures, existing request-signing keys, verifier assessment keys, TLS keys, and future auction keys. No modification to today's request-signing protocol or rotation endpoints is authorized by this spec. + +Provision a publisher-generated Ed25519 key through an authenticated operator tool or existing provider secret mechanism. The private seed is exactly 32 bytes encoded as canonical standard base64 in a dedicated secret-store entry. Metadata contains the public JWK, thumbprint, validity interval, and secret entry reference. The runtime derives the public key from the loaded seed and compares it with metadata before signing. A metadata/key mismatch is 503. Secrets never enter source, build inputs, artifact metadata, shared CI caches, app-config JSON, generated documentation, or verifier enrollment. A provisioning tool MUST NOT print or return private key bytes in ordinary output. + +Version 1 preserves the existing portable store inventories and defaults unchanged. Store nonsecret metadata in the existing logical config store `trusted_server_config` at `ts-publisher-key-`, and private seeds in the existing logical secret store `trusted_server_secrets` at `ts-publisher-`. A local name is 1–48 lowercase ASCII letters, digits, or hyphens, starts with a letter, and is unique within that deployment. The prefixed secret name therefore remains at most 61 characters. Metadata has the closed schema `schema: ts-publisher-key-metadata-v1`, `kid`, `jwk`, `not_before`, `not_after`, and `secret_name` (exactly the prefixed secret name). Verify that metadata and the derived public key agree. The ordinary app-config secret resolver MUST NOT eagerly resolve these endpoint-only entries. + +These prefixes are reserved for attestation provisioning. Before writing, the operator tool checks existing entries and ordinary app-config secret references, including each adapter's normalized key/environment mapping, and refuses collisions; it must not overwrite an unrelated value. Rotation replaces only entries explicitly owned by that deployment/key. Physical IDs and resource-link mappings remain operator deployment context, not public claims or new build inputs. Fastly reads by the existing logical links. The running Trusted Server Axum adapter reads metadata through `TRUSTED_SERVER_CONFIG_{STORE}_{KEY}` and seed values through `TRUSTED_SERVER_SECRET_{STORE}_{KEY}`, using its existing uppercase/underscore normalization. EdgeZero CLI local-config files and its separate secret environment convention are not automatically consumed by that runtime. P1 provisioning must use the Trusted Server mapping explicitly, or supply and verify a bridge, including entry-ownership/collision checks and a running-adapter readback test. Cloudflare/Spin flat secret namespaces remain unchanged and production attestation there remains unsupported until separately qualified. + +Do not add a second logical secret store, a second config store, or unconditional attestation resource links to `edgezero.toml`/adapter store metadata. Pinned EdgeZero v0.0.11 treats Axum, Cloudflare, and Spin as single-secret-store adapters; shared inventory expansion would reject strict validation, config push, and provision before feature enablement is considered. Existing-store namespaces avoid that regression and impose no additional store quota or empty-store linkage requirement on disabled deployments. Fastly requires an initial config entry before association under its documented provisioning path; existing application-config provisioning already supplies it. Enabling attestation adds validated entries only after existing link/access/quota checks succeed. No empty new store, placeholder private key, or sentinel is needed. Disabled mode performs zero attestation-entry reads/writes and requires no new resources. + +A future operator may isolate keys in additional physical stores only through an adapter-scoped, separately reviewed capability/provisioning change; this spec does not authorize changing the shared inventory to do so. Store sharing does not mean key reuse: cryptographic purposes, metadata, prefixes, and enrollment are separate, but application code with access to the shared secret store can read those keys. Verifier credentials remain read-only; absence of physical isolation is explicit in the residual trust model. + +Sharing the public release executable does not imply sharing keys between publishers. Existing store linkage is observed provider context, not proof of non-extractability or per-key access isolation. Verifiers receive no write permission to these stores and do not generate publisher keys. Axum fixtures use the existing environment-backed read adapter and a test-only mapping; adding portable logical names does not imply provider namespace isolation or write support on Cloudflare/Spin, whose production paths remain unsupported. + +Key validity is at most 90 days. Metadata may publish a successor before activation. Operator rotation stages new metadata/secret, includes the successor in `discovery_keys`, and stages DNS authorization, changes `active_key`, then completes fresh endpoint proof and obtains an assessment for the new key/binding. Until that assessment is available, the new evidence is unendorsed and a consumer requiring an assessment rejects it; normal site traffic continues. Version 1 does not promise an uninterrupted attestation transition. Keep the old public key verifiable for at least the maximum assessment lifetime plus status/cache allowance. Never sign after key expiry. No "last key signs forever" fallback. There is no promise of an atomic distributed store/config transaction: readers observing inconsistent metadata fail the endpoint, and rotation tests must cover ordering and propagation. + +The endpoint checks key validity and current time on every response even if parsed key bytes are sandbox-cached. A reusable sandbox cannot extend an expired key or assessment. Cached metadata has the same documented snapshot lifetime as its bound settings; changing a store does not retroactively update a running snapshot. Operators must plan instance recycling or bounded refresh where required by a qualified adapter. + +On compromise, stop positive renewal, mark affected enrollments/keys compromised, provision a fresh key through trusted operator recovery, re-prove host control, and issue new assessments. Old-key signatures cannot authorize the replacement alone. Routine retirement does not imply historical signatures were forged; compromise and observation unavailability are separate reasons. Historical evidence remains verifiable as historical data, not current authorization. + +## 7. Configuration claims and actual snapshot identity + +### PA-SNAPSHOT: commit only to a defined public projection + +Version 1 claims a deliberately narrow identity projection: + +```json +{ + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" +} +``` + +The object is closed. It is built from effective normalized settings after defaults and permitted overrides, alongside that request's settings snapshot. `configuration.digest` is SHA-256 of its JCS representation; descriptor identity fields MUST equal their projection counterparts. The key and provider version are already separately bound in the descriptor. + +This digest says nothing about auction rules, consent policies, bidder lists, integration safety, source contents, mutable dictionaries, runtime data, resolved secret values, or the full settings document. Neither built-in policy may claim those properties. A broader policy projection is a follow-up requiring named fields, normalization, privacy review, and independent check methods; merely hashing more JSON is not approval of behavior. + +Capture verified envelope identity and configuration selector privately before `BlobEnvelope::into_data()` and secret resolution discard them, and carry that provenance beside the same immutable settings snapshot. Do not publicly expose an arbitrary full-config hash: low-entropy sensitive settings can be guessed. An opaque internal snapshot ID and a public projection digest serve different purposes. A timestamp or envelope checksum is not proof of publisher authorization. + +For both built-in v1 policies, the configuration check validates the signed public projection's schema, digest, equality with the descriptor, and consistency with the enrolled host/operator/deployment/environment tuple. Its method is `public-identity-projection-v1`; a pass means that those declared values are structurally consistent and authorized, not independently observed runtime configuration. The registry does not read the whole app-config envelope merely to compare these five identity values. Even an official executable assessment MUST state this declared-configuration scope; official bytes do not certify settings or behavior. + +The runtime still binds evidence to the snapshot actually used by its handler. The verifier compares fresh evidence bindings during collection and repeats provider active-version/host observations where the selected policy requires them. Covered declared identity or provider version changes cause a bounded retry and then an indeterminate result. Matching observations cannot rule out change-and-restore or global propagation differences. Independent business/consent/integration policy appraisal requires a separate privacy-reviewed method and consumer opt-in. + +Default Fastly, reusable Fastly, Axum, Cloudflare, and Spin can have different settings lifetimes. Evidence MUST describe the actual retained snapshot, not the latest config store fetched later. When fresh evidence and a retained assessment disagree on covered identity/key/version, a consumer rejects the combination and requests reassessment. It never relabels a stale binding as current. + +## 8. Assessment lifecycle + +The [registry lifecycle contract](2026-11-04-publisher-attestation-registry-design.md#pa-collection-deterministic-independent-assessment) defines collection and timing. V1 uses expiry-only consumer acceptance by default: assessments last at most 15 minutes from the oldest observation and no longer than their authorizations. Live status is optional consumer policy with its own availability/privacy cost. Independent configuration reads are excluded from both built-in profiles; projection consistency remains a signed publisher declaration. + +## 9. Consumer verification and networking + +### PA-CONSUMER: consumer verification + +The [consumer acceptance algorithm](2026-11-04-publisher-attestation-registry-design.md#pa-consumer-acceptance-algorithm) compares a fresh publisher response with assessments from independently trusted issuers. It validates exact bindings, signatures, policy and expiry, and checks live status only when expressly configured. A matching package fingerprint cannot satisfy official-executable policy. + +### PA-NETWORK: constrain all external fetches + +Publisher checks require TLS certificate and hostname validation with SNI and authority set to the expected enrolled host. No redirects, downgrade to HTTP, userinfo, URL fragments, caller-selected port, or alternate host supplied by a response. Fixed endpoint paths prevent following a page's attacker-selected verify link. Development HTTP is allowed only for explicitly configured loopback fixtures under the declaration profile, never production. + +Reference-verifier enrollment and publisher fetching MUST defend against SSRF: reject loopback, private, link-local, multicast, unspecified, reserved/nonpublic, and provider metadata destinations; resolve and validate all connection candidates, pin a validated address for the connection, and revalidate on every new connection. Do not merely validate a hostname before a client re-resolves it. Resolver trust and allowed enterprise exceptions require explicit operator configuration and cannot produce the public production profile. Proxy environment variables are disabled by default in the reference collector; explicitly configured egress proxies are trusted components recorded in its policy. + +Provider API traffic uses an independently configured fixed Fastly authority, not report-selected URLs. Provider credentials are never forwarded to publisher, release, discovery, redirect, or status endpoints. Release evidence acquisition follows Layer 1's trusted repository/workflow/publication policy. Verifier status URLs are constructed from configured verifier base and validated UUID, not fetched from an arbitrary assessment member. + +Each network call has a five-second deadline; transient idempotent reads may retry once within the collection deadline, respecting bounded Retry-After. HTTP error bodies are capped at 4 KiB and redacted. Evidence is capped at 16 KiB, discovery at 16 KiB, assessment at 32 KiB, and status at 8 KiB, measured after any HTTP decoding. Do not accept unlimited decompression or chunked growth. Provider/package limits belong to the qualification spec. Endpoint rate limiting is an operator/platform deployment responsibility; tests cover bounded work per request without assuming a global counter across WASM instances. + +### PA-REFERENCE: delivery boundary + +This repository delivers the publisher endpoint, portable types/pure verification, and a bounded host-target reference verifier. Registry publication, administration, signer recovery, governance, retention and the demo are specified in the [separate registry contract](2026-11-04-publisher-attestation-registry-design.md). Production checkpoint/fencing backend engineering is a registry deployment obligation, not code required inside the edge publisher binary. Moving it to that contract does not waive the no-stale-issuance invariant. + +## 10. Failure model, diagnostics, and privacy + +### PA-FAILURE: distinguish rejection from uncertainty + +| Reason code | Meaning | Default effect | +| ---------------------------- | ---------------------------------------------------------------------------------- | ------------------------------------------- | +| `malformed` | Invalid syntax, schema, limits, or inconsistent hashes | Reject | +| `signature_invalid` | Wrong key, message type, or signature | Reject | +| `operator_unauthorized` | Claimed operator identifier lacks valid independent account association/delegation | Reject enrollment/issuance | +| `state_recovery_required` | Durable authorization history or fencing cannot be established | Stop signing/current status | +| `host_mismatch` | Expected host or enrolled authorization differs | Reject | +| `environment_mismatch` | Wrong staging/production or unavailable identity | Reject production | +| `key_unauthorized` | Unknown/not-yet-valid/expired/retired key | Reject current acceptance | +| `key_compromised` | Confirmed compromise recorded by trusted authority | Reject; rotate/re-enroll | +| `nonce_mismatch` | Missing, stale, repeated, or wrong challenge | Reject freshness | +| `stale` | Evidence, observations, assessment, enrollment, or status too old | Reject current acceptance | +| `binding_mismatch` | Version/key/projection/deployment tuple differs | Reject combination; reassess | +| `release_ineligible` | Authentic release not accepted under configured policy | Reject official profile | +| `artifact_mismatch` | Qualified observation binds a different executable | Fail official check | +| `artifact_binding_unproven` | Only fingerprint/declaration or unqualified method available | Indeterminate official check | +| `configuration_unobservable` | Inputs to an explicitly selected independent configuration method are unavailable | Indeterminate selected optional method | +| `provider_unavailable` | Outage, timeout, permission, incomplete state | Indeterminate; stop positive renewal | +| `observation_race` | Observed state changed during collection | Retry bounded operation; then indeterminate | +| `withdrawn` | Assessment or enrollment withdrawn | Reject current acceptance | +| `status_unavailable` | Explicitly required live status cannot be validated | Reject current official assurance | +| `policy_untrusted` | Unknown issuer/policy/method or threshold not met | Reject endorsement | +| `clock_unavailable` | Reliable current time unavailable | Stop current assurance | + +No API response should reduce these distinctions to a universal `trusted: true`. Public verdicts include expected host, issuer/policy, observation interval, expiry, build class/assurance, coverage, and reason codes. A declaration can satisfy the declaration profile without satisfying official-deployment policy. A custom build is not intrinsically a failure; it fails a policy that requires official bytes. + +Attestation failure does not shut down normal publisher traffic by default. It removes the attestation claim or returns an endpoint error. Any site-wide blocking policy belongs to explicit operator configuration outside this feature. Ordinary request-signing behavior remains unchanged. + +### PA-PRIVACY: minimize disclosures and retained evidence + +Public objects disclose host, IDs, key, provider service/version, public identity projection, build declarations, appraisal scope/times, and potentially official release identity. Operators explicitly opt in to this disclosure. No browser identities, IPs, cookies, consent strings, bidder credentials, backend URLs, full configuration, private keys, or provider tokens appear in public evidence. + +Log operation IDs, outcome codes, durations, and shortened safe object IDs through `log`; do not log nonce query strings, bodies, raw config, secret references, provider authorization headers, or sensitive provider error payloads. Public errors use generic codes; privileged diagnostics are separately access controlled. Do not publish arbitrary low-entropy private digests. + +The reference verifier retains exact public signed objects, sanitized observation records, policy/release evidence identities, and enrollment/recovery audit events for 90 days by default in restricted storage. Public historical objects may be archived longer under a stated operator policy. Raw credential-bearing responses and signing secrets are excluded from evidence archives; retention and credential backup have separate access controls. Restrict state directories and files to the owning account. Disable unrelated third-party analytics on a reference verification page, if one is added later. + +Fastly read-only credentials may still expose account-wide information: service restrictions on global read scopes do not imply isolation of non-service endpoints. Before enrollment, document actual endpoint permissions, resource exposure, rotation/expiry, and separation from unrelated account assets. Prefer a dedicated deployment account where required by the observed permission model. No verifier requires provider write/deploy rights. + +## 11. Repository integration and compatibility + +### PA-INTEGRATION: fit existing seams + +| Existing surface | Proposed work and constraint | +| ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- | +| `crates/trusted-server-core/src/config.rs` and `settings.rs` | Typed opt-in attestation settings, strict validation, narrow projection | +| `config_payload.rs` and `settings_data.rs` | Retain provenance beside the actual settings snapshot before secret resolution; do not change existing secret semantics | +| `platform/` runtime services | Adapter-owned identity and dedicated store access; no publisher-controlled identity override | +| `trusted-server-adapter-fastly/src/app.rs` and `main.rs` | Exact early route, request-local identity/snapshot, default and reusable admission semantics | +| `trusted-server-adapter-axum/` | Production/staging declarations and isolated development fixtures; no measured provider identity | +| Cloudflare and Spin adapters | Preserve existing routes/builds; unsupported production attestation remains explicit; qualify separately before adding claims | +| `request_signing/` | Reuse reviewed crypto primitives only where useful; retain separate keys, entry namespaces, types, and endpoints | +| Host CLI/reference verifier | Enrollment input, collection, offline verification, public assessment/status generation; target-isolated dependencies | +| Layer 1 release evidence | Authenticate retained raw executable bytes and eligibility; no runtime GitHub verification or new publisher-specific release build | +| JS bundles and publisher HTML | No new JS injection, user flow, or auction modification | + +Core protocol types and validation should have narrow modules and strong domain types for host, deployment ID, binding ID, key thumbprint, and times. Use `error-stack` and existing runtime store/HTTP abstractions. Runtime clock access must use the repository's WASM-safe clock conventions. No dependency is selected solely by this design; verify support across targeted builds before implementation. + +The endpoint and its required protocol/key-reading capability MUST be compiled into the authenticated release executable used for an official deployment claim, then enabled at runtime with publisher config/keys. Adding an operator-specific module or recompiling in a key changes the artifact and cannot inherit that official release identity. Core versus linked module placement remains an implementation choice only if the official release composition includes it. Older releases lacking the endpoint are not made capable by configuration alone. + +Do not depend on the fork's full module/source/filter stack to ship this feature. An existing or merged module endpoint seam may host it if it can enforce the routing/key/snapshot contract; otherwise add the smallest explicit adapter route. The architecture is independent of code placement. Do not add a broad generic attestation plugin framework. + +Existing deployments remain disabled and preserve normal behavior. Existing `/.well-known/trusted-server.json` key discovery and `/verify-signature` retain their current purposes; they do not become publisher-attestation authorities. No automatic migration of their keys is allowed. The old fork's bespoke ES256 envelope and compiled-key schedule are not wire-compatible with this version. Operators must enroll new runtime keys; do not silently accept legacy objects under new assurance labels. + +The historical January proposal is background only. Its full-config commitments and embedded final-binary checksum must not become requirements by implication. The release specification/guide on #1435 distinguishes raw executable identity, source facts, and deployment observations; consume verified inputs without assuming a later release index is shipped. A candidate/unsigned index cannot authorize an official assessment. + +## 12. Delivery boundaries and qualification gates + +This is the cross-component architecture contract. It is not an implementation plan or permission to activate live credentials/services. Each delivery milestone gets its own bounded implementation plan and any necessary phase-specific spec amendment; provider experiments require explicit authorization of named disposable resources. + +| Milestone | Deliverable | Exit gate | +| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | +| P0: provider feasibility | Retained Fastly source/provider evidence and supported method decision | Companion qualification review; unresolved official binding remains closed | +| P1: publisher evidence | Runtime keys, strict schemas, host/snapshot binding, endpoint, pure/reference verifier, minimal declaration enrollment and signed assessment, fixtures/docs; public Axum declarations included | Declaration-profile end-to-end proof; visibly no independent installed-code claim | +| P2: independent deployment appraisal | Provider-backed enrollment/appraisal, qualified provider/release collection with declared identity consistency, signed assessments/status | Strong profile enabled only for methods passing P0 and runtime tests | +| P3: operational adoption | Operator-run renewal/status service and recovery runbooks | Chosen consumer-mode availability/privacy SLOs, credential exposure review, rollback and incident rehearsal | +| P4: demo registry | Stacked illustrative registry with enrollment/status display and consumer verification walkthrough | Fictional/local fixtures, clear declared/fingerprint/official labels; no implicit public accreditation or live provider qualification | + +P1 does not close the full independent-verification scope of #161. If P0 cannot justify a strong binding, maintainers may ship the declaration profile and fingerprint observations, but must record the unsupported official-deployment claim and revise acceptance rather than quietly mark it achieved. P4 is a named stacked demo-registry follow-up after the protocol/reference verifier; its UI and hosting are not core-feature acceptance dependencies. Future auction/bid work is not an acceptance dependency. + +No calendar commitment is made here. Endpoint work, provider feasibility, and a continuously operated verifier are different effort categories. Estimates must follow the qualified method, phase scope, dependencies, and reviewer capacity; signature code size is not a measure of complete assurance-system effort. + +## 13. Verification and acceptance matrix + +### PA-TESTS: evidence before assurance + +Tests use fictional hosts/data and generated test-only keys, never operator credentials or production signing keys. A fixture's declared expected result cannot stand in for provider qualification. CI tests must include independent verification of produced JWS bytes and malicious negative fixtures, not only round-trip tests through the same serializer. + +| Test family | Required cases | Requirements | +| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | +| T1 encoding/crypto | Independent JWS verification; altered segments; wrong key/type/curve/algorithm; duplicate members; limits; canonical thumbprints/hashes; structurally valid semantic contradictions | PA-WIRE, PA-BINDING | +| T2 endpoint freshness | Exact nonce; repeated parameters and invalid encoding; future/expired/key-boundary times; unavailable clock | PA-EVIDENCE | +| T3 host routing | Exact host; parent/suffix/lookalike rejection; canonical ASCII/A-label/trailing dot/port/authority conflicts; forwarded-host spoofing | PA-IDENTITY, PA-ROUTING | +| T4 routes/privacy | No bot/auth/EC/consent/auction dependency; disabled reserved paths; unsupported methods; unchanged neighbors; no backend calls; conditional requests; final no-store; CORS; no user identifiers | PA-HTTP, PA-ROUTING, PA-PRIVACY | +| T5 runtime keys/stores | No key; corrupt seed; public-key mismatch; rotation propagation; bounded discovery list; missing overlap metadata; no enumeration; expiry in cached sandbox; staging isolation; no secret disclosure; namespace collisions; strict disabled validation/provision/config push without inventory expansion; absent optional entries | PA-CONFIG, PA-KEYS | +| T6 runtime snapshots | Actual retained versus latest config; projected versus uncovered changes; declared scope; multi-host mismatch; cached sandbox; version/config/key changes | PA-SNAPSHOT | +| T7 adapter integration | Running Fastly evidence independently verified; production/staging Axum declarations; canonical host consistent across ingress/TLS; ordinary deploy emits new version binding and rejects old assessment combination | PA-REFERENCE, PA-BINDING | + +Registry enrollment, appraisal, consumer acceptance, provider collection and durable recovery tests belong to the [registry verification matrix](2026-11-04-publisher-attestation-registry-design.md#registry-verification-matrix). Provider executable-binding experiments belong to the Fastly qualification companion. These separate acceptance boundaries do not require auction/bid implementation. + +Before publisher-evidence handoff, run changed core/adapter tests with target-matched aliases, Fastly reusable tests if that path is touched, host verifier/CLI tests, strict applicable clippy, formatting, domain lint, documentation checks, and an actual running-adapter fixture. Use native tests for protocol logic and Viceroy for Fastly endpoint behavior. Cloudflare/Spin compilation/parity checks demonstrate compatibility only, not production provider qualification. No HTML EOF harness is required unless implementation changes publisher/HTML processing. Before an implementation PR handoff, run all repository-mandated CI gates, documenting any unavailable external runtime checks without calling them passed. + +Acceptance of this design requires review of the contracts and explicit unresolved-provider gates, not a claim that implementation tests have run. Acceptance of the full feature requires: + +- **AC1:** Authorized publisher evidence verifies independently; malformed, forged, stale, cross-host, cross-environment, and unauthorized-key objects fail. +- **AC2:** Keys are runtime-only and separate from release/request signing; rotation/expiry/compromise behavior is demonstrated. +- **AC3:** The exact request-used identity projection and service/version/key binding survive the real runtime transport. +- **AC4:** A qualified independent method authenticates the installed selected executable before official provenance is asserted. If that gate remains unresolved, only the narrower milestone is accepted; the full independent-verification feature remains incomplete and the strong profile stays unsupported. Any reduced-scope closure requires an explicit maintainer disposition. +- **AC5:** Declaration, custom, fingerprint-only, official, unavailable, failed, and withdrawn outcomes cannot be confused by the reference consumer or documentation. +- **AC6:** Signed assessments, default expiry-only acceptance, optional live status, monitoring outages, sequence recovery where applicable, and multiple-verifier trust policy are exercised end to end. +- **AC7:** No auction/bid behavior changes, new user-data collection, publisher-specific official build inputs, or mandatory central administrator are introduced. + +## 14. Prior work and references + +The role separation follows RFC 9334: attester, verifier, relying party, reference-value provider, and endorser are roles, not a requirement for one administrator. This design borrows the operator endpoint's narrow declarations and exact-byte verification lessons while requiring independent evidence for stronger appraisal. + +| Work | Learning and treatment | +| ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| [jwrosewell/trusted-server#7](https://github.com/jwrosewell/trusted-server/pull/7), inspected at `59e09b6cd9632b8198deaa92b38ed7d5b841e06e` | Historical closed/unmerged attestation prototype: bounded nonce, explicit limits, endpoint-local errors, independent OpenSSL harness. Reject compiled private keys and endless last-key signing; it supplies no installed-artifact measurement | +| [IABTechLab/trusted-server#1297](https://github.com/IABTechLab/trusted-server/pull/1297) and [#1353](https://github.com/IABTechLab/trusted-server/pull/1353) | Related upstream stack history; attestation was removed from #1353, which is endpoint-seam work, not an implemented assurance dependency | +| [jwrosewell/trusted-server#34](https://github.com/jwrosewell/trusted-server/pull/34), inspected at `12b1f467aeab9cfb5650e7fbc2b32f654d323ebd` | Distinguish publisher identity from backend source and outbound Host; source refactor is not required here | +| [jwrosewell/trusted-server#47](https://github.com/jwrosewell/trusted-server/pull/47), inspected at `86f77a124d49bcfe27d00be2b397b481786340fb` | Request-cycle parity and terminal privacy protections matter; no independent executable verification supplied | +| [#846](https://github.com/IABTechLab/trusted-server/issues/846) | Secret migration background. Current baseline already resolves typed secret references; open issue status is not proof of current plaintext blob behavior | + +Primary provider sources: [Fastly package API](https://www.fastly.com/documentation/reference/api/services/package/), [token scopes](https://www.fastly.com/documentation/reference/api/auth-tokens/user/), [edge data stores](https://www.fastly.com/documentation/guides/compute/edge-data-storage/about-edge-data-stores/), [secret-store API](https://www.fastly.com/documentation/reference/api/services/resources/secret-store/), and [audit events](https://www.fastly.com/documentation/reference/api/account/events/). These support provider semantics, not an inference of exclusive runtime key access or globally consistent observation. + +Normative encoding references: RFC 7515 (JWS), RFC 8037 as updated by RFC 9864 (fully specified Ed25519 JOSE), RFC 7638 (JWK thumbprints), RFC 8725 (strict validation and message separation), and RFC 8785 (JCS). Verify interoperability and target support during implementation qualification; no external standard certifies this project's claim accuracy. + +The v1 host contract is canonical ASCII DNS syntax; Unicode/IDNA conversion, if offered by operator tooling, is explicit preprocessing outside protocol identity checks. Using JWS does not claim EAT conformance; RFC 9711 EAT alignment or registered public media types may be considered later without weakening this private profile's validation. + +## Task-force decisions and open questions + +The proposed v1 defaults now explicitly select expiry-only acceptance, optional live status, publisher-declared identity consistency, real production Axum declarations, runtime-enabled capability in the authenticated official release, registry-side endorsement storage with read-only provider access, and provider polling as the monitoring baseline. Fresh DNS challenges are retained with automation support. Outermost traffic placement is not a verified v1 claim. + +Before implementation/production adoption, the task force must decide: + +1. Which Fastly selected-executable binding method passes qualification? If none does, is a clearly narrower declaration/fingerprint milestone useful without closing the strong feature? +2. Who will operate verifiers, which policies/keys consumers should trust, and whether any consumer requires the optional live-status mode? +3. Which operator DNS/account-delegation methods are accepted, and how DNS renewal automation is supported? Persistent issuer/key/scope authorization is a follow-up alternative, not an unreviewed replacement for fresh challenges. +4. Which governance/appeal procedures and registry service agreements apply, including allocation of legal responsibilities? Cryptographic validity does not settle those terms. +5. What deployment and acceptance scope should the stacked demo registry have? It cannot present fictional evidence as production qualification. +6. Is independently checked full configuration or outermost traffic placement required in a later profile? Each needs a new evidence/privacy contract and qualification; neither may be inferred from official bytes. + +These are explicit approval/qualification gates, not implementation TODOs or permission to invent missing provider capabilities. + +## Review log + +- **Round 1 (Codex, independent security and runtime review):** Corrected policy-conditional inputs, exact-path routing, store wiring and rotation. +- **Round 2 (Codex, independent security and runtime review):** Corrected overlap-key discovery without store enumeration. +- **Round 3 (Codex, independent security and runtime review):** No blocking contract issue remained. +- **Follow-up review (Codex, independent security, feasibility and standards review):** Corrected existing-store compatibility, operator authorization, JOSE algorithm identifier and transport limits; added schemas, vectors and recovery fencing. +- **Second detailed pass (Codex, independent security and feasibility review):** Corrected authorization-expiry caps; no blocking contract issue remained after correction. +- **Split-contract review (Codex, independent security and contract review):** Aligned the signed configuration-method identifier; no blocking contract issue remained after correction. Document and fixture checks do not qualify runtime behavior or a Fastly method. +- **Cleanup review (Codex, independent contract review):** Checked contextual fingerprint evidence, deployment gaps, operator lifetime, rejection semantics and test ownership; corrected declaration-profile wording to permit optional provider observations. +- **Cleanup follow-up (Codex, independent contract review):** No remaining blocking consistency findings. Structural and signature fixtures pass; runtime and provider qualification remain unexecuted. +- **Final detailed review (Codex, independent security, runtime-feasibility and protocol reviewers):** No blocking findings. Clarified Axum provisioning mapping, optional provider observations, and P1 declaration enrollment/assessment ownership. Runtime implementation and provider qualification remain unexecuted. +- **Self-review (Claude Code, independent contract and fixture review):** No blocking findings. Renamed the evidence path to `/_ts/attestation.jws` to match its `application/jose` body, clarified the discovery `keys` bound, and fixed live-status sequence ordering in the registry contract. The schema keeps draft-07 in its `$comment` and in the wire-schema text rather than a `$schema` URI, because the repository URL-host lint rejects that host and JSON cannot carry a per-line suppression; validators must select draft-07 explicitly. Fixture signatures, digests and schema results were rechecked independently. diff --git a/docs/superpowers/specs/2026-11-04-publisher-attestation-fastly-qualification-design.md b/docs/superpowers/specs/2026-11-04-publisher-attestation-fastly-qualification-design.md new file mode 100644 index 000000000..353e7989c --- /dev/null +++ b/docs/superpowers/specs/2026-11-04-publisher-attestation-fastly-qualification-design.md @@ -0,0 +1,143 @@ +# Publisher attestation: Fastly executable-binding qualification + +**Date:** 2026-11-04. **Status:** Proposed read-only investigation contract and conditional experiment design; no production provider qualification or live mutation authorized. + +**Parent contract:** [Publisher attestation](2026-11-04-publisher-attestation-design.md). **Registry protocol:** [assessments and operations](2026-11-04-publisher-attestation-registry-design.md). **Scope:** authenticate the join from an enrolled publisher host and service/version to an installed selected executable, then to independently verified Layer 1 bytes. This is a feasibility/assurance gate, not auction/bid attestation or a new release producer. + +## 1. Question and non-assumptions + +Can an independent verifier, with read-only Fastly credentials, establish that the executable selected for an enrolled host's active production service/version is byte-for-byte an eligible official Trusted Server WASM? + +The verifier starts with authenticated official raw WASM bytes, not merely a checksum string, plus existing enrolled service/host context. It must not infer execution from source headers, service environment variables, upload success, CLI exit zero, publisher-supplied receipts, or the attestation endpoint's own report. No public API for retrieving deployed executable bytes has been established by this investigation. + +The strong publisher profile remains disabled until this question has a defensible method. A provider fingerprint observation can still be recorded at lower assurance. A matching fingerprint must not be labelled an official installed binary merely because it appears plausible. + +## 2. Confirmed client algorithm + +The repository pins Fastly CLI 16.0.0, whose annotated tag resolves to commit `34cef1b0bdbc35d0f1af883a1955d7fe9b3a5ad5`. At [hashfiles.go](https://github.com/fastly/cli/blob/34cef1b0bdbc35d0f1af883a1955d7fe9b3a5ad5/pkg/commands/compute/hashfiles.go), `getFilesHash`: + +1. Extracts nondirectory package entries through `packageFiles`. +2. Stores each entry's contents by `NameInArchive` in a map; a repeated exact name replaces the earlier value. +3. Sorts the map's names lexicographically. +4. Concatenates contents in that order into SHA-512. Names and lengths are not included in the hashed stream. + +In symbols, for sorted unique entry names `n1 ... nk`: + +```text +files_hash = hex(SHA-512(contents[n1] || ... || contents[nk])) +``` + +For a package with precisely one `bin/main.wasm` and one `fastly.toml` under the same conventional root, their lexical order yields `SHA-512(wasm_bytes || manifest_bytes)`. Additional files also contribute. Tar headers, gzip metadata, and directory entries are not part of that client stream. + +At [validate.go](https://github.com/fastly/cli/blob/34cef1b0bdbc35d0f1af883a1955d7fe9b3a5ad5/pkg/commands/compute/validate.go), `packageFiles` skips directories and delegates archive extraction; this code is not a security specification for unique paths/member types. Package validation checks expected basenames and must not substitute for a strict verifier grammar. + +The [provider API](https://www.fastly.com/documentation/reference/api/services/package/) describes `metadata.files_hash` as a hash of files within the package and exposes metadata GET and package PUT. It does not by itself establish server acceptance/selection grammar, identical hash calculation, or selected-module readback. The obsolete package `hashsum` is a different field and must not be substituted. + +## 3. Security consequence + +SHA-512 collision resistance does not make this concatenation an injective package encoding. Different names or divisions between file contents can represent the same hashed byte stream without any SHA-512 collision. Duplicate names and parser differences add ambiguity. Whether an attacker can exploit those properties while satisfying Fastly's actual package/WASM selection rules is not established here. + +Strictly inspecting a publisher-supplied canonical archive only proves properties of that supplied archive. An attacker controlling upload can submit a different provider-accepted archive. A locally enforced two-file grammar does not constrain Fastly's remote accepted set. Nor does a matching provider hash prove the publisher supplied the same archive that was uploaded. + +Strong qualification therefore requires one of: + +| Method | Evidence necessary | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Provider-authenticated selected-module digest | Documented/authenticated provider measurement naming exact service/version and selected raw module bytes, with semantics and algorithm qualified | +| Authenticated selected-byte readback | Retrieve provider-authenticated deployed package/module for exact service/version, independently parse selection, hash exact module bytes, and verify its association with the active host | +| Qualified package-hash binding | Documented provider acceptance/selection and hashing contract, corroborated by experiments, plus a security argument that no accepted alternate package with a different selected module can produce the same expected stream under that contract | + +Bounded positive and negative experiments cannot by themselves prove the final method safe for all accepted packages. If provider contract or selected-byte evidence is missing, retain `fingerprint_only` assurance. Operator-controlled upload tooling, a package comment, or a receipt signed by the publisher is not an independent provider invariant. + +## 4. Required observation chain + +Each link needs a concrete authenticated evidence source, its retrieval time, version scope, coverage, and failure behavior: + +```text +explicitly enrolled publisher host + → provider host/service mapping and TLS/routing context + → production active service version + → package identity for that exact version + → selected executable bytes or qualified equivalent binding + → authenticated eligible official release bytes +``` + +Investigate both versioned and versionless domain mechanisms supported by the actual account, staging, attached resources, resource linkage where needed by the qualified method, and edge propagation. V1 does not require app-config payload reads for identity consistency; the signed public projection remains a publisher declaration. Resolve the production environment explicitly through supported active/environment associations, not latest version or a legacy staging boolean. The [version API](https://www.fastly.com/documentation/reference/api/services/version/) documents some historical booleans as unused; distinguish those management fields from runtime staging identity. Provider API reads may describe desired/control-plane state rather than execution at every POP. An HTTPS challenge observes one serving path; a browser-visible page or response header cannot authenticate the management-plane mapping alone. + +Read active provider version/host mapping before and after the challenge, and compare fresh signed public identity bindings when needed. Do not treat those declared values as independently observed configuration. Reject inconsistent intervals. Record that matching observations do not exclude a change-and-restore or prove simultaneous global convergence. State whether a supported profile describes control-plane configured deployment, sampled response, or both. + +## 5. Strict local package inspection + +For any method consuming an archive, the verifier must use a safe streaming/parser strategy without extracting attacker-selected paths to the filesystem. Enforce a qualified allowlisted archive layout, one selected executable, exact member names/root, unique canonical paths, allowed regular-file/directory types, and exact manifest bytes. Reject absolute paths, traversal, backslash aliases, normalized duplicate names, links, special files, nested archives, multiple executable candidates, unexpected files, malformed headers, truncated streams, and unsupported extensions. If PAX/GNU metadata is necessary, specify its allowed interpretation and reject contradictory names/sizes. + +Initial parser safety limits are 100 MB compressed, 256 MiB total expanded regular contents, 128 MiB per member, 16 entries including directories, depth 4, 512-byte names, and a 30-second inspection deadline. These are verifier bounds, not claims of identical provider limits. Confirm actual official artifact fit before adoption; a larger official artifact requires an explicit reviewed profile limit increase, not silent expansion. Hash while reading; do not hold several attacker-controlled expanded copies unnecessarily. + +Retain the exact inspected file inventory, content digests/sizes, selected-member identity, and archive digest privately. The archive SHA-256 identifies the submitted envelope; it is not the canonical release executable identity. Publisher `fastly.toml` can disclose private deployment metadata and must not be published in full as attestation evidence. Never execute its scripts or invoke a build-capable command to inspect it. + +## 6. Investigation and controlled experiments + +### Q1: source and provider contract review, read-only + +- Pin the examined CLI version and source commit; inspect `getFilesHash`, archive parser, package validation, upload, skip-same-hash, and activation behavior. +- Identify actual provider metadata and active-version APIs, host mapping APIs, resource links, selector observation, and read permissions. +- Verify the parent contract's existing-store namespaces against the pinned EdgeZero capability model. Do not add a second portable logical secret store or require empty metadata-store association; disabled attestation must preserve strict validation/config-push/provision behavior and existing store quotas. Check exact entry ownership/collision and physical link resolution before enabling keys. +- Ask whether authenticated selected-module digest/readback exists and under what access/retention conditions. Record documentation or provider confirmation; do not invent an API. +- Document what each field measures and whether it is reported, derived, mutable, versionless, or sampled. +- Separate supported facts from hypotheses in a method report. Runtime reports and client source do not establish server semantics. + +### Q2: local fixtures, provider-free + +- Compute client fingerprints from canonical official-byte packages with independently retained manifests and compare against pinned CLI output. +- Vary compression, tar timestamps/order/root prefixes, manifest whitespace, contents, extra files, duplicate/alias paths, links, and headers. Record fingerprint and local-parser outcomes separately. +- Demonstrate generic concatenation/name ambiguity with harmless fixture bytes. Do not claim a successful provider exploit from a local hash equality alone. +- Validate safe archive rejection and resource bounds with malicious small fixtures. No real credentials or publisher domains enter fixtures. + +### Q3: disposable provider observations, requires explicit resource authorization + +Before any upload, activation, token creation, or domain/resource change, obtain authorization naming the disposable account/service, allowed actions, cost bounds, and cleanup owner. Use fictional fixture data; do not modify an existing publisher service. Test instrumentation and a reviewable experiment plan are prepared before requesting that authorization. + +- Upload canonical packages containing retained official or harmless test module bytes; independently read provider metadata for exact allocated versions. +- Compare local/client/provider hashes; vary only one property per trial. Distinguish successful upload, selected module, activation, and observed response. +- Exercise provider-accepted naming/root/member rules, duplicate/alias handling, extra entries, and safe selected-module distinguishers. A provider rejection is evidence about that fixture only. +- Check staging versus production, new-version activation, same-hash upload skipping, domain mappings, and before/after read races. +- Change a declared public identity value without a new service version and verify the endpoint's loaded snapshot/renewal mismatch behavior separately; no claim of independent full-config appraisal is made. +- Exercise credential restrictions/revocation and audit-event coverage for relevant changes. Missing events or inaccessible resources must remain explicit gaps. +- Check structural/enrollment consistency of the signed public identity projection without reading the full app-config blob for that purpose, while treating `ts-publisher-key-` metadata entries and `ts-publisher-` secret entries as separate namespaced records. Do not publish their private linkage or infer code-exclusive access from a shared store. +- Retain sanitized observations and raw private evidence under restricted access. Clean up only resources the experiment owns; report uncertain outcomes without guessing or retrying mutations blindly. + +### Q4: method security review and disposition + +The report must contain source/API identity, provider acceptance/selection contract, exact join algorithm, hostile-operator threat argument, retained positive/negative evidence, release verification/eligibility path, host/version/config coverage, permissions, time/propagation limits, and unsupported states. Distinguish absence of an observed counterexample from a justified invariant. + +Two independent reviews are required before enabling a strong method: package/provider security review and runtime/operational integration review. Reviewers must assess alternate accepted archives and control-plane versus serving-state limitations, not just canonical equality. + +## 7. Gate outcomes and versioning + +| Outcome | Permitted publisher result | +| -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | +| Authenticated selected executable and all parent-profile checks established | `artifact_bound`; `official` only after eligible release-byte verification | +| Provider hash matches a locally reconstructed candidate, but selected module is not securely bound | `fingerprint_only`, null installed executable digest and official release; official profile indeterminate | +| Only publisher build report available | `declared`; no independent installed-artifact claim | +| Observation fails or races | `unavailable`, `fail`, or `indeterminate` as appropriate; no positive official renewal | + +An approved method gets a stable versioned identifier naming its provider evidence, semantics, and limits. Consumers allowlist that identifier. CLI/provider algorithm changes, archive parser changes, provider acceptance-rule changes, new package layouts, or broadened resource selectors require requalification; they cannot silently inherit the method's approval. + +The parent contract defines policy failure and expiry. This investigation must not weaken them to fit an available API. If only lower assurance is feasible, maintainers explicitly decide whether that narrower feature meets their objective; the original strong claim stays unresolved. + +## 8. Acceptance + +- **Q-AC1:** A reviewed evidence graph distinguishes official raw WASM, publisher archive, provider fingerprint, selected executable, active service/version, host, and the publisher-declared actual request-used identity snapshot. +- **Q-AC2:** The observed client hash algorithm and its ambiguity are documented with exact source and harmless fixtures. +- **Q-AC3:** Provider contract and observations justify the selected method, or an explicit lower-assurance disposition prevents official claims. +- **Q-AC4:** Hostile packages, parser/resource limits, permissions, staging, version/config changes, and failures have retained evidence at the applicable scope. +- **Q-AC5:** No unapproved live provider changes, invented readback capability, or inference from canonical success to universal safety is accepted. +- **Q-AC6:** The qualified path uses the compatible existing-store layout, with provider-valid initialization, collision checks, and no disabled-deployment resource/inventory regression. + +No controlled provider experiment has been executed as part of writing this specification. + +## Review log + +- **Round 1 (Codex, independent security and runtime review):** Checked package ambiguity and remote-provider invariants; no blocking companion issue found. +- **Round 2 (Codex, independent security and runtime review):** Confirmed the selected-executable qualification gate; no blocking companion issue found. +- **Round 3 (Codex, independent security and runtime review):** No blocking companion issue remained. +- **Follow-up correction pass (Codex, independent security and feasibility review):** Added existing-store provisioning qualification and Q-AC6; no blocking companion issue remained. Controlled provider experiments and strong-method qualification remain unexecuted. diff --git a/docs/superpowers/specs/2026-11-04-publisher-attestation-registry-design.md b/docs/superpowers/specs/2026-11-04-publisher-attestation-registry-design.md new file mode 100644 index 000000000..3017aaf62 --- /dev/null +++ b/docs/superpowers/specs/2026-11-04-publisher-attestation-registry-design.md @@ -0,0 +1,238 @@ +# Publisher attestation: registry protocol and operations + +**Date:** 2026-11-04. **Status:** Proposed registry-side contract; no deployed registry or qualified Fastly method is claimed. + +**Parent:** [Publisher endpoint and common wire contract](2026-11-04-publisher-attestation-design.md). **Provider gate:** [Fastly executable binding](2026-11-04-publisher-attestation-fastly-qualification-design.md). + +This companion specifies what an independent verifier signs and what a consumer checks. Registry hosting, administration, signer recovery and governance belong to that registry's operator; they do not run inside the edge publisher binary. The repository supplies a bounded reference verifier and a separately planned stacked demo, not an automatically accredited multi-tenant public service. + +V1 defaults to expiry-only consumer acceptance. An assessment lives for at most 15 minutes from its oldest observation and no longer than applicable authorizations. Live status is optional and introduces availability, privacy and load costs. Known compromise/withdrawal is never ignored, but a consumer without a live update can accept until its assessment expires. Consumer trust roots are independently configured. + +```mermaid +sequenceDiagram + participant O as Publisher/operator + participant D as Publisher DNS + participant V as Independent verifier + participant P as Publisher endpoint + participant F as Fastly and release evidence + O->>V: Request scoped enrollment + V-->>O: Fresh DNS challenge + O->>D: Publish challenge response + V->>D: Verify host and optional operator proof + V->>P: Fresh nonce challenge over HTTPS + P-->>V: Signed declared identity and build facts + opt Qualified Fastly official-deployment policy + V->>F: Independently collect active version and executable binding + F-->>V: Authenticated observation and release evidence + end + V-->>O: Short-lived signed assessment +``` + +## Signed registry objects + +### PA-ASSESSMENT: verifier payload + +| Required field | Type and rule | +| --------------------------------- | ---------------------------------------------------------------------------------------------------- | +| `schema` | `ts-publisher-assessment-v1` | +| `issuer` | Consumer-configured verifier HTTPS identifier | +| `assessment_id`, `enrollment_id` | Verifier-assigned canonical UUIDs | +| `binding`, `binding_id` | Full endorsed descriptor and its digest | +| `evidence_digest` | SHA-256 of collected evidence compact JWS | +| `observed_from`, `observed_until` | Ordered observation interval covering all successful checks | +| `issued_at`, `expires_at` | Ordered times subject to PA-TIME | +| `policy` | Object: `id` string, `version` positive integer, `digest` of the verifier's retained policy document | +| `result` | `satisfied`, `not_satisfied`, or `indeterminate` under that policy | +| `checks` | Object described immediately below | +| `build` | Build appraisal object described immediately below | +| `reason_codes` | Unique sorted array of codes from the parent PA-FAILURE, empty allowed | +| `extensions` | Empty object | + +`checks` contains exactly `host_authorization`, `key_possession`, `host_service_binding`, `active_version`, and `configuration`. Each is an object with `outcome` (`pass`, `fail`, `unavailable`, `not_assessed`), `method` (nonempty profile identifier string or null), `observed_at` (integer or null), and `evidence_digest` (digest or null). A pass requires a non-null method, non-null observation time, and retained evidence digest. `not_assessed` requires all three other fields null; a fail/unavailable outcome names the attempted method and may have null observation/evidence when collection did not complete. An unavailable/not-assessed outcome MUST NOT satisfy a required check. + +`build` contains exactly `provenance` (`official`, `custom`, `unknown`), `assurance` (`artifact_bound`, `fingerprint_only`, `declared`), `method` (string), `artifact_sha256` (digest or null), `provider_files_hash` (128 lowercase hex or null), `release` (object or null), and `coverage` (literal `selected_executable_only` or `declaration_only`). A non-null `release` contains `repository`, `tag`, `source_commit`, `asset_name`, `artifact_sha256`, and `verification_evidence_digest`; it names authenticated Layer 1 evidence, not runtime strings. `repository` is a nonempty `owner/name` string matched to the configured Layer 1 source; `tag` is a nonempty tag string validated under that release policy; `source_commit` is 40 lowercase hex characters; `asset_name` is one basename without slash, backslash, or dot-segment components; both digest members are SHA-256 digest objects. None of these members may be null inside a non-null release. + +`provenance: official` requires `assurance: artifact_bound`, a non-null executable digest, and a verified eligible release with the same digest. `custom` may be independently observed or declared; the assurance field is mandatory and MUST be displayed alongside it. A publisher saying it customized code does not prove those bytes are installed. A custom classification requires the signed custom declaration or a retained custom-build appraisal; absence from the verifier's known release list alone means unknown, not custom. `fingerprint_only` MUST have null executable digest/release and MUST NOT be rendered as official. It records a provider fingerprint comparison, not a stronger claim. An artifact-bound custom build has a non-null independently bound digest and null official release. All other declared builds have null artifact digest/release and `coverage: declaration_only`. + +A non-null `provider_files_hash` requires `checks.host_service_binding.outcome: pass` and `checks.active_version.outcome: pass`, plus a Fastly binding with non-null service ID, version and staging flag. Retained provider evidence MUST attribute the hash to that exact host-authorized service/version/environment, observed within the assessment interval. A publisher-supplied hash or a hash from an unattributed package cannot satisfy this rule. These checks establish context, not selected-executable binding or official provenance. Consumers reject a violated cross-field invariant as `malformed`. + +Two built-in appraisal contracts are defined: + +| Policy ID | Version 1 acceptance condition | +| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `publisher-declaration-v1` | Authorized enrollment; fresh evidence; exact authorized key/binding; valid configuration identity projection; explicit build declaration. Host-service and installed-artifact checks may be not assessed; the result must remain visibly self-declared | +| `fastly-official-deployment-v1` | Qualified Fastly active production service/version and host binding; artifact-bound official eligible executable; authorized host/key and structural projection-consistency checks pass. Configuration remains publisher-declared as scoped in the [parent PA-SNAPSHOT](2026-11-04-publisher-attestation-design.md#pa-snapshot-commit-only-to-a-defined-public-projection) | + +A verifier may add its own named policy, with retained policy digest, explicit check requirements, and consumer opt-in. A custom policy is not interchangeable with either built-in policy. No policy here certifies consent behavior, module safety, the truth of the full configuration, or outermost traffic placement. Additional profiles require their own reviewed specification, qualification, and negative tests before consumers enable them. + +### PA-STATUS: signed withdrawal and key status + +A verifier publishes a status object for a requested assessment. Required fields are `schema: ts-publisher-status-v1`, `issuer`, `enrollment_id`, `assessment_id`, `binding_id`, `publisher_key_kid`, `sequence`, `assessment_status`, `enrollment_status`, `publisher_key_status`, `reason_codes`, `issued_at`, `expires_at`, and empty `extensions`. + +Statuses are `current`/`withdrawn` for the assessment, `active`/`withdrawn` for enrollment, and `active`/`compromised`/`retired` for the publisher key. `sequence` is a positive integer per enrollment, durably persisted by the verifier. It advances only when the enrollment's recorded status state changes: an assessment or enrollment withdrawal, a publisher-key status change, or an authorization-generation change. A status reissued or reused while that state is unchanged carries the current sequence, so concurrently current assessments in one enrollment, such as both versions during a rolling deployment, share it. Withdrawal and compromise are terminal for their identifier. Re-enrollment uses new identifiers; an expired assessment is not extended by a status response. A current status means no withdrawal is recorded, not that a fresh provider observation occurred. Before each current-status issuance or reuse, recheck any applicable separate operator authorization, enrollment, publisher key, assessment, and verifier signing-key validity at the current time. Its expiry is no later than the earliest of those authorization/assessment expiries and issued_at+60; a still-valid signature cannot extend an expired operator delegation. On operator-record expiry/withdrawal, stop current-status issuance and positive assessment publication, mark affected enrollment authorization withdrawn, and advance durable generation/sequence. Time passing across an expiry is a denial condition even if no event has yet updated the generation. + +Status MUST satisfy `issued_at < expires_at <= issued_at + 60`. Consumers persist the highest seen sequence per verifier/enrollment, accept an equal sequence, and reject lower sequences. A lower sequence means the status predates a recorded state change, so a superseded `current` status for another assessment in the enrollment is correctly rejected. A fresh consumer may still accept an older signed status within its bounded lifetime; no instantaneous revocation is promised. Compromised-key status affects all assessments for that key in that enrollment; known cross-enrollment reuse triggers investigation and withdrawal of each affected enrollment. Status history and assessment expiry remain independent. + +## Enrollment and independent trust bootstrap + +### PA-ENROLLMENT: authorize before endorsing + +The reference verifier accepts enrollment only through an authenticated operator workflow, not an anonymous public URL submission that automatically grants trust. Required private enrollment input is the full authorized tuple from PA-IDENTITY, publisher contact/recovery authorization, public key and validity, and selected policy. Provider observations additionally require an existing Fastly service ID, intended host mapping, and narrowly scoped provider credentials. The declaration profile can be satisfied without provider credentials or release acquisition; when no provider observation is collected, provider checks are not assessed. An optional fingerprint observation requires independent provider credentials and the host/service/version checks above, without upgrading declaration acceptance to official assurance. A Fastly service ID remains part of the operator-declared enrolled tuple; Axum declaration bindings may use null service identity in production, staging, or development as permitted by PA-BINDING. No signing private key is submitted to a verifier. + +The authenticated enrollment account MUST have a verifier-maintained authorization record permitting any non-null `operator_id` it submits. Null means publisher self-operation; the publisher host/key authorization supplies the finite authority interval and no separate operator identity is asserted. That record binds account identity, the exact canonical operator identifier, permitted publisher/deployment scope, authorization method, approver or delegating authority, evidence digest, validity interval, and withdrawal state. The default version 1 operator-control method, `operator-dns-control-v1`, is a fresh DNS proof at `_ts-operator.` with value `ts-operator-v1=`, using the same exact identifier, publisher/deployment/key scope, verifier issuer, nonce, and ten-minute deadline as the publisher challenge. The host is parsed from the authorized HTTPS operator identifier under PA-ROUTING; the verifier performs no arbitrary URL fetch. Operator DNS control grants technical authority for that identifier/scope, not a legal relationship. A documented preapproved association or delegation may be a separately named consumer-opted-in method; a self-submitted URL, publisher DNS proof, key possession, or an authenticated login alone does not establish that association. Do not fetch an arbitrary operator URL to manufacture proof. If the record is absent, expired, outside scope, or withdrawn, fail enrollment with `operator_unauthorized` before any positive assessment. Retain and recheck the authorization record on renewal, recovery, and assessment publication. A legitimate operator-identifier change, including switching between self-operation and a separate operator, requires new authorization/binding. An old publisher-key signature alone cannot authorize a third-party operator. Prefixed DNS owner names must fit DNS length limits; unrepresentable challenge names fail enrollment explicitly. + +The verifier MUST also establish DNS control for the exact host and proof of possession of the exact key, rather than treating either as sufficient alone. A parent publisher domain is descriptive; it does not authorize arbitrary subdomains. Every host is enrolled explicitly. Neither a wildcard nor a string suffix check grants enrollment. + +The verifier creates a single-use enrollment challenge: a closed JSON object with `schema: ts-publisher-enrollment-challenge-v1`, `issuer`, `host`, `publisher_id`, `operator_id`, `deployment_id`, `provider`, `service_id`, `environment`, `publisher_key_kid`, random 32-byte base64url `nonce`, and `expires_at` at most ten minutes after creation. The operator publishes `ts-publisher-v1=` as a TXT value at `_ts-attestation.`. The verifier retains the exact challenge and hash, checks that value before its deadline using a documented trusted resolver, and does not accept unrelated existing tokens. A TXT record split into DNS character strings is joined within that one record; separate records are never concatenated. + +The verifier then fetches fresh HTTPS publisher evidence and verifies it with the proposed key, matches the enrolled tuple, and corroborates provider host/service ownership and production version where the chosen policy requires them. Only after these steps may it issue an enrollment ID and assessment. DNS proves technical control under the resolver trust model, not legal ownership or that all requests use Trusted Server. DNSSEC validation status is retained; absence does not become a false DNSSEC claim. The operator may remove the enrollment TXT value after success. An explicit loopback development fixture substitutes a manually pinned host/key authorization for DNS and uses a separate test trust configuration; its environment is development, it cannot produce the production profile, and its objects MUST NOT be accepted by production trust configuration. + +Enrollment expires after at most 30 days and requires new DNS and key-possession challenges to renew. This is deliberate fresh-control proof, not a promise of zero DNS operations. Operator tooling SHOULD automate challenge publication, propagation checks, retry within the deadline, cleanup, and renewal scheduling using publisher-controlled DNS credentials; registries receive no DNS write credentials. For `operator-dns-control-v1`, operator authorization expires no later than 30 days after successful proof and no later than the publisher enrollment; a shorter registry policy may apply. Each publisher/deployment/key scope needs a fresh challenge at renewal, so multi-publisher operators incur per-scope DNS work. Separately approved delegation methods must state their own finite maximum lifetime. Persistent issuer/key/scope authorization remains the explicit task-force alternative for reducing that burden; it requires separate revocation rules. Propagation failure leaves the existing unexpired authorization unchanged and cannot silently extend it. A new key requires new proof and enrollment authorization; possession of an old key alone cannot authorize recovery. Production/staging, host, publisher/operator, deployment ID, or service changes require explicit enrollment review. A new service version within the enrolled service requires a new assessment/binding, not automatically new DNS proof. Suspected DNS/host ownership changes suspend renewal until reauthorization. + +### PA-TRUST: discovery is not authority + +Consumer trust configuration supplies verifier ID, pinned public keys and validity, permitted policies/methods, acceptable releases, expected host/environment, observation age, and status requirements. The publisher's bounded `verifiers` discovery list is only an untrusted hint; a consumer queries only issuer bases it independently trusts. Unknown issuers, self-provided trust roots, unapproved policies, and additional untrusted endorsements cannot turn rejection into acceptance. + +The first consumer policy accepts one independently configured verifier; multiple-verifier support means evaluating each signed assessment independently. A consumer may require a threshold of distinct configured issuers whose accepted assessments match the same binding ID. Repeated keys/objects from one issuer count once. This is not evidence that organizations are operationally independent. There is no protocol-wide majority vote or mandatory registry. + +Trust-anchor rotation occurs through an authenticated consumer configuration update with an overlap period. A new root published solely in an untrusted assessment is not accepted. Verifiers retain historical public keys for audit verification. Compromise of a verifier key requires consumer trust withdrawal and reissuance through trusted recovery, not a status response signed only by that compromised key. + +## Collection, freshness, and monitoring + +### PA-COLLECTION: deterministic independent assessment + +For each assessment, the verifier performs these steps under an operation ID and a total 60-second collection deadline. Provider/release steps apply only when required by the selected policy or explicitly requested as additional observations. When no additional provider observation is requested, the declaration profile skips provider/release steps and records those checks as `not_assessed`; it still validates enrollment, evidence, actual descriptor/projection consistency, clock, and key possession. Optional provider observations must satisfy their contextual evidence requirements and never upgrade declaration acceptance to official assurance. Public production Axum uses declaration enrollment with real DNS/TLS; only loopback fixtures use the isolated development exception: + +1. Load an active enrolled tuple, trusted publisher key, and appraisal policy; load provider credentials and authenticated release eligibility policy only when the selected collection requires them. Checking current enrollment state is a new observation; the retained original DNS proof has its own historical timestamp and 30-day authorization deadline and is not misrepresented as a new DNS lookup. +2. Read provider host/service mapping, production active version, package identity and required resource links without reading the app-config payload solely for the identity projection. Record retrieval timestamps and retained response digests privately. +3. Fetch fresh evidence with a new unpredictable nonce over authenticated HTTPS to the expected host. Verify signature, clock, enrolled key, host, environment, descriptor/projection hashes, and all tuple values. +4. Compare reported service/version with independently observed state. Never use a report's service ID as authorization to query another service. +5. Apply the qualified selected-executable binding method, if available. Verify retained official release bytes and eligibility; classify the outcome without upgrading a fingerprint match into artifact binding. +6. Repeat provider version/host observations and, when needed, a fresh evidence challenge to detect declared-identity changes. On a detected race, discard the collection and make at most one fresh attempt within a new bounded operation. Never combine old/new observations into one successful interval. +7. Calculate results under the named policy; sign an assessment referencing exact evidence and policy digests. Persist the object and evidence before advertising success. + +No write or deployment is necessary for collection. Missing credentials, 403/429, outage, incomplete audit pages, malformed provider responses, or unavailable release evidence produce unavailable/indeterminate results, not a successful downgraded official assessment. A verifier may separately issue a clearly named declaration assessment after its own required checks; that is a different result, not continuation of the failed policy. + +### PA-TIME: bounded acceptance + +Evidence lifetime is at most 60 seconds. Verifier assessment issuance MUST occur within 60 seconds after `observed_until`. An assessment MUST satisfy `observed_from <= observed_until <= issued_at < expires_at <= observed_from + 900`. Its expiry is also no later than publisher-key, enrollment, verifier-signing-key, or any applicable separate operator-authorization expiry; self-operation uses the finite publisher enrollment authority. The verifier computes that minimum at commit/publication, not just when collection begins. A non-null separate operator claim with no independently established finite validity interval cannot authorize a positive assessment. Old observations cannot receive a new 15-minute lease by re-signing them. + +Consumers require `issued_at <= now + 30`, unexpired evidence/assessment and any explicitly required status, and `observed_until <= issued_at`. Clock skew allowance applies to future issuance and not-before checks; it never extends an expiry. A consumer may require a shorter observation age or lifetime. All interval and cross-object relationships are validated even when signatures are correct. Missing/unreliable runtime time is endpoint 503; verifier clock failure stops issuance; consumer clock failure stops current-assurance acceptance. + +The default verifier renews positive assessments every five minutes, subject to provider rate limits and a configured queue. For the monitored Fastly profile it polls provider version/host state at least every 60 seconds; a new signed projection is checked for consistency during renewal. V1 deliberately uses polling. Audit-log polling may trigger earlier rechecks only after event visibility/completeness is qualified; no push feed or complete audit history is assumed. If that monitoring interval cannot be maintained, stop representing the service as currently monitored and stop new positive official assessments until a complete collection succeeds. Previously issued assessments retain their explicitly bounded validity unless withdrawn. + +An ordinary deploy changes `service_version` in the binding. Fresh version-43 evidence cannot be combined with a version-42 assessment, even if that assessment has not expired. There is therefore an expected unendorsed interval after activation until a complete new-version assessment is published: under normal polling, up to the 60-second polling interval plus collection/publication time, and potentially longer during outages or queueing. This is a loss of endorsement, not necessarily website availability. Rolling deployments may expose both versions; consumers require an assessment matching whichever version answered and MUST NOT fall back to an old-version assessment. Publisher tooling SHOULD request prompt reassessment through the registry's authenticated enrollment-management interface after activation. Such a request is rate-limited and coalesced by enrollment, carries only the enrolled identifier and expected version, and is an untrusted scheduling hint: it never supplies observation evidence, selects arbitrary fetch targets, bypasses the complete collection, or guarantees zero gap. Exact management transport is registry-specific; baseline polling remains sufficient for protocol conformance. + +Observed changes to active version, authorized host mapping, declared identity projection, linked key context, or enrolled authorization trigger reassessment and withdrawal of known stale assessments. A confirmed key compromise also changes key status. API unavailability alone is not a declaration that the publisher key was compromised. Monitoring credentials being revoked prevents further positive collection. + +The v1 default consumer policy uses short assessment expiry alone and does not require a live registry status call. A previously obtained assessment and fresh publisher evidence may be checked without contacting the registry while their validity and independently configured trust policy hold. Registry unavailability prevents obtaining/renewing assessments but does not shorten an existing assessment to 60 seconds. Known withdrawal or compromise evidence is never ignored; without a live update the consumer may continue accepting until the existing assessment expires, at most the remaining bounded lifetime. + +Live-status checking is a separately configured stricter consumer mode, not a field selected by the publisher or an implicit v1 requirement. That mode requires a signed status no older than 60 seconds and denies acceptance on status failure. It introduces registry availability and query-observation dependencies: the registry may learn the checking client's network identity and publisher interest. The collector and consumer must document that choice and its privacy/load implications. Default expiry-only consumers cannot claim prompt revocation. Initial assessment discovery or renewal can still reveal a client's network identity and publisher interest; retaining a valid signed copy avoids a mandatory new registry query for each check, not all registry traffic. No per-bid registry lookup or auction/bid transport is specified here. + +## Consumer acceptance + +### PA-CONSUMER: acceptance algorithm + +A current publisher check MUST: + +1. Take expected host/environment, trusted issuers/keys, permitted policies/methods, and freshness/status settings from independent configuration. +2. Generate a fresh nonce and fetch publisher evidence. Strictly validate JWS and schema with an enrolled/endorsed publisher key; unsigned discovery may supply candidate bytes only. +3. Verify each candidate assessment with an allowed verifier key and exact message type, then validate policy, result, intervals, enrollment status, build assurance, release eligibility, and required check outcomes. +4. Require full descriptor and binding-ID equality between fresh evidence and assessment, including host, deployment ID, service/version/environment, projection, key material, and validity. +5. Under the default expiry-only mode, enforce assessment expiry and any independently known withdrawal/compromise. Only if the consumer explicitly requires live status, fetch it from the independently configured verifier base and match issuer, enrollment, assessment, binding, key, sequence, and timing; a live-status failure denies that stricter mode. A publisher cannot disable the consumer's configured checks. +6. Apply the consumer's distinct-issuer threshold to matching accepted assessments. Return structured reasons and the accepted scope. No acceptable assessment means unendorsed, not a registry-verified success. + +The assessment-only operation is explicitly historical/bounded-observation verification. Without fresh publisher evidence it cannot claim that the host responded now. Conversely, a fresh publisher response cannot refresh an old assessment. Consumers MUST NOT accept `result: satisfied` without evaluating the policy and concrete required fields. A known policy with `result: satisfied` and a failed/unavailable/not-assessed required check is internally contradictory and rejected as `malformed`; `policy_untrusted` is reserved for unknown/unaccepted issuer, policy, method or an unmet trust threshold. + +### PA-REFERENCE: tools and registry boundary + +The delivery includes a host-target reference verifier/collector and a pure verification library, with machine-readable results and offline historical verification. Planning must select its concrete crate/CLI placement without making runtime core depend on host HTTP, GitHub CLI subprocesses, or credentials. Prefer a small host-only component exposed through the existing operator CLI when dependency/target separation permits. Names of future commands are not frozen by this spec. + +The reference collector consumes operator-supplied enrollment and, only for provider-backed profiles, read-only provider credentials, retains evidence, and produces signed assessments/status. Its local state writes are atomic and restrictive. A production operator owns scheduling, authenticated administration, durable sequence allocation, backup, serving, abuse controls, and signer isolation. Advance the status sequence and persist the changed status state atomically before signing or publishing a status that reflects the change, following PA-RECOVERY below. A failed publication must not undo recorded withdrawal. After restart, never reset a sequence; if durable monotonic state cannot be recovered, stop current issuance and use authenticated recovery with a new enrollment identifier rather than risk rollback. A deployment of this reference component is not automatically an endorsed public registry. A full multi-tenant hosted registry and UI require a separate operational design. The named demo-registry follow-up below is a smaller illustrative deployment, not a production accreditation service. + +### PA-RECOVERY: fence stale collectors and restored state + +All registry modes, including expiry-only, must prevent new issuance from known withdrawn or stale restored authorization. The following production recovery design is registry-side qualification work. Each enrollment has an authoritative authorization generation in addition to its public status sequence. Changing operator authorization, enrollment/key status, accepted binding, or withdrawal increments that generation in a serialized durable transaction. A collector captures the generation when it starts and, immediately before committing a positive assessment, rechecks the generation, current authorization/key/enrollment validity, expiry deadlines, and policy. Commit uses compare-and-swap against that generation; an intervening withdrawal/change discards the candidate. Signing/outbox publication is likewise gated on the current generation, so a pre-withdrawal job cannot publish a new positive assessment or `current` status afterward. Already delivered objects retain only the bounded exposure explicitly described in PA-TIME. + +Local persistence alone does not prove a restored backup is current. A production registry offering the monitored/live-status contract MUST have a trusted recovery checkpoint outside the rollback domain of its ordinary backups. That checkpoint binds enrollment ID, highest allocated sequence, authorization generation, a digest of the authoritative authorization/withdrawal state, and a current signer fencing epoch. It is updated monotonically and acknowledged before any affected object is signed/released. A checkpoint digest covers authorization state rather than secrets or raw credential responses. A database transaction/outbox and checkpoint protocol must treat a partially acknowledged transition as pending and fail closed; it cannot sign using a guessed earlier state. A deployment unable to supply and qualify this checkpoint mechanism cannot offer the monitored production profile. + +Every restart or restore verifies local state against the trusted checkpoint and obtains the current exclusive signer epoch. A lower sequence/generation, inconsistent state digest, unknown checkpoint, stale epoch, or checkpoint outage fences signing, positive collection commits, and current-status publication with `state_recovery_required`. A restored process does not automatically overwrite the checkpoint or reset sequence state. Authorized recovery restores the latest corroborated state or withdraws the affected enrollment through trusted administration and re-enrolls with a new identifier; an old backup/key cannot authorize its own clean replacement. The checkpoint/signing owner must ensure a fenced old worker cannot continue publishing through another outbox or signer instance. Retained historical verification remains available without a current-assurance claim. + +Qualification must exercise restore of an internally valid backup that predates a withdrawal, crashes on both sides of checkpoint acknowledgment, duplicate/fenced signer instances, and a delayed collector completing after compromise. This registry-side contract specifies the required invariant; the concrete transaction/checkpoint backend and its failure proof belong to P3's bounded operational plan. The edge endpoint and local protocol fixtures do not implement that production backend. No distributed-store atomicity or safe backup restoration is assumed merely because local files use atomic rename. + +### PA-PUBLICATION: verifier read surfaces + +A minimal verifier publication service exposes these read-only paths under an independently configured HTTPS base: + +| GET path | Response | +| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- | +| `/v1/hosts/{canonical-host}/assessments?environment={environment}` | JSON with exactly `schema: ts-publisher-assessment-list-v1`, `host`, `environment`, and `assessments` (at most 16 compact JWS strings) | +| `/v1/assessments/{assessment_id}` | Exact assessment compact JWS, `application/jose` | +| `/v1/assessments/{assessment_id}/status` | Signed status compact JWS, `application/jose` | + +The host lookup makes assessment discovery possible without putting changing assessment IDs in publisher evidence. Its list is only a transport hint; each signed object is independently checked against the fresh binding and configured issuer. The list includes the newest unexpired assessment for each current binding/policy, suppresses withdrawn entries, and returns 409 if more than 16 matching entries require an explicit policy/assessment selection. Each compact JWS list item is explicitly permitted up to 32,768 ASCII bytes, overriding the ordinary claim-string limit; the entire decoded response including JSON framing is capped at 524,288 bytes. Return 409 for a list that exceeds either the entry-count or total-byte bound rather than silently omitting applicable assessments. Unknown IDs/hosts return 404, unavailable status returns 503, and no public route exposes admin operations. Public responses use `no-store`; no redirect or unsigned success status is accepted. Consumers may instead receive explicit assessment files/IDs from independent input. The reference consumer's provider abstraction supports lookup, assessment, and status retrieval; it cannot assume a publisher-advertised endpoint is trusted. Enrollment, withdrawal, trust updates, and signer operations require authenticated administration and auditable authorization. + +## Deliberate storage and access decision + +Assessments are stored and served by their issuing registry, not written into publisher config/secret stores. This deliberately avoids granting verifiers provider write/deploy permission and avoids making renewal a publisher-store write transaction. Publisher discovery lists only untrusted issuer identifiers; actual trust comes from consumer configuration. A registry must not gain write access merely to make its endorsement appear on the publisher endpoint. + +A Fastly read token is not a five-field disclosure channel. Depending on role/scope/resource permissions it can expose broader service and account configuration, including commercially sensitive settings. Service restrictions on `global:read` do not isolate non-service endpoints. Plaintext secret-store values are separately protected; do not claim that every secret is readable. The registry must inventory and disclose actual readable endpoints/resources and retention before enrollment. Removing the v1 full-config projection read reduces unnecessary collection, but does not narrow the provider credential's inherent access. + +## Governance, withdrawal and publisher exit + +Each verifier publishes its issuer/key identities, policy versions, assessment scope, suspension/withdrawal criteria, evidence-retention policy, administrative authorization roles, contact/appeal process, and consumer-mode availability expectations. No protocol participant gains authority over another verifier's assessments or the publisher's website. + +- Authorized publisher administrators may request exit for their own enrolled tuple through the registry's authenticated administration channel. Verify an enrolled credential or approved recovery/fresh DNS proof, record the request, stop renewal immediately, and withdraw that registry's enrollment/assessments. A compromised publisher key alone does not authorize a clean replacement identity. +- The verifier's explicitly authorized incident/policy administrators may stop issuance or withdraw their own assessments for confirmed mismatches, lost authorization, compromise, or policy breach. Keep reason/evidence and timestamps; distinguish unavailable observations from misconduct or key compromise. Technical emergencies may be acted on immediately, with notice and appeal afterward. +- Give the publisher an explanation and a documented review/correction route. Sensitive provider evidence is not automatically public. An appeal cannot extend expired objects or turn a failed check into success. Corrected deployments receive new assessments; terminally withdrawn identifiers are not resurrected. +- Under expiry-only consumption, withdrawal/exit stops new issuance but previously delivered assessments can be accepted until their bounded expiry. Optional live-status consumers can learn a withdrawal sooner, subject to their stated freshness/network limits. DNS token cleanup or persistent-record deletion is not immediate revocation: DNS caches/serve-stale, polling, and outstanding assessments matter. +- Withdrawal affects only that verifier's signed endorsement. It is not a global kill switch, does not disable site traffic, and does not revoke another independent verifier's opinion. Consumers retain their own trust/acceptance decisions. + +The task force and participating organizations must approve the governance and any registry service agreements before public production operation. This specification does not assign legal liability, create indemnities, or certify regulatory compliance; those questions remain explicit agreement/approval items rather than consequences of a valid signature. + +## Public publisher-key history + +The registry provides `GET /v1/hosts/{canonical-host}/key-history?environment={environment}` with an optional opaque `cursor` of 1–256 printable ASCII bytes. The JSON response is exactly `schema: ts-publisher-key-history-v1`, `host`, `environment`, `entries`, and `next_cursor` (null or a bounded printable-ASCII opaque string). Entries are closed objects containing an assessment compact JWS (at most 32 KiB) and an optional status compact JWS (at most 8 KiB, or null). Limit pages to 16 entries and 512 KiB including framing; page earlier when the byte bound is reached. Cursor values never name URLs. Unknown host/environment/cursor returns 404/400 as appropriate; responses use no-store. + +History retains issued assessment/key material for the documented retention window (90 days by default) and is ordered by issuance time plus assessment ID. The list itself is an untrusted transport hint; independently verify every object's issuer, message type, signature and exact host. Expired/withdrawn objects are historical evidence only and cannot authorize current publisher keys, extend expiry, bootstrap a new verifier trust root, or prove completeness across other registries. A null/expired historical status does not establish current revocation state. Verifier signing-key history is a separate issuer trust-management responsibility; archived public keys never become trusted automatically. + +## Stacked demo-registry follow-up + +P4 is a named follow-up stacked on the approved publisher/reference-verifier protocol. It demonstrates enrollment, declared/custom/fingerprint/official labels, assessment lookup, optional status, publisher-key history, and a consumer verification walkthrough. Its initial inputs are fictional/local fixtures; an official-shaped fixture is marked synthetic and cannot claim a qualified live Fastly deployment. The demo's UI/hosting plan and data sources require separate review. It is not an acceptance dependency for the edge endpoint and does not authorize deploying an operational public registry. + +```mermaid +sequenceDiagram + participant C as Consumer + participant P as Publisher endpoint + participant R as Trusted registry or retained assessment + C->>P: New random nonce + P-->>C: Fresh signed binding + C->>R: Obtain assessment, or use retained unexpired copy + R-->>C: Signed assessment + C->>C: Check trust, exact binding, policy and expiry + opt Consumer explicitly selects live status + C->>R: Fetch recent signed status + R-->>C: Status or unavailable + C->>C: Deny this stricter mode on unavailable/withdrawn status + end +``` + +## Registry verification matrix + +| Family | Required cases | +| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Enrollment/authorization | DNS reuse/expiry; key possession; unauthorized operator; self-operation; per-scope operator renewal and lifetime cap; recovery without old-key authority; canonical host across enrollment and index lookup | +| Collection/network | Qualified provider/release positive and negative cases; wrong service/version/staging; non-null hash without successful host/version checks; redirects/SNI mismatch; DNS rebinding; nonpublic addresses; proxy/token leakage; response bounds/deadlines/retries/429; no report-selected resource lookup | +| Assessment semantics | Exact binding; unsupported policy/method; satisfied with failed/missing required check is malformed; reversed intervals; oldest-observation expiry; full-size embedded JWS; declared/fingerprint/artifact-bound distinctions; official-shaped unqualified rejection | +| Consumer | Multiple issuers and duplicates; exact fresh-evidence binding match; compromised/withdrawn keys and enrollment; expiry-only outage tolerance; optional-live outage denial; sequence rollback; equal-sequence statuses for concurrently current assessments; ordinary version activation gap and rolling-version mismatch | +| Operations/recovery | Poll/renewal outage; reassessment hint abuse/coalescing; publication failure; retained-state restart; stale checkpoint/backup mismatch; collector/signing race with withdrawal; operator expiry between collection and commit; assessment/status cap at authority expiry; current-status denial after expiry before any timer update | + +These tests qualify registry/reference-consumer behavior separately from the publisher runtime. Provider executable binding still requires the companion's independent qualification evidence. + +## Review log + +- **Split-contract review (Codex, independent security and contract review):** Checked consumer defaults, operator proof, governance, history and trust. Corrected the shared configuration-method identifier; no blocking contract issue remained after correction. No registry deployment or provider qualification was performed. +- **Cleanup review (Codex, independent contract review):** Checked contextual fingerprint evidence, deployment gaps, operator lifetime, rejection semantics and test ownership; corrected declaration-profile wording to permit optional provider observations. +- **Cleanup follow-up (Codex, independent contract review):** No remaining blocking consistency findings. Structural and signature fixtures pass; runtime and provider qualification remain unexecuted. +- **Final detailed review (Codex, independent security and protocol reviewers):** No blocking findings. Clarified that declaration collection omits provider checks only when no optional observation is requested; contextual fingerprints retain their narrower assurance. +- **Self-review (Claude Code, independent contract review):** No blocking findings. Per-issuance status sequences could make a consumer reject a valid reused status for one of two concurrently current assessments during a rolling deployment; the sequence now advances only on recorded status-state changes, and the consumer matrix covers equal sequences. diff --git a/docs/superpowers/specs/fixtures/publisher-attestation-v1-vectors.json b/docs/superpowers/specs/fixtures/publisher-attestation-v1-vectors.json new file mode 100644 index 000000000..85c05cd3a --- /dev/null +++ b/docs/superpowers/specs/fixtures/publisher-attestation-v1-vectors.json @@ -0,0 +1,1631 @@ +{ + "description": "Public documentation/interoperability vectors, not runtime implementation or provider qualification. Ephemeral independent publisher/verifier Ed25519 keys were generated once; only public JWKs and signatures are retained. No private seed is retained. All identities, service observations and policy inputs are fictional. Positive assessment is declaration-only, never official installed-code proof. Base positive is a production Axum declaration using dns-key-control-v1 in explicitly isolated synthetic protocol context. Optional fingerprint and official-shaped objects contain fictional methods/releases/digests; production_provider_qualification=false. No production provider method is qualified by these vectors.", + "encoding": "JWS signing input is ASCII protected_segment + dot + payload_segment. Verify those exact segments. JSON bytes use sorted keys and compact ASCII-compatible serialization; fixture values use the RFC 8785-compatible integer/ASCII subset. Digests of signed objects hash exact compact ASCII bytes.", + "validation_order": [ + "bounded strict JSON/JWS decode with duplicate rejection", + "protected header structural schema", + "expected message type and independently configured key", + "signature", + "payload structural schema", + "canonical encoding/hash/identity relationships", + "key/enrollment authorization, nonce and time", + "assessment policy/build/status/cross-object acceptance" + ], + "public_keys": { + "publisher": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + } + }, + "verifier": { + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "5PPEXQwd1jqtprv4Qy-v_mVrnzqTx7I8ue38olNdXzQ" + } + } + }, + "external_context": { + "now": 1793793600, + "expected_host": "news.example.com", + "expected_environment": "production", + "nonce": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8", + "nonce_outstanding": true, + "enrollment_active_until": 1793880000, + "expected_binding_id": "73f238cc7671c4c460c4642be75cf168303acebca1bcd4853fc8fc6d4d5deca4", + "trusted_publisher_kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "trusted_verifier": { + "issuer": "https://verifier.example.com/publisher-attestation", + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "not_before": 1793790000, + "not_after": 1793880000, + "allowed_policies": ["publisher-declaration-v1"], + "allowed_methods": [ + "dns-key-control-v1", + "publisher-evidence-jws-v1", + "not-assessed-v1", + "public-identity-projection-v1", + "publisher-custom-declaration-v1" + ], + "required_checks": [ + "host_authorization", + "key_possession", + "configuration" + ] + }, + "require_status": false, + "highest_status_sequence": 1, + "maximum_observation_age_seconds": 900, + "production_provider_qualification": false, + "operator_authorization": { + "operator_id": "https://operator.example.com/publisher-attestation", + "authenticated_account": "fixture-operator-account", + "authorization_record_active": true, + "source": "Synthetic independent exact operator DNS/account proof record; never inferred from publisher host DNS", + "not_before": 1793790000, + "not_after": 1793880000, + "operator_dns_account_proof_verified": true + }, + "durable_authorization_history_available": true, + "signer_fence_current": true, + "status_available": true, + "protocol_test_only": true, + "test_context": "Isolated synthetic protocol acceptance only; no real enrollment, operator proof, provider qualification or production authorization is claimed." + }, + "signed_objects": { + "evidence": { + "protected": { + "alg": "Ed25519", + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "typ": "ts-publisher-evidence+jws" + }, + "payload": { + "schema": "ts-publisher-evidence-v1", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "axum", + "service_id": null, + "service_version": null, + "staging": null + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "fbc9d4c8a8d08d380b7bb06391960f18d69379f820b7283ac88c16259261a36c" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "73f238cc7671c4c460c4642be75cf168303acebca1bcd4853fc8fc6d4d5deca4", + "nonce": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8", + "issued_at": 1793793595, + "expires_at": 1793793655, + "build_report": { + "declared_class": "custom", + "source_commit": null, + "package_version": null, + "target": null, + "variant": null + }, + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ", + "payload_segment": "eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiYXh1bSIsInNlcnZpY2VfaWQiOm51bGwsInNlcnZpY2VfdmVyc2lvbiI6bnVsbCwic3RhZ2luZyI6bnVsbH0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiI3M2YyMzhjYzc2NzFjNGM0NjBjNDY0MmJlNzVjZjE2ODMwM2FjZWJjYTFiY2Q0ODUzZmM4ZmM2ZDRkNWRlY2E0IiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ", + "signature_segment": "7ZNqODgm9ZBCkhrppahzNSN85VUP-sgQsVWAIvd4LWJqTjTEXgw4KxCmsmCnHQTiLIjilgsI3INPmH76Yfk1Cg", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ.eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiYXh1bSIsInNlcnZpY2VfaWQiOm51bGwsInNlcnZpY2VfdmVyc2lvbiI6bnVsbCwic3RhZ2luZyI6bnVsbH0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiI3M2YyMzhjYzc2NzFjNGM0NjBjNDY0MmJlNzVjZjE2ODMwM2FjZWJjYTFiY2Q0ODUzZmM4ZmM2ZDRkNWRlY2E0IiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ.7ZNqODgm9ZBCkhrppahzNSN85VUP-sgQsVWAIvd4LWJqTjTEXgw4KxCmsmCnHQTiLIjilgsI3INPmH76Yfk1Cg", + "compact_sha256": { + "algorithm": "sha256", + "value": "2b6a52e01a03f75aa2eb3d430682f19ea6eb10557220ad87397516abb3e192a7" + } + }, + "assessment": { + "protected": { + "alg": "Ed25519", + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "typ": "ts-publisher-assessment+jws" + }, + "payload": { + "schema": "ts-publisher-assessment-v1", + "issuer": "https://verifier.example.com/publisher-attestation", + "assessment_id": "33333333-3333-4333-8333-333333333333", + "enrollment_id": "44444444-4444-4444-8444-444444444444", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "axum", + "service_id": null, + "service_version": null, + "staging": null + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "fbc9d4c8a8d08d380b7bb06391960f18d69379f820b7283ac88c16259261a36c" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "73f238cc7671c4c460c4642be75cf168303acebca1bcd4853fc8fc6d4d5deca4", + "evidence_digest": { + "algorithm": "sha256", + "value": "2b6a52e01a03f75aa2eb3d430682f19ea6eb10557220ad87397516abb3e192a7" + }, + "observed_from": 1793793590, + "observed_until": 1793793598, + "issued_at": 1793793599, + "expires_at": 1793794200, + "policy": { + "id": "publisher-declaration-v1", + "version": 1, + "digest": { + "algorithm": "sha256", + "value": "80a0698b02357ec9192d62162d7f3e1d3ebd9d6c4e51311d09c0d23e17e507e7" + } + }, + "result": "satisfied", + "checks": { + "host_authorization": { + "outcome": "pass", + "method": "dns-key-control-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "key_possession": { + "outcome": "pass", + "method": "publisher-evidence-jws-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "host_service_binding": { + "outcome": "not_assessed", + "method": null, + "observed_at": null, + "evidence_digest": null + }, + "active_version": { + "outcome": "not_assessed", + "method": null, + "observed_at": null, + "evidence_digest": null + }, + "configuration": { + "outcome": "pass", + "method": "public-identity-projection-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + } + }, + "build": { + "provenance": "custom", + "assurance": "declared", + "method": "publisher-custom-declaration-v1", + "artifact_sha256": null, + "provider_files_hash": null, + "release": null, + "coverage": "declaration_only" + }, + "reason_codes": [], + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9", + "payload_segment": "eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJkbnMta2V5LWNvbnRyb2wtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5NDIwMCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ", + "signature_segment": "EzlwJVeeoldM49zZPJdolO1UGi6DEPfukzYdOjbx_kpUkaB6BZjoMRKfwZbX7f5Xm3m4uf8gl-HxRweqs3OaCg", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJkbnMta2V5LWNvbnRyb2wtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5NDIwMCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ.EzlwJVeeoldM49zZPJdolO1UGi6DEPfukzYdOjbx_kpUkaB6BZjoMRKfwZbX7f5Xm3m4uf8gl-HxRweqs3OaCg", + "compact_sha256": { + "algorithm": "sha256", + "value": "8ca676475cb6632764eeb49a9ab5ec412e906afda2fe9cea6ac98b4ece95297a" + } + }, + "status": { + "protected": { + "alg": "Ed25519", + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "typ": "ts-publisher-status+jws" + }, + "payload": { + "schema": "ts-publisher-status-v1", + "issuer": "https://verifier.example.com/publisher-attestation", + "enrollment_id": "44444444-4444-4444-8444-444444444444", + "assessment_id": "33333333-3333-4333-8333-333333333333", + "binding_id": "73f238cc7671c4c460c4642be75cf168303acebca1bcd4853fc8fc6d4d5deca4", + "publisher_key_kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "sequence": 1, + "assessment_status": "current", + "enrollment_status": "active", + "publisher_key_status": "active", + "reason_codes": [], + "issued_at": 1793793599, + "expires_at": 1793793659, + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1zdGF0dXMrandzIn0", + "payload_segment": "eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYXNzZXNzbWVudF9zdGF0dXMiOiJjdXJyZW50IiwiYmluZGluZ19pZCI6IjczZjIzOGNjNzY3MWM0YzQ2MGM0NjQyYmU3NWNmMTY4MzAzYWNlYmNhMWJjZDQ4NTNmYzhmYzZkNGQ1ZGVjYTQiLCJlbnJvbGxtZW50X2lkIjoiNDQ0NDQ0NDQtNDQ0NC00NDQ0LTg0NDQtNDQ0NDQ0NDQ0NDQ0IiwiZW5yb2xsbWVudF9zdGF0dXMiOiJhY3RpdmUiLCJleHBpcmVzX2F0IjoxNzkzNzkzNjU5LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk5LCJpc3N1ZXIiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9rZXlfa2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInB1Ymxpc2hlcl9rZXlfc3RhdHVzIjoiYWN0aXZlIiwicmVhc29uX2NvZGVzIjpbXSwic2NoZW1hIjoidHMtcHVibGlzaGVyLXN0YXR1cy12MSIsInNlcXVlbmNlIjoxfQ", + "signature_segment": "S517wIitH_cDlLZJ1O75zmGkp57hiIN4HfizdgghCGKoo-5Jur6zgeABhJurMPUXfrx_zohPXLdQfKd16UV5DQ", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1zdGF0dXMrandzIn0.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYXNzZXNzbWVudF9zdGF0dXMiOiJjdXJyZW50IiwiYmluZGluZ19pZCI6IjczZjIzOGNjNzY3MWM0YzQ2MGM0NjQyYmU3NWNmMTY4MzAzYWNlYmNhMWJjZDQ4NTNmYzhmYzZkNGQ1ZGVjYTQiLCJlbnJvbGxtZW50X2lkIjoiNDQ0NDQ0NDQtNDQ0NC00NDQ0LTg0NDQtNDQ0NDQ0NDQ0NDQ0IiwiZW5yb2xsbWVudF9zdGF0dXMiOiJhY3RpdmUiLCJleHBpcmVzX2F0IjoxNzkzNzkzNjU5LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk5LCJpc3N1ZXIiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9rZXlfa2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInB1Ymxpc2hlcl9rZXlfc3RhdHVzIjoiYWN0aXZlIiwicmVhc29uX2NvZGVzIjpbXSwic2NoZW1hIjoidHMtcHVibGlzaGVyLXN0YXR1cy12MSIsInNlcXVlbmNlIjoxfQ.S517wIitH_cDlLZJ1O75zmGkp57hiIN4HfizdgghCGKoo-5Jur6zgeABhJurMPUXfrx_zohPXLdQfKd16UV5DQ", + "compact_sha256": { + "algorithm": "sha256", + "value": "19f0f478120ad2d9460bd34667477d81a43856e9d9fb6620fca6130b08538d67" + } + }, + "self_operated_evidence": { + "protected": { + "alg": "Ed25519", + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "typ": "ts-publisher-evidence+jws" + }, + "payload": { + "schema": "ts-publisher-evidence-v1", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": null, + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "axum", + "service_id": null, + "service_version": null, + "staging": null + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "3faf0f8ae900832f9f22aded9e1657aa9c4f37e86a1e5efb9a9fb714982bfaa7" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": null, + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "58e95e08426f9568056ab257b9609b298c8fe8c840a33902b3df0c18816f3ca6", + "nonce": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8", + "issued_at": 1793793595, + "expires_at": 1793793655, + "build_report": { + "declared_class": "custom", + "source_commit": null, + "package_version": null, + "target": null, + "variant": null + }, + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ", + "payload_segment": "eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjNmYWYwZjhhZTkwMDgzMmY5ZjIyYWRlZDllMTY1N2FhOWM0ZjM3ZTg2YTFlNWVmYjlhOWZiNzE0OTgyYmZhYTcifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6bnVsbCwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOm51bGwsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiYXh1bSIsInNlcnZpY2VfaWQiOm51bGwsInNlcnZpY2VfdmVyc2lvbiI6bnVsbCwic3RhZ2luZyI6bnVsbH0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiI1OGU5NWUwODQyNmY5NTY4MDU2YWIyNTdiOTYwOWIyOThjOGZlOGM4NDBhMzM5MDJiM2RmMGMxODgxNmYzY2E2IiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ", + "signature_segment": "tXl8Zs8HwEoSS3ogUl_4HfEejQbhGGWT3_s6c8eDecqgGEtKKHfeGXwq0JP2OC1gzlvc3iWdlH80Q_P8WpeEBQ", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ.eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjNmYWYwZjhhZTkwMDgzMmY5ZjIyYWRlZDllMTY1N2FhOWM0ZjM3ZTg2YTFlNWVmYjlhOWZiNzE0OTgyYmZhYTcifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6bnVsbCwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOm51bGwsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiYXh1bSIsInNlcnZpY2VfaWQiOm51bGwsInNlcnZpY2VfdmVyc2lvbiI6bnVsbCwic3RhZ2luZyI6bnVsbH0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiI1OGU5NWUwODQyNmY5NTY4MDU2YWIyNTdiOTYwOWIyOThjOGZlOGM4NDBhMzM5MDJiM2RmMGMxODgxNmYzY2E2IiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ.tXl8Zs8HwEoSS3ogUl_4HfEejQbhGGWT3_s6c8eDecqgGEtKKHfeGXwq0JP2OC1gzlvc3iWdlH80Q_P8WpeEBQ", + "compact_sha256": { + "algorithm": "sha256", + "value": "395b4d1fdcf900eac49686b9fb0fd5f7f5ce2a7785673a9d3e13a208e53acc45" + } + }, + "assessment_required_check_failed": { + "protected": { + "alg": "Ed25519", + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "typ": "ts-publisher-assessment+jws" + }, + "payload": { + "schema": "ts-publisher-assessment-v1", + "issuer": "https://verifier.example.com/publisher-attestation", + "assessment_id": "33333333-3333-4333-8333-333333333333", + "enrollment_id": "44444444-4444-4444-8444-444444444444", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "axum", + "service_id": null, + "service_version": null, + "staging": null + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "fbc9d4c8a8d08d380b7bb06391960f18d69379f820b7283ac88c16259261a36c" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "73f238cc7671c4c460c4642be75cf168303acebca1bcd4853fc8fc6d4d5deca4", + "evidence_digest": { + "algorithm": "sha256", + "value": "2b6a52e01a03f75aa2eb3d430682f19ea6eb10557220ad87397516abb3e192a7" + }, + "observed_from": 1793793590, + "observed_until": 1793793598, + "issued_at": 1793793599, + "expires_at": 1793794200, + "policy": { + "id": "publisher-declaration-v1", + "version": 1, + "digest": { + "algorithm": "sha256", + "value": "80a0698b02357ec9192d62162d7f3e1d3ebd9d6c4e51311d09c0d23e17e507e7" + } + }, + "result": "satisfied", + "checks": { + "host_authorization": { + "outcome": "pass", + "method": "dns-key-control-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "key_possession": { + "outcome": "fail", + "method": "publisher-evidence-jws-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "host_service_binding": { + "outcome": "not_assessed", + "method": null, + "observed_at": null, + "evidence_digest": null + }, + "active_version": { + "outcome": "not_assessed", + "method": null, + "observed_at": null, + "evidence_digest": null + }, + "configuration": { + "outcome": "pass", + "method": "public-identity-projection-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + } + }, + "build": { + "provenance": "custom", + "assurance": "declared", + "method": "publisher-custom-declaration-v1", + "artifact_sha256": null, + "provider_files_hash": null, + "release": null, + "coverage": "declaration_only" + }, + "reason_codes": [], + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9", + "payload_segment": "eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJkbnMta2V5LWNvbnRyb2wtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoiZmFpbCJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5NDIwMCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ", + "signature_segment": "nSEAngs9wIk69LfTMvNpxYiZWYmzbn9X1fQrNP4KPAKq9Ao4rieWqGsVT8oE4vpKNjaSri07xjvlBeWrrwUXBg", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJkbnMta2V5LWNvbnRyb2wtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoiZmFpbCJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5NDIwMCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ.nSEAngs9wIk69LfTMvNpxYiZWYmzbn9X1fQrNP4KPAKq9Ao4rieWqGsVT8oE4vpKNjaSri07xjvlBeWrrwUXBg", + "compact_sha256": { + "algorithm": "sha256", + "value": "1a0c4fa7a2e5d2e054612e6fe38379b32d56bcfee76dab24e710807f228b54cf" + } + }, + "assessment_reversed_time": { + "protected": { + "alg": "Ed25519", + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "typ": "ts-publisher-assessment+jws" + }, + "payload": { + "schema": "ts-publisher-assessment-v1", + "issuer": "https://verifier.example.com/publisher-attestation", + "assessment_id": "33333333-3333-4333-8333-333333333333", + "enrollment_id": "44444444-4444-4444-8444-444444444444", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "axum", + "service_id": null, + "service_version": null, + "staging": null + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "fbc9d4c8a8d08d380b7bb06391960f18d69379f820b7283ac88c16259261a36c" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "73f238cc7671c4c460c4642be75cf168303acebca1bcd4853fc8fc6d4d5deca4", + "evidence_digest": { + "algorithm": "sha256", + "value": "2b6a52e01a03f75aa2eb3d430682f19ea6eb10557220ad87397516abb3e192a7" + }, + "observed_from": 1793793590, + "observed_until": 1793793598, + "issued_at": 1793793599, + "expires_at": 1793793598, + "policy": { + "id": "publisher-declaration-v1", + "version": 1, + "digest": { + "algorithm": "sha256", + "value": "80a0698b02357ec9192d62162d7f3e1d3ebd9d6c4e51311d09c0d23e17e507e7" + } + }, + "result": "satisfied", + "checks": { + "host_authorization": { + "outcome": "pass", + "method": "dns-key-control-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "key_possession": { + "outcome": "pass", + "method": "publisher-evidence-jws-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "host_service_binding": { + "outcome": "not_assessed", + "method": null, + "observed_at": null, + "evidence_digest": null + }, + "active_version": { + "outcome": "not_assessed", + "method": null, + "observed_at": null, + "evidence_digest": null + }, + "configuration": { + "outcome": "pass", + "method": "public-identity-projection-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + } + }, + "build": { + "provenance": "custom", + "assurance": "declared", + "method": "publisher-custom-declaration-v1", + "artifact_sha256": null, + "provider_files_hash": null, + "release": null, + "coverage": "declaration_only" + }, + "reason_codes": [], + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9", + "payload_segment": "eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJkbnMta2V5LWNvbnRyb2wtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5MzU5OCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ", + "signature_segment": "vcf1JCJ-QyBhpVSuINapcuKspxkUw4SNLZ4Nf270PFT_wsXO2P0zXSi9TRIGwxuNjb920CgD9vdSkG6pkSZJAw", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJkbnMta2V5LWNvbnRyb2wtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5MzU5OCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ.vcf1JCJ-QyBhpVSuINapcuKspxkUw4SNLZ4Nf270PFT_wsXO2P0zXSi9TRIGwxuNjb920CgD9vdSkG6pkSZJAw", + "compact_sha256": { + "algorithm": "sha256", + "value": "e4e51d0737ca698294a1f0639584ccb57e8855ff4caf9b16887ac6bf3eaa0e75" + } + }, + "assessment_dev_fixture_method": { + "protected": { + "alg": "Ed25519", + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "typ": "ts-publisher-assessment+jws" + }, + "payload": { + "schema": "ts-publisher-assessment-v1", + "issuer": "https://verifier.example.com/publisher-attestation", + "assessment_id": "33333333-3333-4333-8333-333333333333", + "enrollment_id": "44444444-4444-4444-8444-444444444444", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "axum", + "service_id": null, + "service_version": null, + "staging": null + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "fbc9d4c8a8d08d380b7bb06391960f18d69379f820b7283ac88c16259261a36c" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "73f238cc7671c4c460c4642be75cf168303acebca1bcd4853fc8fc6d4d5deca4", + "evidence_digest": { + "algorithm": "sha256", + "value": "2b6a52e01a03f75aa2eb3d430682f19ea6eb10557220ad87397516abb3e192a7" + }, + "observed_from": 1793793590, + "observed_until": 1793793598, + "issued_at": 1793793599, + "expires_at": 1793794200, + "policy": { + "id": "publisher-declaration-v1", + "version": 1, + "digest": { + "algorithm": "sha256", + "value": "80a0698b02357ec9192d62162d7f3e1d3ebd9d6c4e51311d09c0d23e17e507e7" + } + }, + "result": "satisfied", + "checks": { + "host_authorization": { + "outcome": "pass", + "method": "fixture-enrollment-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "key_possession": { + "outcome": "pass", + "method": "publisher-evidence-jws-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "host_service_binding": { + "outcome": "not_assessed", + "method": null, + "observed_at": null, + "evidence_digest": null + }, + "active_version": { + "outcome": "not_assessed", + "method": null, + "observed_at": null, + "evidence_digest": null + }, + "configuration": { + "outcome": "pass", + "method": "public-identity-projection-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + } + }, + "build": { + "provenance": "custom", + "assurance": "declared", + "method": "publisher-custom-declaration-v1", + "artifact_sha256": null, + "provider_files_hash": null, + "release": null, + "coverage": "declaration_only" + }, + "reason_codes": [], + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9", + "payload_segment": "eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJmaXh0dXJlLWVucm9sbG1lbnQtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5NDIwMCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ", + "signature_segment": "beWKXBjyfufm91yIiIbKbcqtURzUzqhiem6gzvGYa2uGWRd0EsqEXgEu2bvSEUHihbw1AKZfuTOqEiJmAxiqBw", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJmaXh0dXJlLWVucm9sbG1lbnQtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5NDIwMCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ.beWKXBjyfufm91yIiIbKbcqtURzUzqhiem6gzvGYa2uGWRd0EsqEXgEu2bvSEUHihbw1AKZfuTOqEiJmAxiqBw", + "compact_sha256": { + "algorithm": "sha256", + "value": "f563182bc1a232e262a1ff7a9bb4047f5fa9c28a96e95f2a636af98a8b1efaf5" + } + }, + "fingerprint_evidence": { + "protected": { + "alg": "Ed25519", + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "typ": "ts-publisher-evidence+jws" + }, + "payload": { + "schema": "ts-publisher-evidence-v1", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "fastly", + "service_id": "fictional-service", + "service_version": 7, + "staging": false + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "fbc9d4c8a8d08d380b7bb06391960f18d69379f820b7283ac88c16259261a36c" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "f913a1f473b3ea168976301aeb4789d34dc82fb37d48d4a103b044148636ce6b", + "nonce": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8", + "issued_at": 1793793595, + "expires_at": 1793793655, + "build_report": { + "declared_class": "custom", + "source_commit": null, + "package_version": null, + "target": null, + "variant": null + }, + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ", + "payload_segment": "eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiZmFzdGx5Iiwic2VydmljZV9pZCI6ImZpY3Rpb25hbC1zZXJ2aWNlIiwic2VydmljZV92ZXJzaW9uIjo3LCJzdGFnaW5nIjpmYWxzZX0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiJmOTEzYTFmNDczYjNlYTE2ODk3NjMwMWFlYjQ3ODlkMzRkYzgyZmIzN2Q0OGQ0YTEwM2IwNDQxNDg2MzZjZTZiIiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ", + "signature_segment": "PE3Twya8QwIhMlLHU6WGYR0iB7PTGILjDqnzZrh8GEjCpPPplDiktJmE9orir6ivx32gwRT7Ljmm-dcg1-QfAA", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ.eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiZmFzdGx5Iiwic2VydmljZV9pZCI6ImZpY3Rpb25hbC1zZXJ2aWNlIiwic2VydmljZV92ZXJzaW9uIjo3LCJzdGFnaW5nIjpmYWxzZX0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiJmOTEzYTFmNDczYjNlYTE2ODk3NjMwMWFlYjQ3ODlkMzRkYzgyZmIzN2Q0OGQ0YTEwM2IwNDQxNDg2MzZjZTZiIiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ.PE3Twya8QwIhMlLHU6WGYR0iB7PTGILjDqnzZrh8GEjCpPPplDiktJmE9orir6ivx32gwRT7Ljmm-dcg1-QfAA", + "compact_sha256": { + "algorithm": "sha256", + "value": "e1540977547c895ad4b7e1211b62c24513e9dc9f74242593b6fe46fe4364f8f0" + } + }, + "assessment_fingerprint_only": { + "protected": { + "alg": "Ed25519", + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "typ": "ts-publisher-assessment+jws" + }, + "payload": { + "schema": "ts-publisher-assessment-v1", + "issuer": "https://verifier.example.com/publisher-attestation", + "assessment_id": "33333333-3333-4333-8333-333333333333", + "enrollment_id": "44444444-4444-4444-8444-444444444444", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "fastly", + "service_id": "fictional-service", + "service_version": 7, + "staging": false + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "fbc9d4c8a8d08d380b7bb06391960f18d69379f820b7283ac88c16259261a36c" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "f913a1f473b3ea168976301aeb4789d34dc82fb37d48d4a103b044148636ce6b", + "evidence_digest": { + "algorithm": "sha256", + "value": "e1540977547c895ad4b7e1211b62c24513e9dc9f74242593b6fe46fe4364f8f0" + }, + "observed_from": 1793793590, + "observed_until": 1793793598, + "issued_at": 1793793599, + "expires_at": 1793794200, + "policy": { + "id": "publisher-declaration-v1", + "version": 1, + "digest": { + "algorithm": "sha256", + "value": "80a0698b02357ec9192d62162d7f3e1d3ebd9d6c4e51311d09c0d23e17e507e7" + } + }, + "result": "satisfied", + "checks": { + "host_authorization": { + "outcome": "pass", + "method": "dns-key-control-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "key_possession": { + "outcome": "pass", + "method": "publisher-evidence-jws-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "host_service_binding": { + "outcome": "pass", + "method": "fictional-fastly-host-service-binding-v1", + "observed_at": 1793793598, + "evidence_digest": { + "algorithm": "sha256", + "value": "4ddbd57e2866943c6fe4cbe7ae411b9c1ffb378a1e8e71cd084447916982f4d6" + } + }, + "active_version": { + "outcome": "pass", + "method": "fictional-fastly-active-version-v1", + "observed_at": 1793793598, + "evidence_digest": { + "algorithm": "sha256", + "value": "dcfa49474ad800692952de5e764cd6771875a5f3b6d0ecebe554ff7e9ebc957f" + } + }, + "configuration": { + "outcome": "pass", + "method": "public-identity-projection-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + } + }, + "build": { + "provenance": "unknown", + "assurance": "fingerprint_only", + "method": "fictional-fastly-fingerprint-v1", + "artifact_sha256": null, + "provider_files_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", + "release": null, + "coverage": "selected_executable_only" + }, + "reason_codes": [], + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9", + "payload_segment": "eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImZhc3RseSIsInNlcnZpY2VfaWQiOiJmaWN0aW9uYWwtc2VydmljZSIsInNlcnZpY2VfdmVyc2lvbiI6Nywic3RhZ2luZyI6ZmFsc2V9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiZjkxM2ExZjQ3M2IzZWExNjg5NzYzMDFhZWI0Nzg5ZDM0ZGM4MmZiMzdkNDhkNGExMDNiMDQ0MTQ4NjM2Y2U2YiIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZmluZ2VycHJpbnRfb25seSIsImNvdmVyYWdlIjoic2VsZWN0ZWRfZXhlY3V0YWJsZV9vbmx5IiwibWV0aG9kIjoiZmljdGlvbmFsLWZhc3RseS1maW5nZXJwcmludC12MSIsInByb3ZlbmFuY2UiOiJ1bmtub3duIiwicHJvdmlkZXJfZmlsZXNfaGFzaCI6ImFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhIiwicmVsZWFzZSI6bnVsbH0sImNoZWNrcyI6eyJhY3RpdmVfdmVyc2lvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJkY2ZhNDk0NzRhZDgwMDY5Mjk1MmRlNWU3NjRjZDY3NzE4NzVhNWYzYjZkMGVjZWJlNTU0ZmY3ZTllYmM5NTdmIn0sIm1ldGhvZCI6ImZpY3Rpb25hbC1mYXN0bHktYWN0aXZlLXZlcnNpb24tdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5OCwib3V0Y29tZSI6InBhc3MifSwiY29uZmlndXJhdGlvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJjYzRjNDE4ZDRiODQ4NzdjZGFhMzgxN2QxMzg3NWRhZjlhZGZmMTVjMDM4ZDFmOWVlMmZiZmQ0ZTVkOWYxY2I1In0sIm1ldGhvZCI6InB1YmxpYy1pZGVudGl0eS1wcm9qZWN0aW9uLXYxIiwib2JzZXJ2ZWRfYXQiOjE3OTM3OTM1OTYsIm91dGNvbWUiOiJwYXNzIn0sImhvc3RfYXV0aG9yaXphdGlvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJjYzRjNDE4ZDRiODQ4NzdjZGFhMzgxN2QxMzg3NWRhZjlhZGZmMTVjMDM4ZDFmOWVlMmZiZmQ0ZTVkOWYxY2I1In0sIm1ldGhvZCI6ImRucy1rZXktY29udHJvbC12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X3NlcnZpY2VfYmluZGluZyI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI0ZGRiZDU3ZTI4NjY5NDNjNmZlNGNiZTdhZTQxMWI5YzFmZmIzNzhhMWU4ZTcxY2QwODQ0NDc5MTY5ODJmNGQ2In0sIm1ldGhvZCI6ImZpY3Rpb25hbC1mYXN0bHktaG9zdC1zZXJ2aWNlLWJpbmRpbmctdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5OCwib3V0Y29tZSI6InBhc3MifSwia2V5X3Bvc3Nlc3Npb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaXNoZXItZXZpZGVuY2UtandzLXYxIiwib2JzZXJ2ZWRfYXQiOjE3OTM3OTM1OTYsIm91dGNvbWUiOiJwYXNzIn19LCJlbnJvbGxtZW50X2lkIjoiNDQ0NDQ0NDQtNDQ0NC00NDQ0LTg0NDQtNDQ0NDQ0NDQ0NDQ0IiwiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZTE1NDA5Nzc1NDdjODk1YWQ0YjdlMTIxMWI2MmMyNDUxM2U5ZGM5Zjc0MjQyNTkzYjZmZTQ2ZmU0MzY0ZjhmMCJ9LCJleHBpcmVzX2F0IjoxNzkzNzk0MjAwLCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk5LCJpc3N1ZXIiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsIm9ic2VydmVkX2Zyb20iOjE3OTM3OTM1OTAsIm9ic2VydmVkX3VudGlsIjoxNzkzNzkzNTk4LCJwb2xpY3kiOnsiZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiODBhMDY5OGIwMjM1N2VjOTE5MmQ2MjE2MmQ3ZjNlMWQzZWJkOWQ2YzRlNTEzMTFkMDljMGQyM2UxN2U1MDdlNyJ9LCJpZCI6InB1Ymxpc2hlci1kZWNsYXJhdGlvbi12MSIsInZlcnNpb24iOjF9LCJyZWFzb25fY29kZXMiOltdLCJyZXN1bHQiOiJzYXRpc2ZpZWQiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYXNzZXNzbWVudC12MSJ9", + "signature_segment": "-qyqbj4yY-3GBZfseONyBtEa9vhFvdr-vkxPOyRMdphEMeFe1W0gCUBbFmyGYFAv4u1lSYleOS_uuO4J9xywDg", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImZhc3RseSIsInNlcnZpY2VfaWQiOiJmaWN0aW9uYWwtc2VydmljZSIsInNlcnZpY2VfdmVyc2lvbiI6Nywic3RhZ2luZyI6ZmFsc2V9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiZjkxM2ExZjQ3M2IzZWExNjg5NzYzMDFhZWI0Nzg5ZDM0ZGM4MmZiMzdkNDhkNGExMDNiMDQ0MTQ4NjM2Y2U2YiIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZmluZ2VycHJpbnRfb25seSIsImNvdmVyYWdlIjoic2VsZWN0ZWRfZXhlY3V0YWJsZV9vbmx5IiwibWV0aG9kIjoiZmljdGlvbmFsLWZhc3RseS1maW5nZXJwcmludC12MSIsInByb3ZlbmFuY2UiOiJ1bmtub3duIiwicHJvdmlkZXJfZmlsZXNfaGFzaCI6ImFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhIiwicmVsZWFzZSI6bnVsbH0sImNoZWNrcyI6eyJhY3RpdmVfdmVyc2lvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJkY2ZhNDk0NzRhZDgwMDY5Mjk1MmRlNWU3NjRjZDY3NzE4NzVhNWYzYjZkMGVjZWJlNTU0ZmY3ZTllYmM5NTdmIn0sIm1ldGhvZCI6ImZpY3Rpb25hbC1mYXN0bHktYWN0aXZlLXZlcnNpb24tdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5OCwib3V0Y29tZSI6InBhc3MifSwiY29uZmlndXJhdGlvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJjYzRjNDE4ZDRiODQ4NzdjZGFhMzgxN2QxMzg3NWRhZjlhZGZmMTVjMDM4ZDFmOWVlMmZiZmQ0ZTVkOWYxY2I1In0sIm1ldGhvZCI6InB1YmxpYy1pZGVudGl0eS1wcm9qZWN0aW9uLXYxIiwib2JzZXJ2ZWRfYXQiOjE3OTM3OTM1OTYsIm91dGNvbWUiOiJwYXNzIn0sImhvc3RfYXV0aG9yaXphdGlvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJjYzRjNDE4ZDRiODQ4NzdjZGFhMzgxN2QxMzg3NWRhZjlhZGZmMTVjMDM4ZDFmOWVlMmZiZmQ0ZTVkOWYxY2I1In0sIm1ldGhvZCI6ImRucy1rZXktY29udHJvbC12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X3NlcnZpY2VfYmluZGluZyI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI0ZGRiZDU3ZTI4NjY5NDNjNmZlNGNiZTdhZTQxMWI5YzFmZmIzNzhhMWU4ZTcxY2QwODQ0NDc5MTY5ODJmNGQ2In0sIm1ldGhvZCI6ImZpY3Rpb25hbC1mYXN0bHktaG9zdC1zZXJ2aWNlLWJpbmRpbmctdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5OCwib3V0Y29tZSI6InBhc3MifSwia2V5X3Bvc3Nlc3Npb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaXNoZXItZXZpZGVuY2UtandzLXYxIiwib2JzZXJ2ZWRfYXQiOjE3OTM3OTM1OTYsIm91dGNvbWUiOiJwYXNzIn19LCJlbnJvbGxtZW50X2lkIjoiNDQ0NDQ0NDQtNDQ0NC00NDQ0LTg0NDQtNDQ0NDQ0NDQ0NDQ0IiwiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZTE1NDA5Nzc1NDdjODk1YWQ0YjdlMTIxMWI2MmMyNDUxM2U5ZGM5Zjc0MjQyNTkzYjZmZTQ2ZmU0MzY0ZjhmMCJ9LCJleHBpcmVzX2F0IjoxNzkzNzk0MjAwLCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk5LCJpc3N1ZXIiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsIm9ic2VydmVkX2Zyb20iOjE3OTM3OTM1OTAsIm9ic2VydmVkX3VudGlsIjoxNzkzNzkzNTk4LCJwb2xpY3kiOnsiZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiODBhMDY5OGIwMjM1N2VjOTE5MmQ2MjE2MmQ3ZjNlMWQzZWJkOWQ2YzRlNTEzMTFkMDljMGQyM2UxN2U1MDdlNyJ9LCJpZCI6InB1Ymxpc2hlci1kZWNsYXJhdGlvbi12MSIsInZlcnNpb24iOjF9LCJyZWFzb25fY29kZXMiOltdLCJyZXN1bHQiOiJzYXRpc2ZpZWQiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYXNzZXNzbWVudC12MSJ9.-qyqbj4yY-3GBZfseONyBtEa9vhFvdr-vkxPOyRMdphEMeFe1W0gCUBbFmyGYFAv4u1lSYleOS_uuO4J9xywDg", + "compact_sha256": { + "algorithm": "sha256", + "value": "9ac6b33eb7d1d2def3c4ccae3f2c03b54effa88df7425fb45b0cd6bec7e1b5a2" + } + }, + "official_shaped_evidence": { + "protected": { + "alg": "Ed25519", + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "typ": "ts-publisher-evidence+jws" + }, + "payload": { + "schema": "ts-publisher-evidence-v1", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "fastly", + "service_id": "fictional-service", + "service_version": 7, + "staging": false + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "fbc9d4c8a8d08d380b7bb06391960f18d69379f820b7283ac88c16259261a36c" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "f913a1f473b3ea168976301aeb4789d34dc82fb37d48d4a103b044148636ce6b", + "nonce": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8", + "issued_at": 1793793595, + "expires_at": 1793793655, + "build_report": { + "declared_class": "custom", + "source_commit": null, + "package_version": null, + "target": null, + "variant": null + }, + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ", + "payload_segment": "eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiZmFzdGx5Iiwic2VydmljZV9pZCI6ImZpY3Rpb25hbC1zZXJ2aWNlIiwic2VydmljZV92ZXJzaW9uIjo3LCJzdGFnaW5nIjpmYWxzZX0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiJmOTEzYTFmNDczYjNlYTE2ODk3NjMwMWFlYjQ3ODlkMzRkYzgyZmIzN2Q0OGQ0YTEwM2IwNDQxNDg2MzZjZTZiIiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ", + "signature_segment": "PE3Twya8QwIhMlLHU6WGYR0iB7PTGILjDqnzZrh8GEjCpPPplDiktJmE9orir6ivx32gwRT7Ljmm-dcg1-QfAA", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ.eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiZmFzdGx5Iiwic2VydmljZV9pZCI6ImZpY3Rpb25hbC1zZXJ2aWNlIiwic2VydmljZV92ZXJzaW9uIjo3LCJzdGFnaW5nIjpmYWxzZX0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiJmOTEzYTFmNDczYjNlYTE2ODk3NjMwMWFlYjQ3ODlkMzRkYzgyZmIzN2Q0OGQ0YTEwM2IwNDQxNDg2MzZjZTZiIiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ.PE3Twya8QwIhMlLHU6WGYR0iB7PTGILjDqnzZrh8GEjCpPPplDiktJmE9orir6ivx32gwRT7Ljmm-dcg1-QfAA", + "compact_sha256": { + "algorithm": "sha256", + "value": "e1540977547c895ad4b7e1211b62c24513e9dc9f74242593b6fe46fe4364f8f0" + } + }, + "assessment_official_shaped_unqualified": { + "protected": { + "alg": "Ed25519", + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "typ": "ts-publisher-assessment+jws" + }, + "payload": { + "schema": "ts-publisher-assessment-v1", + "issuer": "https://verifier.example.com/publisher-attestation", + "assessment_id": "33333333-3333-4333-8333-333333333333", + "enrollment_id": "44444444-4444-4444-8444-444444444444", + "binding": { + "schema": "ts-publisher-binding-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "platform": { + "provider": "fastly", + "service_id": "fictional-service", + "service_version": 7, + "staging": false + }, + "attestation_key": { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + }, + "configuration": { + "schema": "ts-publisher-identity-v1", + "digest": { + "algorithm": "sha256", + "value": "fbc9d4c8a8d08d380b7bb06391960f18d69379f820b7283ac88c16259261a36c" + }, + "projection": { + "schema": "ts-publisher-identity-v1", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production" + } + }, + "extensions": {} + }, + "binding_id": "f913a1f473b3ea168976301aeb4789d34dc82fb37d48d4a103b044148636ce6b", + "evidence_digest": { + "algorithm": "sha256", + "value": "e1540977547c895ad4b7e1211b62c24513e9dc9f74242593b6fe46fe4364f8f0" + }, + "observed_from": 1793793590, + "observed_until": 1793793598, + "issued_at": 1793793599, + "expires_at": 1793794200, + "policy": { + "id": "fictional-official-profile-v1", + "version": 1, + "digest": { + "algorithm": "sha256", + "value": "80a0698b02357ec9192d62162d7f3e1d3ebd9d6c4e51311d09c0d23e17e507e7" + } + }, + "result": "satisfied", + "checks": { + "host_authorization": { + "outcome": "pass", + "method": "dns-key-control-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "key_possession": { + "outcome": "pass", + "method": "publisher-evidence-jws-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + }, + "host_service_binding": { + "outcome": "pass", + "method": "fictional-fastly-host-service-binding-v1", + "observed_at": 1793793598, + "evidence_digest": { + "algorithm": "sha256", + "value": "4ddbd57e2866943c6fe4cbe7ae411b9c1ffb378a1e8e71cd084447916982f4d6" + } + }, + "active_version": { + "outcome": "pass", + "method": "fictional-fastly-active-version-v1", + "observed_at": 1793793598, + "evidence_digest": { + "algorithm": "sha256", + "value": "dcfa49474ad800692952de5e764cd6771875a5f3b6d0ecebe554ff7e9ebc957f" + } + }, + "configuration": { + "outcome": "pass", + "method": "public-identity-projection-v1", + "observed_at": 1793793596, + "evidence_digest": { + "algorithm": "sha256", + "value": "cc4c418d4b84877cdaa3817d13875daf9adff15c038d1f9ee2fbfd4e5d9f1cb5" + } + } + }, + "build": { + "provenance": "official", + "assurance": "artifact_bound", + "method": "fictional-fastly-artifact-binding-v1", + "artifact_sha256": { + "algorithm": "sha256", + "value": "5931956b4a7ea501c6db03558808b7389137efa75c13477bd8a9b67e316fa9b2" + }, + "provider_files_hash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "release": { + "repository": "example/project", + "tag": "fictional-v1", + "source_commit": "cccccccccccccccccccccccccccccccccccccccc", + "asset_name": "fictional-release.wasm", + "artifact_sha256": { + "algorithm": "sha256", + "value": "5931956b4a7ea501c6db03558808b7389137efa75c13477bd8a9b67e316fa9b2" + }, + "verification_evidence_digest": { + "algorithm": "sha256", + "value": "251bdcb583f9c0943b87bd26e1d21bc010eb2069554532a55ba38f10751341c0" + } + }, + "coverage": "selected_executable_only" + }, + "reason_codes": [], + "extensions": {} + }, + "protected_segment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9", + "payload_segment": "eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImZhc3RseSIsInNlcnZpY2VfaWQiOiJmaWN0aW9uYWwtc2VydmljZSIsInNlcnZpY2VfdmVyc2lvbiI6Nywic3RhZ2luZyI6ZmFsc2V9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiZjkxM2ExZjQ3M2IzZWExNjg5NzYzMDFhZWI0Nzg5ZDM0ZGM4MmZiMzdkNDhkNGExMDNiMDQ0MTQ4NjM2Y2U2YiIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjU5MzE5NTZiNGE3ZWE1MDFjNmRiMDM1NTg4MDhiNzM4OTEzN2VmYTc1YzEzNDc3YmQ4YTliNjdlMzE2ZmE5YjIifSwiYXNzdXJhbmNlIjoiYXJ0aWZhY3RfYm91bmQiLCJjb3ZlcmFnZSI6InNlbGVjdGVkX2V4ZWN1dGFibGVfb25seSIsIm1ldGhvZCI6ImZpY3Rpb25hbC1mYXN0bHktYXJ0aWZhY3QtYmluZGluZy12MSIsInByb3ZlbmFuY2UiOiJvZmZpY2lhbCIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOiJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYiIsInJlbGVhc2UiOnsiYXJ0aWZhY3Rfc2hhMjU2Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNTkzMTk1NmI0YTdlYTUwMWM2ZGIwMzU1ODgwOGI3Mzg5MTM3ZWZhNzVjMTM0NzdiZDhhOWI2N2UzMTZmYTliMiJ9LCJhc3NldF9uYW1lIjoiZmljdGlvbmFsLXJlbGVhc2Uud2FzbSIsInJlcG9zaXRvcnkiOiJleGFtcGxlL3Byb2plY3QiLCJzb3VyY2VfY29tbWl0IjoiY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjYyIsInRhZyI6ImZpY3Rpb25hbC12MSIsInZlcmlmaWNhdGlvbl9ldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyNTFiZGNiNTgzZjljMDk0M2I4N2JkMjZlMWQyMWJjMDEwZWIyMDY5NTU0NTMyYTU1YmEzOGYxMDc1MTM0MWMwIn19fSwiY2hlY2tzIjp7ImFjdGl2ZV92ZXJzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImRjZmE0OTQ3NGFkODAwNjkyOTUyZGU1ZTc2NGNkNjc3MTg3NWE1ZjNiNmQwZWNlYmU1NTRmZjdlOWViYzk1N2YifSwibWV0aG9kIjoiZmljdGlvbmFsLWZhc3RseS1hY3RpdmUtdmVyc2lvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk4LCJvdXRjb21lIjoicGFzcyJ9LCJjb25maWd1cmF0aW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGljLWlkZW50aXR5LXByb2plY3Rpb24tdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9hdXRob3JpemF0aW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoiZG5zLWtleS1jb250cm9sLXYxIiwib2JzZXJ2ZWRfYXQiOjE3OTM3OTM1OTYsIm91dGNvbWUiOiJwYXNzIn0sImhvc3Rfc2VydmljZV9iaW5kaW5nIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjRkZGJkNTdlMjg2Njk0M2M2ZmU0Y2JlN2FlNDExYjljMWZmYjM3OGExZThlNzFjZDA4NDQ0NzkxNjk4MmY0ZDYifSwibWV0aG9kIjoiZmljdGlvbmFsLWZhc3RseS1ob3N0LXNlcnZpY2UtYmluZGluZy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk4LCJvdXRjb21lIjoicGFzcyJ9LCJrZXlfcG9zc2Vzc2lvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJjYzRjNDE4ZDRiODQ4NzdjZGFhMzgxN2QxMzg3NWRhZjlhZGZmMTVjMDM4ZDFmOWVlMmZiZmQ0ZTVkOWYxY2I1In0sIm1ldGhvZCI6InB1Ymxpc2hlci1ldmlkZW5jZS1qd3MtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifX0sImVucm9sbG1lbnRfaWQiOiI0NDQ0NDQ0NC00NDQ0LTQ0NDQtODQ0NC00NDQ0NDQ0NDQ0NDQiLCJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJlMTU0MDk3NzU0N2M4OTVhZDRiN2UxMjExYjYyYzI0NTEzZTlkYzlmNzQyNDI1OTNiNmZlNDZmZTQzNjRmOGYwIn0sImV4cGlyZXNfYXQiOjE3OTM3OTQyMDAsImV4dGVuc2lvbnMiOnt9LCJpc3N1ZWRfYXQiOjE3OTM3OTM1OTksImlzc3VlciI6Imh0dHBzOi8vdmVyaWZpZXIuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwib2JzZXJ2ZWRfZnJvbSI6MTc5Mzc5MzU5MCwib2JzZXJ2ZWRfdW50aWwiOjE3OTM3OTM1OTgsInBvbGljeSI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI4MGEwNjk4YjAyMzU3ZWM5MTkyZDYyMTYyZDdmM2UxZDNlYmQ5ZDZjNGU1MTMxMWQwOWMwZDIzZTE3ZTUwN2U3In0sImlkIjoiZmljdGlvbmFsLW9mZmljaWFsLXByb2ZpbGUtdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ", + "signature_segment": "SQK8yxbMl11688AXXs8usIWrLsDYN0Q3c7LvpxBQJvYB8cD8btK5TqWqCn7T95_PuVoVsuA4k72ZoNoyZgd6BQ", + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImZhc3RseSIsInNlcnZpY2VfaWQiOiJmaWN0aW9uYWwtc2VydmljZSIsInNlcnZpY2VfdmVyc2lvbiI6Nywic3RhZ2luZyI6ZmFsc2V9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiZjkxM2ExZjQ3M2IzZWExNjg5NzYzMDFhZWI0Nzg5ZDM0ZGM4MmZiMzdkNDhkNGExMDNiMDQ0MTQ4NjM2Y2U2YiIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjU5MzE5NTZiNGE3ZWE1MDFjNmRiMDM1NTg4MDhiNzM4OTEzN2VmYTc1YzEzNDc3YmQ4YTliNjdlMzE2ZmE5YjIifSwiYXNzdXJhbmNlIjoiYXJ0aWZhY3RfYm91bmQiLCJjb3ZlcmFnZSI6InNlbGVjdGVkX2V4ZWN1dGFibGVfb25seSIsIm1ldGhvZCI6ImZpY3Rpb25hbC1mYXN0bHktYXJ0aWZhY3QtYmluZGluZy12MSIsInByb3ZlbmFuY2UiOiJvZmZpY2lhbCIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOiJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYiIsInJlbGVhc2UiOnsiYXJ0aWZhY3Rfc2hhMjU2Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNTkzMTk1NmI0YTdlYTUwMWM2ZGIwMzU1ODgwOGI3Mzg5MTM3ZWZhNzVjMTM0NzdiZDhhOWI2N2UzMTZmYTliMiJ9LCJhc3NldF9uYW1lIjoiZmljdGlvbmFsLXJlbGVhc2Uud2FzbSIsInJlcG9zaXRvcnkiOiJleGFtcGxlL3Byb2plY3QiLCJzb3VyY2VfY29tbWl0IjoiY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjYyIsInRhZyI6ImZpY3Rpb25hbC12MSIsInZlcmlmaWNhdGlvbl9ldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyNTFiZGNiNTgzZjljMDk0M2I4N2JkMjZlMWQyMWJjMDEwZWIyMDY5NTU0NTMyYTU1YmEzOGYxMDc1MTM0MWMwIn19fSwiY2hlY2tzIjp7ImFjdGl2ZV92ZXJzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImRjZmE0OTQ3NGFkODAwNjkyOTUyZGU1ZTc2NGNkNjc3MTg3NWE1ZjNiNmQwZWNlYmU1NTRmZjdlOWViYzk1N2YifSwibWV0aG9kIjoiZmljdGlvbmFsLWZhc3RseS1hY3RpdmUtdmVyc2lvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk4LCJvdXRjb21lIjoicGFzcyJ9LCJjb25maWd1cmF0aW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGljLWlkZW50aXR5LXByb2plY3Rpb24tdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9hdXRob3JpemF0aW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoiZG5zLWtleS1jb250cm9sLXYxIiwib2JzZXJ2ZWRfYXQiOjE3OTM3OTM1OTYsIm91dGNvbWUiOiJwYXNzIn0sImhvc3Rfc2VydmljZV9iaW5kaW5nIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjRkZGJkNTdlMjg2Njk0M2M2ZmU0Y2JlN2FlNDExYjljMWZmYjM3OGExZThlNzFjZDA4NDQ0NzkxNjk4MmY0ZDYifSwibWV0aG9kIjoiZmljdGlvbmFsLWZhc3RseS1ob3N0LXNlcnZpY2UtYmluZGluZy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk4LCJvdXRjb21lIjoicGFzcyJ9LCJrZXlfcG9zc2Vzc2lvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJjYzRjNDE4ZDRiODQ4NzdjZGFhMzgxN2QxMzg3NWRhZjlhZGZmMTVjMDM4ZDFmOWVlMmZiZmQ0ZTVkOWYxY2I1In0sIm1ldGhvZCI6InB1Ymxpc2hlci1ldmlkZW5jZS1qd3MtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifX0sImVucm9sbG1lbnRfaWQiOiI0NDQ0NDQ0NC00NDQ0LTQ0NDQtODQ0NC00NDQ0NDQ0NDQ0NDQiLCJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJlMTU0MDk3NzU0N2M4OTVhZDRiN2UxMjExYjYyYzI0NTEzZTlkYzlmNzQyNDI1OTNiNmZlNDZmZTQzNjRmOGYwIn0sImV4cGlyZXNfYXQiOjE3OTM3OTQyMDAsImV4dGVuc2lvbnMiOnt9LCJpc3N1ZWRfYXQiOjE3OTM3OTM1OTksImlzc3VlciI6Imh0dHBzOi8vdmVyaWZpZXIuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwib2JzZXJ2ZWRfZnJvbSI6MTc5Mzc5MzU5MCwib2JzZXJ2ZWRfdW50aWwiOjE3OTM3OTM1OTgsInBvbGljeSI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI4MGEwNjk4YjAyMzU3ZWM5MTkyZDYyMTYyZDdmM2UxZDNlYmQ5ZDZjNGU1MTMxMWQwOWMwZDIzZTE3ZTUwN2U3In0sImlkIjoiZmljdGlvbmFsLW9mZmljaWFsLXByb2ZpbGUtdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ.SQK8yxbMl11688AXXs8usIWrLsDYN0Q3c7LvpxBQJvYB8cD8btK5TqWqCn7T95_PuVoVsuA4k72ZoNoyZgd6BQ", + "compact_sha256": { + "algorithm": "sha256", + "value": "8fb47cb87be4ecec8d40161072efe86118f1cf4df97f088f6c69be8fd8184146" + } + } + }, + "negative_encodings": { + "legacy_algorithm": { + "compact_jws": "eyJhbGciOiJFZERTQSIsImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJ0eXAiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UrandzIn0.eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiYXh1bSIsInNlcnZpY2VfaWQiOm51bGwsInNlcnZpY2VfdmVyc2lvbiI6bnVsbCwic3RhZ2luZyI6bnVsbH0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiI3M2YyMzhjYzc2NzFjNGM0NjBjNDY0MmJlNzVjZjE2ODMwM2FjZWJjYTFiY2Q0ODUzZmM4ZmM2ZDRkNWRlY2E0IiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ.H8MJQGovS34gUZyZdboM_vanquu8A3P5RnXVtlqekXBJ7gN4yeoPeLNzsH8KfASY8YeBIHmJ7mbTD7qoyN-LCA" + }, + "wrong_message_type": { + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1zdGF0dXMrandzIn0.eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiYXh1bSIsInNlcnZpY2VfaWQiOm51bGwsInNlcnZpY2VfdmVyc2lvbiI6bnVsbCwic3RhZ2luZyI6bnVsbH0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiI3M2YyMzhjYzc2NzFjNGM0NjBjNDY0MmJlNzVjZjE2ODMwM2FjZWJjYTFiY2Q0ODUzZmM4ZmM2ZDRkNWRlY2E0IiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ.4pXETKdTd1gv8YJmZkAGNP5mvYRhVkm5QDsVZNnNpa0gB3NAkUlfSGgvx67iTO9C7NIg2PU1zq1bFbAe0_poBA" + }, + "unknown_member": { + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ.eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiYXh1bSIsInNlcnZpY2VfaWQiOm51bGwsInNlcnZpY2VfdmVyc2lvbiI6bnVsbCwic3RhZ2luZyI6bnVsbH0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiI3M2YyMzhjYzc2NzFjNGM0NjBjNDY0MmJlNzVjZjE2ODMwM2FjZWJjYTFiY2Q0ODUzZmM4ZmM2ZDRkNWRlY2E0IiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEiLCJ1bmV4cGVjdGVkIjp0cnVlfQ.pMy1RTQt5Yb2Pu-qKyN8uBzUpjkJi54jcwffPZWMKtSXX9Xd3G6PUI4jwVSCo6gjZF4UKJzLtV2M9p6N15KVBQ" + }, + "signature_tamper": { + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInR5cCI6InRzLXB1Ymxpc2hlci1ldmlkZW5jZStqd3MifQ.eyJiaW5kaW5nIjp7ImF0dGVzdGF0aW9uX2tleSI6eyJqd2siOnsiY3J2IjoiRWQyNTUxOSIsImt0eSI6Ik9LUCIsIngiOiJXcEVhRzJPbjVvb0VEZkFYRlpRcEV1UGM4U2daUVhUOF90TFBpbThhOV9RIn0sImtpZCI6Ikludlc0THdUN2RCWlZlMmJSanpKdl9XQnpBcGdrTlpNNWIzai1PRXliYXciLCJub3RfYWZ0ZXIiOjE3OTM4ODAwMDAsIm5vdF9iZWZvcmUiOjE3OTM3OTAwMDB9LCJjb25maWd1cmF0aW9uIjp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZiYzlkNGM4YThkMDhkMzgwYjdiYjA2MzkxOTYwZjE4ZDY5Mzc5ZjgyMGI3MjgzYWM4OGMxNjI1OTI2MWEzNmMifSwicHJvamVjdGlvbiI6eyJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiaG9zdCI6Im5ld3MuZXhhbXBsZS5jb20iLCJvcGVyYXRvcl9pZCI6Imh0dHBzOi8vb3BlcmF0b3IuZXhhbXBsZS5jb20vcHVibGlzaGVyLWF0dGVzdGF0aW9uIiwicHVibGlzaGVyX2lkIjoiMTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTExIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWlkZW50aXR5LXYxIn0sInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJkZXBsb3ltZW50X2lkIjoiMjIyMjIyMjItMjIyMi00MjIyLTgyMjItMjIyMjIyMjIyMjIyIiwiZW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwiZXh0ZW5zaW9ucyI6e30sImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInBsYXRmb3JtIjp7InByb3ZpZGVyIjoiYXh1bSIsInNlcnZpY2VfaWQiOm51bGwsInNlcnZpY2VfdmVyc2lvbiI6bnVsbCwic3RhZ2luZyI6bnVsbH0sInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1iaW5kaW5nLXYxIn0sImJpbmRpbmdfaWQiOiI3M2YyMzhjYzc2NzFjNGM0NjBjNDY0MmJlNzVjZjE2ODMwM2FjZWJjYTFiY2Q0ODUzZmM4ZmM2ZDRkNWRlY2E0IiwiYnVpbGRfcmVwb3J0Ijp7ImRlY2xhcmVkX2NsYXNzIjoiY3VzdG9tIiwicGFja2FnZV92ZXJzaW9uIjpudWxsLCJzb3VyY2VfY29tbWl0IjpudWxsLCJ0YXJnZXQiOm51bGwsInZhcmlhbnQiOm51bGx9LCJleHBpcmVzX2F0IjoxNzkzNzkzNjU1LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk1LCJub25jZSI6IkFBRUNBd1FGQmdjSUNRb0xEQTBPRHhBUkVoTVVGUllYR0JrYUd4d2RIaDgiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItZXZpZGVuY2UtdjEifQ.7JNqODgm9ZBCkhrppahzNSN85VUP-sgQsVWAIvd4LWJqTjTEXgw4KxCmsmCnHQTiLIjilgsI3INPmH76Yfk1Cg" + }, + "fingerprint_without_active_version": { + "compact_jws": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImZhc3RseSIsInNlcnZpY2VfaWQiOiJmaWN0aW9uYWwtc2VydmljZSIsInNlcnZpY2VfdmVyc2lvbiI6Nywic3RhZ2luZyI6ZmFsc2V9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiZjkxM2ExZjQ3M2IzZWExNjg5NzYzMDFhZWI0Nzg5ZDM0ZGM4MmZiMzdkNDhkNGExMDNiMDQ0MTQ4NjM2Y2U2YiIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZmluZ2VycHJpbnRfb25seSIsImNvdmVyYWdlIjoic2VsZWN0ZWRfZXhlY3V0YWJsZV9vbmx5IiwibWV0aG9kIjoiZmljdGlvbmFsLWZhc3RseS1maW5nZXJwcmludC12MSIsInByb3ZlbmFuY2UiOiJ1bmtub3duIiwicHJvdmlkZXJfZmlsZXNfaGFzaCI6ImFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhIiwicmVsZWFzZSI6bnVsbH0sImNoZWNrcyI6eyJhY3RpdmVfdmVyc2lvbiI6eyJldmlkZW5jZV9kaWdlc3QiOm51bGwsIm1ldGhvZCI6bnVsbCwib2JzZXJ2ZWRfYXQiOm51bGwsIm91dGNvbWUiOiJub3RfYXNzZXNzZWQifSwiY29uZmlndXJhdGlvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJjYzRjNDE4ZDRiODQ4NzdjZGFhMzgxN2QxMzg3NWRhZjlhZGZmMTVjMDM4ZDFmOWVlMmZiZmQ0ZTVkOWYxY2I1In0sIm1ldGhvZCI6InB1YmxpYy1pZGVudGl0eS1wcm9qZWN0aW9uLXYxIiwib2JzZXJ2ZWRfYXQiOjE3OTM3OTM1OTYsIm91dGNvbWUiOiJwYXNzIn0sImhvc3RfYXV0aG9yaXphdGlvbiI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJjYzRjNDE4ZDRiODQ4NzdjZGFhMzgxN2QxMzg3NWRhZjlhZGZmMTVjMDM4ZDFmOWVlMmZiZmQ0ZTVkOWYxY2I1In0sIm1ldGhvZCI6ImRucy1rZXktY29udHJvbC12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X3NlcnZpY2VfYmluZGluZyI6eyJldmlkZW5jZV9kaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI0ZGRiZDU3ZTI4NjY5NDNjNmZlNGNiZTdhZTQxMWI5YzFmZmIzNzhhMWU4ZTcxY2QwODQ0NDc5MTY5ODJmNGQ2In0sIm1ldGhvZCI6ImZpY3Rpb25hbC1mYXN0bHktaG9zdC1zZXJ2aWNlLWJpbmRpbmctdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5OCwib3V0Y29tZSI6InBhc3MifSwia2V5X3Bvc3Nlc3Npb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaXNoZXItZXZpZGVuY2UtandzLXYxIiwib2JzZXJ2ZWRfYXQiOjE3OTM3OTM1OTYsIm91dGNvbWUiOiJwYXNzIn19LCJlbnJvbGxtZW50X2lkIjoiNDQ0NDQ0NDQtNDQ0NC00NDQ0LTg0NDQtNDQ0NDQ0NDQ0NDQ0IiwiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZTE1NDA5Nzc1NDdjODk1YWQ0YjdlMTIxMWI2MmMyNDUxM2U5ZGM5Zjc0MjQyNTkzYjZmZTQ2ZmU0MzY0ZjhmMCJ9LCJleHBpcmVzX2F0IjoxNzkzNzk0MjAwLCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk5LCJpc3N1ZXIiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsIm9ic2VydmVkX2Zyb20iOjE3OTM3OTM1OTAsIm9ic2VydmVkX3VudGlsIjoxNzkzNzkzNTk4LCJwb2xpY3kiOnsiZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiODBhMDY5OGIwMjM1N2VjOTE5MmQ2MjE2MmQ3ZjNlMWQzZWJkOWQ2YzRlNTEzMTFkMDljMGQyM2UxN2U1MDdlNyJ9LCJpZCI6InB1Ymxpc2hlci1kZWNsYXJhdGlvbi12MSIsInZlcnNpb24iOjF9LCJyZWFzb25fY29kZXMiOltdLCJyZXN1bHQiOiJzYXRpc2ZpZWQiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYXNzZXNzbWVudC12MSJ9.Ucq-7WhoLK-2Ab8rEgf1vs2MELRu9dBTbPT3H3XB3N8UPJA0DqvRCAIK5NrCErZa7mXsbPX3yUpDUO74mKY9CQ" + } + }, + "unsigned_objects": { + "key_discovery": { + "schema": "ts-publisher-key-discovery-v1", + "host": "news.example.com", + "keys": [ + { + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000 + } + ], + "verifiers": ["https://verifier.example.com/publisher-attestation"] + }, + "assessment_list": { + "schema": "ts-publisher-assessment-list-v1", + "host": "news.example.com", + "environment": "production", + "assessments": [ + "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJkbnMta2V5LWNvbnRyb2wtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5NDIwMCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ.EzlwJVeeoldM49zZPJdolO1UGi6DEPfukzYdOjbx_kpUkaB6BZjoMRKfwZbX7f5Xm3m4uf8gl-HxRweqs3OaCg" + ] + }, + "enrollment_challenge": { + "schema": "ts-publisher-enrollment-challenge-v1", + "issuer": "https://verifier.example.com/publisher-attestation", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": "https://operator.example.com/publisher-attestation", + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "provider": "axum", + "service_id": null, + "publisher_key_kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "nonce": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8", + "expires_at": 1793794200 + }, + "key_metadata": { + "schema": "ts-publisher-key-metadata-v1", + "kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "jwk": { + "kty": "OKP", + "crv": "Ed25519", + "x": "WpEaG2On5ooEDfAXFZQpEuPc8SgZQXT8_tLPim8a9_Q" + }, + "not_before": 1793790000, + "not_after": 1793880000, + "secret_name": "ts-publisher-example-key" + }, + "self_operated_enrollment_challenge": { + "schema": "ts-publisher-enrollment-challenge-v1", + "issuer": "https://verifier.example.com/publisher-attestation", + "host": "news.example.com", + "publisher_id": "11111111-1111-4111-8111-111111111111", + "operator_id": null, + "deployment_id": "22222222-2222-4222-8222-222222222222", + "environment": "production", + "provider": "axum", + "service_id": null, + "publisher_key_kid": "InvW4LwT7dBZVe2bRjzJv_WBzApgkNZM5b3j-OEybaw", + "nonce": "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8", + "expires_at": 1793794200 + }, + "key_history": { + "schema": "ts-publisher-key-history-v1", + "host": "news.example.com", + "environment": "production", + "entries": [ + { + "assessment": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1hc3Nlc3NtZW50K2p3cyJ9.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYmluZGluZyI6eyJhdHRlc3RhdGlvbl9rZXkiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoiV3BFYUcyT241b29FRGZBWEZaUXBFdVBjOFNnWlFYVDhfdExQaW04YTlfUSJ9LCJraWQiOiJJbnZXNEx3VDdkQlpWZTJiUmp6SnZfV0J6QXBna05aTTViM2otT0V5YmF3Iiwibm90X2FmdGVyIjoxNzkzODgwMDAwLCJub3RfYmVmb3JlIjoxNzkzNzkwMDAwfSwiY29uZmlndXJhdGlvbiI6eyJkaWdlc3QiOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmYmM5ZDRjOGE4ZDA4ZDM4MGI3YmIwNjM5MTk2MGYxOGQ2OTM3OWY4MjBiNzI4M2FjODhjMTYyNTkyNjFhMzZjIn0sInByb2plY3Rpb24iOnsiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImhvc3QiOiJuZXdzLmV4YW1wbGUuY29tIiwib3BlcmF0b3JfaWQiOiJodHRwczovL29wZXJhdG9yLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9pZCI6IjExMTExMTExLTExMTEtNDExMS04MTExLTExMTExMTExMTExMSIsInNjaGVtYSI6InRzLXB1Ymxpc2hlci1pZGVudGl0eS12MSJ9LCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItaWRlbnRpdHktdjEifSwiZGVwbG95bWVudF9pZCI6IjIyMjIyMjIyLTIyMjItNDIyMi04MjIyLTIyMjIyMjIyMjIyMiIsImVudmlyb25tZW50IjoicHJvZHVjdGlvbiIsImV4dGVuc2lvbnMiOnt9LCJob3N0IjoibmV3cy5leGFtcGxlLmNvbSIsIm9wZXJhdG9yX2lkIjoiaHR0cHM6Ly9vcGVyYXRvci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJwbGF0Zm9ybSI6eyJwcm92aWRlciI6ImF4dW0iLCJzZXJ2aWNlX2lkIjpudWxsLCJzZXJ2aWNlX3ZlcnNpb24iOm51bGwsInN0YWdpbmciOm51bGx9LCJwdWJsaXNoZXJfaWQiOiIxMTExMTExMS0xMTExLTQxMTEtODExMS0xMTExMTExMTExMTEiLCJzY2hlbWEiOiJ0cy1wdWJsaXNoZXItYmluZGluZy12MSJ9LCJiaW5kaW5nX2lkIjoiNzNmMjM4Y2M3NjcxYzRjNDYwYzQ2NDJiZTc1Y2YxNjgzMDNhY2ViY2ExYmNkNDg1M2ZjOGZjNmQ0ZDVkZWNhNCIsImJ1aWxkIjp7ImFydGlmYWN0X3NoYTI1NiI6bnVsbCwiYXNzdXJhbmNlIjoiZGVjbGFyZWQiLCJjb3ZlcmFnZSI6ImRlY2xhcmF0aW9uX29ubHkiLCJtZXRob2QiOiJwdWJsaXNoZXItY3VzdG9tLWRlY2xhcmF0aW9uLXYxIiwicHJvdmVuYW5jZSI6ImN1c3RvbSIsInByb3ZpZGVyX2ZpbGVzX2hhc2giOm51bGwsInJlbGVhc2UiOm51bGx9LCJjaGVja3MiOnsiYWN0aXZlX3ZlcnNpb24iOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImNvbmZpZ3VyYXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJwdWJsaWMtaWRlbnRpdHktcHJvamVjdGlvbi12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9LCJob3N0X2F1dGhvcml6YXRpb24iOnsiZXZpZGVuY2VfZGlnZXN0Ijp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiY2M0YzQxOGQ0Yjg0ODc3Y2RhYTM4MTdkMTM4NzVkYWY5YWRmZjE1YzAzOGQxZjllZTJmYmZkNGU1ZDlmMWNiNSJ9LCJtZXRob2QiOiJkbnMta2V5LWNvbnRyb2wtdjEiLCJvYnNlcnZlZF9hdCI6MTc5Mzc5MzU5Niwib3V0Y29tZSI6InBhc3MifSwiaG9zdF9zZXJ2aWNlX2JpbmRpbmciOnsiZXZpZGVuY2VfZGlnZXN0IjpudWxsLCJtZXRob2QiOm51bGwsIm9ic2VydmVkX2F0IjpudWxsLCJvdXRjb21lIjoibm90X2Fzc2Vzc2VkIn0sImtleV9wb3NzZXNzaW9uIjp7ImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjNGM0MThkNGI4NDg3N2NkYWEzODE3ZDEzODc1ZGFmOWFkZmYxNWMwMzhkMWY5ZWUyZmJmZDRlNWQ5ZjFjYjUifSwibWV0aG9kIjoicHVibGlzaGVyLWV2aWRlbmNlLWp3cy12MSIsIm9ic2VydmVkX2F0IjoxNzkzNzkzNTk2LCJvdXRjb21lIjoicGFzcyJ9fSwiZW5yb2xsbWVudF9pZCI6IjQ0NDQ0NDQ0LTQ0NDQtNDQ0NC04NDQ0LTQ0NDQ0NDQ0NDQ0NCIsImV2aWRlbmNlX2RpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJiNmE1MmUwMWEwM2Y3NWFhMmViM2Q0MzA2ODJmMTllYTZlYjEwNTU3MjIwYWQ4NzM5NzUxNmFiYjNlMTkyYTcifSwiZXhwaXJlc19hdCI6MTc5Mzc5NDIwMCwiZXh0ZW5zaW9ucyI6e30sImlzc3VlZF9hdCI6MTc5Mzc5MzU5OSwiaXNzdWVyIjoiaHR0cHM6Ly92ZXJpZmllci5leGFtcGxlLmNvbS9wdWJsaXNoZXItYXR0ZXN0YXRpb24iLCJvYnNlcnZlZF9mcm9tIjoxNzkzNzkzNTkwLCJvYnNlcnZlZF91bnRpbCI6MTc5Mzc5MzU5OCwicG9saWN5Ijp7ImRpZ2VzdCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjgwYTA2OThiMDIzNTdlYzkxOTJkNjIxNjJkN2YzZTFkM2ViZDlkNmM0ZTUxMzExZDA5YzBkMjNlMTdlNTA3ZTcifSwiaWQiOiJwdWJsaXNoZXItZGVjbGFyYXRpb24tdjEiLCJ2ZXJzaW9uIjoxfSwicmVhc29uX2NvZGVzIjpbXSwicmVzdWx0Ijoic2F0aXNmaWVkIiwic2NoZW1hIjoidHMtcHVibGlzaGVyLWFzc2Vzc21lbnQtdjEifQ.EzlwJVeeoldM49zZPJdolO1UGi6DEPfukzYdOjbx_kpUkaB6BZjoMRKfwZbX7f5Xm3m4uf8gl-HxRweqs3OaCg", + "status": "eyJhbGciOiJFZDI1NTE5Iiwia2lkIjoiMlRmRk81QkdtUnZQdVRBMzZ2dHBSN0VlUDRNX2o1MzVpYVFEb1FlNnM1RSIsInR5cCI6InRzLXB1Ymxpc2hlci1zdGF0dXMrandzIn0.eyJhc3Nlc3NtZW50X2lkIjoiMzMzMzMzMzMtMzMzMy00MzMzLTgzMzMtMzMzMzMzMzMzMzMzIiwiYXNzZXNzbWVudF9zdGF0dXMiOiJjdXJyZW50IiwiYmluZGluZ19pZCI6IjczZjIzOGNjNzY3MWM0YzQ2MGM0NjQyYmU3NWNmMTY4MzAzYWNlYmNhMWJjZDQ4NTNmYzhmYzZkNGQ1ZGVjYTQiLCJlbnJvbGxtZW50X2lkIjoiNDQ0NDQ0NDQtNDQ0NC00NDQ0LTg0NDQtNDQ0NDQ0NDQ0NDQ0IiwiZW5yb2xsbWVudF9zdGF0dXMiOiJhY3RpdmUiLCJleHBpcmVzX2F0IjoxNzkzNzkzNjU5LCJleHRlbnNpb25zIjp7fSwiaXNzdWVkX2F0IjoxNzkzNzkzNTk5LCJpc3N1ZXIiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUuY29tL3B1Ymxpc2hlci1hdHRlc3RhdGlvbiIsInB1Ymxpc2hlcl9rZXlfa2lkIjoiSW52VzRMd1Q3ZEJaVmUyYlJqekp2X1dCekFwZ2tOWk01YjNqLU9FeWJhdyIsInB1Ymxpc2hlcl9rZXlfc3RhdHVzIjoiYWN0aXZlIiwicmVhc29uX2NvZGVzIjpbXSwic2NoZW1hIjoidHMtcHVibGlzaGVyLXN0YXR1cy12MSIsInNlcXVlbmNlIjoxfQ.S517wIitH_cDlLZJ1O75zmGkp57hiIN4HfizdgghCGKoo-5Jur6zgeABhJurMPUXfrx_zohPXLdQfKd16UV5DQ" + } + ], + "next_cursor": null + } + }, + "enrollment_txt_value": "ts-publisher-v1=PhpSCB4Vgzr-BTjiRBl9VaZU_QktJKdB3Wir5VLSrr4", + "cases": [ + { + "id": "evidence-positive", + "signed_object": "evidence", + "context_overrides": {}, + "expected": { + "accept": true, + "scope": "self-declared publisher identity; no independent installed-executable or official-deployment claim" + } + }, + { + "id": "assessment-positive", + "signed_object": "assessment", + "context_overrides": {}, + "expected": { + "accept": true, + "scope": "self-declared publisher identity; no independent installed-executable or official-deployment claim" + } + }, + { + "id": "status-positive", + "signed_object": "status", + "context_overrides": {}, + "expected": { + "accept": true, + "scope": "self-declared publisher identity; no independent installed-executable or official-deployment claim" + } + }, + { + "id": "legacy_algorithm", + "negative_encoding": "legacy_algorithm", + "expected_type": "ts-publisher-evidence+jws", + "context_overrides": {}, + "expected": { + "accept": false, + "stage": "protected_header_schema", + "reason_code": "malformed" + } + }, + { + "id": "signature_tamper", + "negative_encoding": "signature_tamper", + "expected_type": "ts-publisher-evidence+jws", + "context_overrides": {}, + "expected": { + "accept": false, + "stage": "signature", + "reason_code": "signature_invalid" + } + }, + { + "id": "wrong_message_type", + "negative_encoding": "wrong_message_type", + "expected_type": "ts-publisher-evidence+jws", + "context_overrides": {}, + "expected": { + "accept": false, + "stage": "expected_message_type", + "reason_code": "signature_invalid" + } + }, + { + "id": "unknown_member", + "negative_encoding": "unknown_member", + "expected_type": "ts-publisher-evidence+jws", + "context_overrides": {}, + "expected": { + "accept": false, + "stage": "payload_schema", + "reason_code": "malformed" + } + }, + { + "id": "wrong_nonce", + "signed_object": "evidence", + "context_overrides": { + "nonce": "Hx4dHBsaGRgXFhUUExIREA8ODQwLCgkIBwYFBAMCAQA" + }, + "expected": { + "accept": false, + "stage": "freshness", + "reason_code": "nonce_mismatch" + } + }, + { + "id": "expired_evidence", + "signed_object": "evidence", + "context_overrides": { + "now": 1793793655 + }, + "expected": { + "accept": false, + "stage": "freshness", + "reason_code": "stale" + } + }, + { + "id": "binding_mismatch", + "signed_object": "evidence", + "context_overrides": { + "expected_binding_id": "0000000000000000000000000000000000000000000000000000000000000000" + }, + "expected": { + "accept": false, + "stage": "binding", + "reason_code": "binding_mismatch" + } + }, + { + "id": "wrong_host", + "signed_object": "evidence", + "context_overrides": { + "expected_host": "other.example.com" + }, + "expected": { + "accept": false, + "stage": "authorization", + "reason_code": "host_mismatch" + } + }, + { + "id": "operator_unauthorized", + "signed_object": "assessment", + "context_overrides": { + "operator_authorization": { + "operator_id": "https://operator.example.com/publisher-attestation", + "authorization_record_active": false + } + }, + "expected": { + "accept": false, + "stage": "operator_authorization", + "reason_code": "operator_unauthorized" + } + }, + { + "id": "state_recovery_required", + "signed_object": "status", + "context_overrides": { + "durable_authorization_history_available": false, + "signer_fence_current": false + }, + "expected": { + "accept": false, + "stage": "operational_authorization", + "reason_code": "state_recovery_required" + }, + "note": "Verifier issuance/publication precondition: stop signing/current status when durable state/fencing is unavailable. This condition is externally supplied operational state, not detectable from a historical signature alone." + }, + { + "id": "operator_authorization_expired", + "signed_object": "assessment", + "context_overrides": { + "operator_authorization": { + "operator_id": "https://operator.example.com/publisher-attestation", + "authenticated_account": "fixture-operator-account", + "authorization_record_active": true, + "source": "Synthetic independent exact operator DNS/account proof record; never inferred from publisher host DNS", + "not_before": 1793790000, + "not_after": 1793793599, + "operator_dns_account_proof_verified": true + } + }, + "expected": { + "accept": false, + "stage": "operator_authorization", + "reason_code": "operator_unauthorized" + } + }, + { + "id": "assessment_outlives_operator_authority", + "signed_object": "assessment", + "context_overrides": { + "operator_authorization": { + "operator_id": "https://operator.example.com/publisher-attestation", + "authenticated_account": "fixture-operator-account", + "authorization_record_active": true, + "source": "Synthetic independent exact operator DNS/account proof record; never inferred from publisher host DNS", + "not_before": 1793790000, + "not_after": 1793793610, + "operator_dns_account_proof_verified": true + } + }, + "expected": { + "accept": false, + "stage": "authorization_lifetime", + "reason_code": "operator_unauthorized" + } + }, + { + "id": "self_operated_nullable_operator", + "signed_object": "self_operated_evidence", + "context_overrides": { + "expected_binding_id": "58e95e08426f9568056ab257b9609b298c8fe8c840a33902b3df0c18816f3ca6", + "operator_authorization": null + }, + "expected": { + "accept": true + }, + "note": "Self-operated; null makes no distinct operator identity claim." + }, + { + "id": "satisfied_with_failed_required_check", + "signed_object": "assessment_required_check_failed", + "context_overrides": {}, + "expected": { + "accept": false, + "stage": "assessment_semantics", + "reason_code": "malformed" + }, + "note": "Schema-valid signed object; satisfied is inconsistent with a failed required check." + }, + { + "id": "assessment_expiry_before_issuance", + "signed_object": "assessment_reversed_time", + "context_overrides": {}, + "expected": { + "accept": false, + "stage": "time_order", + "reason_code": "malformed" + } + }, + { + "id": "production_rejects_dev_fixture_method", + "signed_object": "assessment_dev_fixture_method", + "context_overrides": { + "protocol_test_only": false + }, + "expected": { + "accept": false, + "stage": "policy", + "reason_code": "policy_untrusted" + }, + "note": "Loopback fixture enrollment exemption applies only in isolated development; forbidden by production trust settings." + }, + { + "id": "fingerprint_only_declaration_scope", + "signed_object": "assessment_fingerprint_only", + "context_overrides": { + "expected_binding_id": "f913a1f473b3ea168976301aeb4789d34dc82fb37d48d4a103b044148636ce6b", + "trusted_verifier": { + "issuer": "https://verifier.example.com/publisher-attestation", + "kid": "2TfFO5BGmRvPuTA36vtpR7EeP4M_j535iaQDoQe6s5E", + "not_before": 1793790000, + "not_after": 1793880000, + "allowed_policies": ["publisher-declaration-v1"], + "allowed_methods": [ + "dns-key-control-v1", + "publisher-evidence-jws-v1", + "not-assessed-v1", + "public-identity-projection-v1", + "publisher-custom-declaration-v1", + "fictional-fastly-fingerprint-v1", + "fictional-fastly-host-service-binding-v1", + "fictional-fastly-active-version-v1" + ], + "required_checks": [ + "host_authorization", + "key_possession", + "configuration" + ] + } + }, + "expected": { + "accept": true + }, + "note": "Synthetic parser/policy exercise only. Fingerprint remains fingerprint_only, never artifact-bound or official qualification." + }, + { + "id": "official_shape_without_provider_qualification", + "signed_object": "assessment_official_shaped_unqualified", + "context_overrides": { + "expected_binding_id": "f913a1f473b3ea168976301aeb4789d34dc82fb37d48d4a103b044148636ce6b", + "production_provider_qualification": false + }, + "expected": { + "accept": false, + "stage": "provider_qualification", + "reason_code": "artifact_binding_unproven" + }, + "note": "Fictional release, method, digests and service. Shape and signature never establish provider byte-recovery qualification or official installed code." + }, + { + "id": "fingerprint_without_active_version", + "context_overrides": { + "expected_binding_id": "f913a1f473b3ea168976301aeb4789d34dc82fb37d48d4a103b044148636ce6b" + }, + "expected": { + "accept": false, + "stage": "payload_schema", + "reason_code": "malformed" + }, + "note": "Signed negative encoding: non-null provider hash without a passing active-version check is structurally invalid.", + "negative_encoding": "fingerprint_without_active_version" + }, + { + "id": "default_expiry_only_status_unavailable", + "signed_object": "assessment", + "context_overrides": { + "status_available": false + }, + "expected": { + "accept": true + }, + "note": "Default require_status=false accepts while assessment remains valid under the isolated synthetic declaration policy." + }, + { + "id": "optional_live_status_unavailable", + "signed_object": "assessment", + "context_overrides": { + "require_status": true, + "status_available": false + }, + "expected": { + "accept": false, + "stage": "status", + "reason_code": "status_unavailable" + } + } + ], + "unsigned_expectations": { + "key_discovery": "Structurally valid candidate keys only; never establishes enrollment or trust.", + "assessment_list": "Structurally valid transport hint only; independently verify each embedded compact JWS.", + "enrollment_challenge": "Structurally valid fictional single-use challenge; creation time is external_context.now.", + "key_metadata": "Structurally valid public metadata; local name example-key, metadata entry ts-publisher-key-example-key. No private secret included.", + "key_history": "Untrusted bounded history transport only; each embedded signature and independent trust policy remains mandatory.", + "self_operated_enrollment_challenge": "Required operator_id is null: self-operated with no separate operator claim." + } +} diff --git a/docs/superpowers/specs/schemas/publisher-attestation-v1.schema.json b/docs/superpowers/specs/schemas/publisher-attestation-v1.schema.json new file mode 100644 index 000000000..165140f62 --- /dev/null +++ b/docs/superpowers/specs/schemas/publisher-attestation-v1.schema.json @@ -0,0 +1,1305 @@ +{ + "$comment": "JSON Schema draft-07. Local references only. Structural validation is necessary but never verifies cryptography, trust, authorization, provider qualification or current acceptance under independently configured policy. Reject duplicate members/trailing bytes and enforce depth <=16, UTF-8 byte limits (ordinary strings <=256), HTTP limits and canonical encodings before validation. External checks include JWK thumbprints, JCS hashes, equality of projected/bound/enrolled identities, ASCII-only host canonicalization, time ordering/lifetimes/key validity, nonce consumption, policy-required checks, release eligibility/digest equality, status sequence/withdrawal and independent trust settings. Evidence/status lifetime <=60 seconds; assessment expiry <=observed_from+900, issued_at<=observed_until+60; key validity <=90 days; challenge expiry <=creation+600. No schema alone establishes these relationships. Assessment expiry must not exceed independently authorized operator-record, enrollment, publisher-key or verifier-key expiry. Current status expiry must not exceed those bounds, assessment expiry or issued_at+60. Recheck authority at publication/commit and status reuse even when authorization generation is unchanged; expired operator authority stops positive assessment/current status. Configuration checks concern signed publisher-declared identity/enrollment consistency only, never a registry read of full configuration. Default acceptance is expiry-only (require_status=false); live status is an optional stricter policy. Non-null operator identity requires independent exact operator DNS/account proof; null denotes self-operated with no distinct operator claim.", + "title": "Publisher attestation version 1 structural contract", + "oneOf": [ + { + "$ref": "#/definitions/evidenceProtectedHeader" + }, + { + "$ref": "#/definitions/assessmentProtectedHeader" + }, + { + "$ref": "#/definitions/statusProtectedHeader" + }, + { + "$ref": "#/definitions/identityProjection" + }, + { + "$ref": "#/definitions/binding" + }, + { + "$ref": "#/definitions/evidence" + }, + { + "$ref": "#/definitions/assessment" + }, + { + "$ref": "#/definitions/status" + }, + { + "$ref": "#/definitions/keyDiscovery" + }, + { + "$ref": "#/definitions/assessmentList" + }, + { + "$ref": "#/definitions/enrollmentChallenge" + }, + { + "$ref": "#/definitions/keyMetadata" + }, + { + "$ref": "#/definitions/keyHistory" + } + ], + "definitions": { + "text": { + "type": "string", + "maxLength": 256 + }, + "nonemptyText": { + "type": "string", + "minLength": 1, + "maxLength": 256 + }, + "integer": { + "type": "integer", + "minimum": 0, + "maximum": 9007199254740991 + }, + "positiveInteger": { + "type": "integer", + "minimum": 1, + "maximum": 9007199254740991 + }, + "time": { + "$ref": "#/definitions/integer" + }, + "hex256": { + "type": "string", + "pattern": "^[0-9a-f]{64}$" + }, + "base64url32": { + "type": "string", + "pattern": "^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$" + }, + "uuid": { + "type": "string", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" + }, + "host": { + "type": "string", + "maxLength": 253, + "pattern": "^(?=.{1,253}$)(?![0-9]+(?:\\.[0-9]+)*$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$", + "$comment": "Protocol boundary accepts ASCII DNS only; canonicalize ASCII letters to lowercase, remove one terminal dot, reject invalid DNS syntax and IP literals. Already-encoded xn-- labels are opaque ASCII DNS labels; Unicode input is rejected, with no Unicode/UTS dependency." + }, + "httpsIdentifier": { + "type": "string", + "maxLength": 256, + "pattern": "^https://[^/?#@\\s]+(?:/[^?#\\s]*)?$", + "$comment": "Additionally parse as HTTPS, reject userinfo/query/fragment and validate authority; this pattern is a structural filter, not a URL parser." + }, + "environment": { + "enum": ["production", "staging", "development"] + }, + "extensions": { + "type": "object", + "required": [], + "additionalProperties": false, + "properties": {} + }, + "digest": { + "type": "object", + "required": ["algorithm", "value"], + "additionalProperties": false, + "properties": { + "algorithm": { + "const": "sha256" + }, + "value": { + "$ref": "#/definitions/hex256" + } + } + }, + "publicJwk": { + "type": "object", + "required": ["kty", "crv", "x"], + "additionalProperties": false, + "properties": { + "kty": { + "const": "OKP" + }, + "crv": { + "const": "Ed25519" + }, + "x": { + "$ref": "#/definitions/base64url32" + } + } + }, + "keyValidity": { + "type": "object", + "required": ["kid", "jwk", "not_before", "not_after"], + "additionalProperties": false, + "properties": { + "kid": { + "$ref": "#/definitions/base64url32" + }, + "jwk": { + "$ref": "#/definitions/publicJwk" + }, + "not_before": { + "$ref": "#/definitions/time" + }, + "not_after": { + "$ref": "#/definitions/time" + } + } + }, + "evidenceProtectedHeader": { + "type": "object", + "required": ["alg", "kid", "typ"], + "additionalProperties": false, + "properties": { + "alg": { + "const": "Ed25519" + }, + "kid": { + "$ref": "#/definitions/base64url32" + }, + "typ": { + "const": "ts-publisher-evidence+jws" + } + } + }, + "assessmentProtectedHeader": { + "type": "object", + "required": ["alg", "kid", "typ"], + "additionalProperties": false, + "properties": { + "alg": { + "const": "Ed25519" + }, + "kid": { + "$ref": "#/definitions/base64url32" + }, + "typ": { + "const": "ts-publisher-assessment+jws" + } + } + }, + "statusProtectedHeader": { + "type": "object", + "required": ["alg", "kid", "typ"], + "additionalProperties": false, + "properties": { + "alg": { + "const": "Ed25519" + }, + "kid": { + "$ref": "#/definitions/base64url32" + }, + "typ": { + "const": "ts-publisher-status+jws" + } + } + }, + "platform": { + "type": "object", + "required": ["provider", "service_id", "service_version", "staging"], + "additionalProperties": false, + "properties": { + "provider": { + "enum": ["fastly", "axum"] + }, + "service_id": { + "anyOf": [ + { + "$ref": "#/definitions/nonemptyText" + }, + { + "type": "null" + } + ] + }, + "service_version": { + "anyOf": [ + { + "$ref": "#/definitions/positiveInteger" + }, + { + "type": "null" + } + ] + }, + "staging": { + "anyOf": [ + { + "type": "boolean" + }, + { + "type": "null" + } + ] + } + }, + "allOf": [ + { + "if": { + "properties": { + "provider": { + "const": "fastly" + } + } + }, + "then": { + "properties": { + "service_id": { + "$ref": "#/definitions/nonemptyText" + }, + "service_version": { + "$ref": "#/definitions/positiveInteger" + } + } + } + }, + { + "if": { + "properties": { + "provider": { + "const": "axum" + } + } + }, + "then": { + "properties": { + "service_id": { + "type": "null" + }, + "service_version": { + "type": "null" + }, + "staging": { + "type": "null" + } + } + } + } + ] + }, + "identityProjection": { + "type": "object", + "required": [ + "schema", + "host", + "publisher_id", + "operator_id", + "deployment_id", + "environment" + ], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-identity-v1" + }, + "host": { + "$ref": "#/definitions/host" + }, + "publisher_id": { + "$ref": "#/definitions/uuid" + }, + "operator_id": { + "anyOf": [ + { + "$ref": "#/definitions/httpsIdentifier" + }, + { + "type": "null" + } + ] + }, + "deployment_id": { + "$ref": "#/definitions/uuid" + }, + "environment": { + "$ref": "#/definitions/environment" + } + } + }, + "configuration": { + "type": "object", + "required": ["schema", "digest", "projection"], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-identity-v1" + }, + "digest": { + "$ref": "#/definitions/digest" + }, + "projection": { + "$ref": "#/definitions/identityProjection" + } + } + }, + "binding": { + "type": "object", + "required": [ + "schema", + "host", + "publisher_id", + "operator_id", + "deployment_id", + "environment", + "platform", + "attestation_key", + "configuration", + "extensions" + ], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-binding-v1" + }, + "host": { + "$ref": "#/definitions/host" + }, + "publisher_id": { + "$ref": "#/definitions/uuid" + }, + "operator_id": { + "anyOf": [ + { + "$ref": "#/definitions/httpsIdentifier" + }, + { + "type": "null" + } + ] + }, + "deployment_id": { + "$ref": "#/definitions/uuid" + }, + "environment": { + "$ref": "#/definitions/environment" + }, + "platform": { + "$ref": "#/definitions/platform" + }, + "attestation_key": { + "$ref": "#/definitions/keyValidity" + }, + "configuration": { + "$ref": "#/definitions/configuration" + }, + "extensions": { + "$ref": "#/definitions/extensions" + } + } + }, + "buildReport": { + "type": "object", + "required": [ + "declared_class", + "source_commit", + "package_version", + "target", + "variant" + ], + "additionalProperties": false, + "properties": { + "declared_class": { + "enum": ["custom", "unspecified"] + }, + "source_commit": { + "anyOf": [ + { + "type": "string", + "pattern": "^[0-9a-f]{40}$" + }, + { + "type": "null" + } + ] + }, + "package_version": { + "anyOf": [ + { + "$ref": "#/definitions/text" + }, + { + "type": "null" + } + ] + }, + "target": { + "anyOf": [ + { + "$ref": "#/definitions/text" + }, + { + "type": "null" + } + ] + }, + "variant": { + "anyOf": [ + { + "$ref": "#/definitions/text" + }, + { + "type": "null" + } + ] + } + } + }, + "evidence": { + "type": "object", + "required": [ + "schema", + "binding", + "binding_id", + "nonce", + "issued_at", + "expires_at", + "build_report", + "extensions" + ], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-evidence-v1" + }, + "binding": { + "$ref": "#/definitions/binding" + }, + "binding_id": { + "$ref": "#/definitions/hex256" + }, + "nonce": { + "$ref": "#/definitions/base64url32" + }, + "issued_at": { + "$ref": "#/definitions/time" + }, + "expires_at": { + "$ref": "#/definitions/time" + }, + "build_report": { + "$ref": "#/definitions/buildReport" + }, + "extensions": { + "$ref": "#/definitions/extensions" + } + } + }, + "check": { + "type": "object", + "required": ["outcome", "method", "observed_at", "evidence_digest"], + "additionalProperties": false, + "properties": { + "outcome": { + "enum": ["pass", "fail", "unavailable", "not_assessed"] + }, + "method": { + "anyOf": [ + { + "$ref": "#/definitions/nonemptyText" + }, + { + "type": "null" + } + ] + }, + "observed_at": { + "anyOf": [ + { + "$ref": "#/definitions/time" + }, + { + "type": "null" + } + ] + }, + "evidence_digest": { + "anyOf": [ + { + "$ref": "#/definitions/digest" + }, + { + "type": "null" + } + ] + } + }, + "allOf": [ + { + "if": { + "properties": { + "outcome": { + "const": "pass" + } + } + }, + "then": { + "properties": { + "observed_at": { + "$ref": "#/definitions/time" + }, + "evidence_digest": { + "$ref": "#/definitions/digest" + }, + "method": { + "$ref": "#/definitions/nonemptyText" + } + } + } + }, + { + "if": { + "properties": { + "outcome": { + "const": "not_assessed" + } + } + }, + "then": { + "properties": { + "method": { + "type": "null" + }, + "observed_at": { + "type": "null" + }, + "evidence_digest": { + "type": "null" + } + } + }, + "else": { + "properties": { + "method": { + "$ref": "#/definitions/nonemptyText" + } + } + } + } + ] + }, + "checks": { + "type": "object", + "required": [ + "host_authorization", + "key_possession", + "host_service_binding", + "active_version", + "configuration" + ], + "additionalProperties": false, + "properties": { + "host_authorization": { + "$ref": "#/definitions/check" + }, + "key_possession": { + "$ref": "#/definitions/check" + }, + "host_service_binding": { + "$ref": "#/definitions/check" + }, + "active_version": { + "$ref": "#/definitions/check" + }, + "configuration": { + "$ref": "#/definitions/check" + } + } + }, + "release": { + "type": "object", + "required": [ + "repository", + "tag", + "source_commit", + "asset_name", + "artifact_sha256", + "verification_evidence_digest" + ], + "additionalProperties": false, + "properties": { + "repository": { + "type": "string", + "maxLength": 256, + "pattern": "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$", + "$comment": "Layer 1 owner/name identity; independently configured release eligibility remains mandatory." + }, + "tag": { + "$ref": "#/definitions/nonemptyText" + }, + "source_commit": { + "type": "string", + "pattern": "^[0-9a-f]{40}$" + }, + "asset_name": { + "type": "string", + "minLength": 1, + "maxLength": 256, + "pattern": "^[^/\\\\\\s]+$", + "$comment": "Simple asset basename; dot and dot-dot names are rejected.", + "not": { + "enum": [".", ".."] + } + }, + "artifact_sha256": { + "$ref": "#/definitions/digest" + }, + "verification_evidence_digest": { + "$ref": "#/definitions/digest" + } + } + }, + "build": { + "type": "object", + "required": [ + "provenance", + "assurance", + "method", + "artifact_sha256", + "provider_files_hash", + "release", + "coverage" + ], + "additionalProperties": false, + "properties": { + "provenance": { + "enum": ["official", "custom", "unknown"] + }, + "assurance": { + "enum": ["artifact_bound", "fingerprint_only", "declared"] + }, + "method": { + "$ref": "#/definitions/nonemptyText" + }, + "artifact_sha256": { + "anyOf": [ + { + "$ref": "#/definitions/digest" + }, + { + "type": "null" + } + ] + }, + "provider_files_hash": { + "anyOf": [ + { + "type": "string", + "pattern": "^[0-9a-f]{128}$" + }, + { + "type": "null" + } + ] + }, + "release": { + "anyOf": [ + { + "$ref": "#/definitions/release" + }, + { + "type": "null" + } + ] + }, + "coverage": { + "enum": ["selected_executable_only", "declaration_only"] + } + }, + "allOf": [ + { + "if": { + "properties": { + "provenance": { + "const": "official" + } + } + }, + "then": { + "properties": { + "assurance": { + "const": "artifact_bound" + }, + "artifact_sha256": { + "$ref": "#/definitions/digest" + }, + "release": { + "$ref": "#/definitions/release" + } + } + } + }, + { + "if": { + "properties": { + "assurance": { + "const": "artifact_bound" + } + } + }, + "then": { + "properties": { + "artifact_sha256": { + "$ref": "#/definitions/digest" + }, + "coverage": { + "const": "selected_executable_only" + } + } + } + }, + { + "if": { + "properties": { + "assurance": { + "const": "fingerprint_only" + } + } + }, + "then": { + "properties": { + "artifact_sha256": { + "type": "null" + }, + "release": { + "type": "null" + } + } + } + }, + { + "if": { + "properties": { + "assurance": { + "const": "declared" + } + } + }, + "then": { + "properties": { + "artifact_sha256": { + "type": "null" + }, + "release": { + "type": "null" + }, + "coverage": { + "const": "declaration_only" + } + } + } + }, + { + "if": { + "properties": { + "provenance": { + "const": "custom" + } + } + }, + "then": { + "properties": { + "release": { + "type": "null" + } + } + } + } + ] + }, + "reasonCodes": { + "type": "array", + "maxItems": 16, + "items": { + "enum": [ + "malformed", + "signature_invalid", + "host_mismatch", + "environment_mismatch", + "key_unauthorized", + "key_compromised", + "nonce_mismatch", + "stale", + "binding_mismatch", + "release_ineligible", + "artifact_mismatch", + "artifact_binding_unproven", + "configuration_unobservable", + "provider_unavailable", + "observation_race", + "withdrawn", + "status_unavailable", + "policy_untrusted", + "clock_unavailable", + "operator_unauthorized", + "state_recovery_required" + ] + }, + "uniqueItems": true, + "$comment": "Lexicographic ordering is checked outside JSON Schema." + }, + "policy": { + "type": "object", + "required": ["id", "version", "digest"], + "additionalProperties": false, + "properties": { + "id": { + "$ref": "#/definitions/nonemptyText" + }, + "version": { + "$ref": "#/definitions/positiveInteger" + }, + "digest": { + "$ref": "#/definitions/digest" + } + } + }, + "assessment": { + "type": "object", + "required": [ + "schema", + "issuer", + "assessment_id", + "enrollment_id", + "binding", + "binding_id", + "evidence_digest", + "observed_from", + "observed_until", + "issued_at", + "expires_at", + "policy", + "result", + "checks", + "build", + "reason_codes", + "extensions" + ], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-assessment-v1" + }, + "issuer": { + "$ref": "#/definitions/httpsIdentifier" + }, + "assessment_id": { + "$ref": "#/definitions/uuid" + }, + "enrollment_id": { + "$ref": "#/definitions/uuid" + }, + "binding": { + "$ref": "#/definitions/binding" + }, + "binding_id": { + "$ref": "#/definitions/hex256" + }, + "evidence_digest": { + "$ref": "#/definitions/digest" + }, + "observed_from": { + "$ref": "#/definitions/time" + }, + "observed_until": { + "$ref": "#/definitions/time" + }, + "issued_at": { + "$ref": "#/definitions/time" + }, + "expires_at": { + "$ref": "#/definitions/time" + }, + "policy": { + "$ref": "#/definitions/policy" + }, + "result": { + "enum": ["satisfied", "not_satisfied", "indeterminate"] + }, + "checks": { + "$ref": "#/definitions/checks" + }, + "build": { + "$ref": "#/definitions/build" + }, + "reason_codes": { + "$ref": "#/definitions/reasonCodes" + }, + "extensions": { + "$ref": "#/definitions/extensions" + } + }, + "allOf": [ + { + "if": { + "properties": { + "build": { + "properties": { + "provider_files_hash": { + "type": "string" + } + } + } + } + }, + "then": { + "properties": { + "binding": { + "properties": { + "platform": { + "properties": { + "provider": { + "const": "fastly" + } + } + } + } + }, + "checks": { + "properties": { + "host_service_binding": { + "properties": { + "outcome": { + "const": "pass" + } + } + }, + "active_version": { + "properties": { + "outcome": { + "const": "pass" + } + } + } + } + } + } + } + } + ] + }, + "status": { + "type": "object", + "required": [ + "schema", + "issuer", + "enrollment_id", + "assessment_id", + "binding_id", + "publisher_key_kid", + "sequence", + "assessment_status", + "enrollment_status", + "publisher_key_status", + "reason_codes", + "issued_at", + "expires_at", + "extensions" + ], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-status-v1" + }, + "issuer": { + "$ref": "#/definitions/httpsIdentifier" + }, + "enrollment_id": { + "$ref": "#/definitions/uuid" + }, + "assessment_id": { + "$ref": "#/definitions/uuid" + }, + "binding_id": { + "$ref": "#/definitions/hex256" + }, + "publisher_key_kid": { + "$ref": "#/definitions/base64url32" + }, + "sequence": { + "$ref": "#/definitions/positiveInteger" + }, + "assessment_status": { + "enum": ["current", "withdrawn"] + }, + "enrollment_status": { + "enum": ["active", "withdrawn"] + }, + "publisher_key_status": { + "enum": ["active", "compromised", "retired"] + }, + "reason_codes": { + "$ref": "#/definitions/reasonCodes" + }, + "issued_at": { + "$ref": "#/definitions/time" + }, + "expires_at": { + "$ref": "#/definitions/time" + }, + "extensions": { + "$ref": "#/definitions/extensions" + } + } + }, + "keyDiscovery": { + "type": "object", + "required": ["schema", "host", "keys", "verifiers"], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-key-discovery-v1" + }, + "host": { + "$ref": "#/definitions/host" + }, + "keys": { + "type": "array", + "maxItems": 4, + "items": { + "$ref": "#/definitions/keyValidity" + }, + "minItems": 1 + }, + "verifiers": { + "type": "array", + "minItems": 0, + "maxItems": 16, + "uniqueItems": true, + "items": { + "$ref": "#/definitions/httpsIdentifier" + }, + "$comment": "Untrusted HTTPS issuer discovery hints only. Never imports trust roots or enables a policy." + } + } + }, + "compactJws": { + "type": "string", + "maxLength": 32768, + "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]{85}[AQgw]$", + "$comment": "Explicit exception to the 256-byte string limit. Header/payload parsing, base64url canonicality and signature verification are external." + }, + "assessmentList": { + "type": "object", + "required": ["schema", "host", "environment", "assessments"], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-assessment-list-v1" + }, + "host": { + "$ref": "#/definitions/host" + }, + "environment": { + "$ref": "#/definitions/environment" + }, + "assessments": { + "type": "array", + "maxItems": 16, + "items": { + "$ref": "#/definitions/compactJws" + } + } + }, + "$comment": "Aggregate decoded HTTP body limit: 524288 bytes, checked before JSON Schema validation; each compact JWS is at most 32768 ASCII bytes." + }, + "enrollmentChallenge": { + "type": "object", + "required": [ + "schema", + "issuer", + "host", + "publisher_id", + "operator_id", + "deployment_id", + "provider", + "service_id", + "environment", + "publisher_key_kid", + "nonce", + "expires_at" + ], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-enrollment-challenge-v1" + }, + "issuer": { + "$ref": "#/definitions/httpsIdentifier" + }, + "host": { + "$ref": "#/definitions/host" + }, + "publisher_id": { + "$ref": "#/definitions/uuid" + }, + "operator_id": { + "anyOf": [ + { + "$ref": "#/definitions/httpsIdentifier" + }, + { + "type": "null" + } + ] + }, + "deployment_id": { + "$ref": "#/definitions/uuid" + }, + "provider": { + "enum": ["fastly", "axum"] + }, + "service_id": { + "anyOf": [ + { + "$ref": "#/definitions/nonemptyText" + }, + { + "type": "null" + } + ] + }, + "environment": { + "$ref": "#/definitions/environment" + }, + "publisher_key_kid": { + "$ref": "#/definitions/base64url32" + }, + "nonce": { + "$ref": "#/definitions/base64url32" + }, + "expires_at": { + "$ref": "#/definitions/time" + } + }, + "allOf": [ + { + "if": { + "properties": { + "provider": { + "const": "fastly" + } + } + }, + "then": { + "properties": { + "service_id": { + "$ref": "#/definitions/nonemptyText" + } + } + } + }, + { + "if": { + "properties": { + "provider": { + "const": "axum" + } + } + }, + "then": { + "properties": { + "service_id": { + "type": "null" + } + } + } + } + ] + }, + "keyMetadata": { + "type": "object", + "required": [ + "schema", + "kid", + "jwk", + "not_before", + "not_after", + "secret_name" + ], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-key-metadata-v1" + }, + "kid": { + "$ref": "#/definitions/base64url32" + }, + "jwk": { + "$ref": "#/definitions/publicJwk" + }, + "not_before": { + "$ref": "#/definitions/time" + }, + "not_after": { + "$ref": "#/definitions/time" + }, + "secret_name": { + "type": "string", + "pattern": "^ts-publisher-[a-z][a-z0-9-]{0,47}$" + } + }, + "$comment": "Read metadata at ts-publisher-key- in existing trusted_server_config; secret_name must equal ts-publisher- in existing trusted_server_secrets. Cross-entry equality is external." + }, + "compactStatusJws": { + "type": "string", + "maxLength": 8192, + "pattern": "^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]{85}[AQgw]$", + "$comment": "Explicit exception to the 256-byte string limit. Header/payload parsing, base64url canonicality and signature verification are external." + }, + "keyHistory": { + "type": "object", + "required": ["schema", "host", "environment", "entries", "next_cursor"], + "additionalProperties": false, + "properties": { + "schema": { + "const": "ts-publisher-key-history-v1" + }, + "host": { + "$ref": "#/definitions/host" + }, + "environment": { + "$ref": "#/definitions/environment" + }, + "entries": { + "type": "array", + "minItems": 0, + "maxItems": 16, + "items": { + "type": "object", + "required": ["assessment", "status"], + "additionalProperties": false, + "properties": { + "assessment": { + "$ref": "#/definitions/compactJws" + }, + "status": { + "anyOf": [ + { + "$ref": "#/definitions/compactStatusJws" + }, + { + "type": "null" + } + ] + } + } + } + }, + "next_cursor": { + "anyOf": [ + { + "type": "null" + }, + { + "type": "string", + "minLength": 1, + "maxLength": 256, + "pattern": "^[\\x20-\\x7e]+$" + } + ] + } + }, + "$comment": "Untrusted transport of historical signed objects. Aggregate decoded HTTP body limit 524288 bytes is enforced externally before schema validation. Assessment JWS <=32768 ASCII bytes; status JWS <=8192 ASCII bytes. Pagination cursor is opaque printable ASCII; it confers no authority." + } + } +}