Attestations: lock the provenance repository on first attested upload (TOFU) #9694

Tracking issue for the trust-on-first-use (TOFU) lock on package provenance, split out of the review of #9546 (see #9546 (comment)).

Context

#9546 verifies the Sigstore attestation uploaded with a package archive and checks that the provenance repository matches pubspec.yaml's repository: and, when GitHub Actions publishing is enabled for the package, publishingConfig.githubConfig.repository.

For packages without automated publishing the only binding is to repository: inside the uploaded archive, which the uploader controls. A compromised uploader credential can therefore publish a version that is built and signed from an attacker-controlled repository, and pub.dev would verify it successfully. The TOFU lock closes this for all packages, independent of their publishing configuration, which is why it should be considered a blocker for enabling verification results and provenance badges in production.

What

Mirror the existing githubLock (GitHubPublishingLock, set on the first upload through GitHub Actions) for attestations:

• On the first attested upload of a package, record the provenance repository: repository (owner/name), repository_id and repository_owner_id (from predicate.buildDefinition.internalParameters.github in the signed statement; the ids are immutable across renames and transfers).
• On every later attested upload, require the provenance to match the lock by repository_id / repository_owner_id (the ids, not the slug, so a renamed repository keeps working while a re-created one under the old name does not).
• When a githubLock exists, require the provenance ids to match that lock as well.
• Package admins need a way to reset the lock (admin page / admin action), like the publishing configuration, with an audit-log entry.
• Decide whether an unattested upload after attested ones should be allowed, and what the UI/badges should show for such a package (the client-side policy in Verify package attestations and enforce provenance policies in pub get/upgrade pub#4875 treats this as a downgrade).

The persisted provenance facts on PackageVersion (#9546) carry the ids, so the lock can be derived from the first attested version and does not need to re-parse any bundle.

Related

• Verify uploaded package attestations using package:sigstore #9546 (verification), Support package policy to require Sigstore provenance attestation #9552 (policy), Display SLSA provenance level shield badges and Security tab #9550 (badges / Security tab)
• Verify package attestations and enforce provenance policies in pub get/upgrade pub#4875 (client-side TOFU policy)