docs: record component accountability and lifecycle procedures - #14
Merged
Merged
Conversation
Bind all 79 locked runtime RPMs to their license tag, source RPM, publisher and redistribution policy, lifecycle boundary, and named update owner, and check that inventory against every acquired RPM in native CI. Define reviewed lock refresh, signing-key rotation and revocation, immutable mirroring, image rollback, and disconnected transfer, with a schema and fail-closed manifest binding a payload to its repository revision, architecture lock, and component inventory. Record the rootless runtime and lifecycle contract, and strengthen the smoke suite to require precise mounted-configuration and unwritable-path diagnostics, worker-replacing reloads that retain PID 1, complete active-request draining on SIGQUIT, the exact embedded 79-RPM manifest, and the reviewed NGINX compile-feature and empty dynamic-module inventories.
…tability-and-lifecycle
The artifact locks moved onto the patched UBI 9.8 bases, so the accountability inventory no longer matched them. Rebind both lock SHA-256 values and update the six affected source-RPM records: openssl, openssl-libs -> openssl-3.5.8-1.el9_8.src.rpm systemd, systemd-libs, systemd-pam, systemd-rpm-macros -> systemd-252-67.el9_8.6.src.rpm License, vendor, and source-RPM records were verified against the actual RPM headers of a freshly acquired AMD64 bundle rather than assumed: all 79 packages verify, and no license tag changed across either rebuild. The package set, publisher policies, lifecycle boundaries, and update owners are unchanged.
joey-huckabee
deleted the
docs/component-accountability-and-lifecycle
branch
September 16, 2026 03:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the remaining Package 2 items: record source, redistribution,
licensing, lifecycle, and update ownership for every runtime component, and
define lock refresh, key rotation, mirroring, rollback, and disconnected
transfer.
Component accountability
artifacts/components.jsonbinds all 79 locked runtime RPMs to a publisherpolicy carrying source, redistribution terms, license reference, support
lifecycle, named update owner, and expected RPM vendor.
scripts/components.pyvalidates it against both locks, and the native jobs re-check every recorded
license tag, source RPM, and vendor header against each acquired RPM.
Licenses are recorded as the publisher's own RPM tag. They are not relabelled
into SPDX-shaped strings, because that would turn upstream metadata into a
project-authored legal conclusion.
Lifecycle and controlled transfer
docs/ARTIFACT-LIFECYCLE.mddefines roles and required reviewers for lockrefresh, signing-key rotation and emergency revocation, mirrors, rollback, and
connected-to-disconnected transfer. A key change is never inferred from a
failed signature or an RPM header.
scripts/transfer.pyplus its schema bind apayload to its repository revision, architecture lock, and component inventory;
the separately conveyed manifest digest does not replace publisher signatures.
Runtime contract
docs/RUNTIME-CONTRACT.mdrecords startup diagnostics, reload andgraceful-stop behavior, and the enforced inventories. The smoke suite now
requires precise mounted-configuration and unwritable-path diagnostics,
worker-replacing reloads that retain PID 1, complete active-request draining on
SIGQUIT, the exact embedded 79-RPM manifest, and an empty dynamic-moduledirectory.
Note on the inventory rebind
This branch was prepared before the lock refresh in #11, so the second commit
rebinds it: both lock SHA-256 values and the six affected source-RPM records
(
opensslx2,systemdx4).Those records were verified against the actual RPM headers of a freshly
acquired AMD64 bundle rather than edited to match the locks — all 79 packages
verify, and no license tag changed across either rebuild. That ordering matters
here: editing the inventory to agree with the locks would have made the check
self-confirming, which is precisely what this file exists to prevent.
🤖 Generated with Claude Code