Fix deterministic container evidence recovery

[0xsl1m]

Incident

The v0.6.3 container workflow built, scanned, pushed, and SLSA-attested the exact release image, then stopped before evidence verification/assets because canonicalization removed CycloneDX serialNumber. The pinned attestation action requires bomFormat, specVersion, and serialNumber to recognize CycloneDX JSON.

PyPI v0.6.3 published successfully. Both GHCR tags currently resolve to sha256:ddc369cd94ee8b982fd8976f2a3641bb75546a4da805ab556e97c3a80df69d9f, and its SLSA provenance verifies against release commit cd852fe6f2b8a3e766fc21ae9f6360755ae50e97.

Fix

• canonicalize after resolving the exact registry digest and replace the random serial with a deterministic UUIDv5 derived from repository@digest; remove only the nondeterministic timestamp
• add a recovery-only manual dispatch for existing stable releases
• require the dispatch itself to run from protected main, then verify its workflow SHA is contained in origin/main
• checkout an explicit stable tag and require a published, non-draft, non-prerelease GitHub release, matching package version, exact green release-source CI, and release commit contained in main
• require both immutable image tags to preexist and match; verify image labels and prior exact-release-source SLSA provenance before reuse
• prevent manual recovery from building, repairing, or pushing image tags and from issuing new provenance
• bind the new SBOM attestation to the protected-main recovery SHA while retaining/verifying the prior SLSA binding to the exact release SHA
• keep release evidence compare-or-create; conflicting assets are never overwritten

Verification

• full regression: 320 passed, 2 opt-in model tests skipped
• Ruff lint/format clean; strict mypy clean across 54 source files
• Actionlint clean; all six embedded Bash run blocks pass bash -n
• workflow/production policy tests: 22 passed
• independent security re-review: GO, with no remaining signing-oracle, mutable-image, tag-confusion, source-binding, or asset-clobber blocker
• live recovery preflight: stable v0.6.3 release, exact green source CI, equal version/SHA tags, matching digest, and exact-source SLSA verification all pass

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shadowshield	Ready	Preview, Comment	Jul 25, 2026 10:35pm