-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathupstream-pins.yaml
More file actions
165 lines (160 loc) · 11.2 KB
/
Copy pathupstream-pins.yaml
File metadata and controls
165 lines (160 loc) · 11.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
# upstream-pins.yaml — provenance-verified pin manifest for the ModemManager stack.
#
# WHAT THIS IS
# The four upstream sources CeraLive rebuilds for the target suite (trixie), each pinned to an EXACT
# upstream release tag and its matching Debian packaging (salsa) tag. Every field is
# real, resolved data — never a placeholder. `packaging/ci/verify-upstream-pins.sh`
# re-checks every field in an isolated GNUPGHOME and fails closed on any drift.
#
# THE PROVENANCE CHAIN (four independent links, all re-verified by the script)
# 1. LINEAGE — the upstream git tag. `git ls-remote --tags <upstream_repo> <upstream_tag>`
# must still resolve to the pinned `upstream_tag_sha` (annotated tag object) and
# `upstream_commit_sha` (peeled commit). This authenticates *lineage* — which commit
# the release names. Per the plan, the git tag is NEVER byte-compared to a git archive;
# the tarball checksum authority is the signed .dsc (link 2), not `git archive`.
# 2. AUTHORITY — the signed Debian `.dsc`. Its detached GPG clearsign is verified against
# the pinned `signer_fingerprint`, whose armored public key is checked into
# `packaging/keys/<fingerprint>.asc` (acquisition documented in packaging/keys/README.md).
# A verified .dsc is the authority for the tarball checksums it embeds.
# 3. ARTIFACT — the `.orig.tar`. It is downloaded and its sha256 must equal
# `orig_tar_sha256`, which itself equals the corresponding line in the .dsc's
# `Checksums-Sha256:` section (copied verbatim into `dsc_checksums_sha256` below).
# So: verified .dsc -> embedded checksum -> downloaded tarball hash.
# 4. PACKAGING — the `.debian.tar.xz`. Downloaded from `debian_tar_url` and sha256-verified
# against `debian_tar_sha256` (which equals its line in the verified .dsc's
# `Checksums-Sha256:`, so the .dsc remains the checksum authority — NOT independently
# computed). It is then extracted and a CANONICAL TREE MANIFEST of its `debian/` dir
# (per entry: relative path, file type, executable bit, symlink target, content sha256)
# is compared byte-for-byte against the SAME manifest built from the pinned `salsa_tag`'s
# `debian/` tree. Equal manifests prove the salsa packaging recipe CeraLive checks in
# (`packaging/<Source>/debian/`) is exactly the tree the signed .dsc ships. Chain closed.
#
# WHY signer_fingerprint IS THE .dsc SIGNER (not the upstream tag signer)
# The cryptographic authority for the *tarball checksums* is the Debian Developer who
# signed the .dsc (Guido Günther / Arnaud Ferraris of the DebianOnMobile team), because
# the .dsc is the checksum authority. The upstream git tag's own GPG signature (Aleksander
# Morgado, upstream) is NOT re-verified here — the plan sanctions "git ls-remote re-check"
# (SHA-pin) for lineage, and re-verifying the tag signature would require fetching tag
# objects (a heavier clone the plan tells us to avoid). Lineage = SHA-pin; tarball
# authority = .dsc GPG signature. Two orthogonal guarantees, both enforced.
#
# NOTE: the .dsc signer per source can change between Debian revisions — whichever
# DebianOnMobile DD sponsored the upload signs it. For this bump the pairing is
# modemmanager+libmbim -> Arnaud Ferraris, libqmi+libqrtr-glib -> Guido Günther (the
# inverse of the previous 1.24.0/1.32.0/1.36.0/1.2.2 pins). Both keys were already pinned;
# no new signer key was required. Each `signer_fingerprint` is the key that actually
# produced that revision's signature, read FROM the signature, not assumed.
#
# EXECUTOR NOTE
# These are the tags NAMED by the plan (ModemManager 1.24.2, libmbim 1.34.0, libqmi 1.38.0,
# libqrtr-glib 1.4.0; salsa debian/1.24.2-2, debian/1.34.0-1, debian/1.38.0-1, debian/1.4.0-1).
# The executor resolves — never chooses — versions. All twelve tags (4 upstream annotated +
# 4 salsa annotated) were confirmed to exist via `git ls-remote` on 2026-07-16; a
# no-newer-stable enumeration of each upstream's release tags confirmed none is newer than
# the pinned version (higher tags are all -dev / -rc / .995 pre-releases). Every checksum
# below was copied from the GPG-verified .dsc and cross-checked against a real download.
# The .debian.tar.xz `debian/` tree was proven byte-identical to the salsa tag's tree.
#
# Tarball compression note: the orig tarballs were RE-ROLLED for this bump — libmbim and
# libqmi moved .orig.tar.xz -> .orig.tar.gz, and libqrtr-glib moved .orig.tar.bz2 ->
# .orig.tar.gz. Only modemmanager stays .orig.tar.xz. `orig_tar_name` reflects the REAL
# name in each verified .dsc, not the previous convention.
#
# FILE FORMAT
# Deliberately flat, 2-space-nested YAML with a single block literal per source
# (`dsc_checksums_sha256`). Parsed by a dependency-free awk reader in the verify script,
# so the packaging CI container needs no python/yq — only bash+gpg+curl+sha256sum+git+tar.
schema_version: 1
sources:
modemmanager:
upstream_tag: "1.24.2"
upstream_repo: "https://gitlab.freedesktop.org/mobile-broadband/ModemManager.git"
upstream_tag_sha: "68b1c1c442a34e0bbdfee2abd74c07470a9fa184"
upstream_commit_sha: "f2b9ab1ad78d322f32134a444b5b54c6e8160e19"
signer_fingerprint: "796DB393DC3FF40222B6EA22D3EBB5966BB99196"
signer_key_file: "keys/796DB393DC3FF40222B6EA22D3EBB5966BB99196.asc"
orig_tar_name: "modemmanager_1.24.2.orig.tar.xz"
orig_tar_url: "https://deb.debian.org/debian/pool/main/m/modemmanager/modemmanager_1.24.2.orig.tar.xz"
orig_tar_sha256: "8f575bfdcc0277b68946a65b527a804be8051abbb17430b6108da365a92c6913"
salsa_repo: "https://salsa.debian.org/DebianOnMobile-team/modemmanager.git"
salsa_tag: "debian/1.24.2-2"
salsa_tag_sha: "c32cb34015be9738c2d2e3372c11f516d78c4fa6"
salsa_commit_sha: "56d7b2dba1f3ddbd99af9522a085fbb35ba06289"
dsc_url: "https://deb.debian.org/debian/pool/main/m/modemmanager/modemmanager_1.24.2-2.dsc"
dsc_sha256: "51f3682ceb1f0ba154107d9cf2f75218b332823be19302c875d8d6874f1694a2"
dsc_signer: "Arnaud Ferraris <arnaud.ferraris@gmail.com>"
debian_tar_name: "modemmanager_1.24.2-2.debian.tar.xz"
debian_tar_url: "https://deb.debian.org/debian/pool/main/m/modemmanager/modemmanager_1.24.2-2.debian.tar.xz"
debian_tar_sha256: "5051465dffee001eb4c77ccfcb36e496ff793879f13a84cbb7484a673ed7e204"
dsc_checksums_sha256: |
8f575bfdcc0277b68946a65b527a804be8051abbb17430b6108da365a92c6913 1366356 modemmanager_1.24.2.orig.tar.xz
5051465dffee001eb4c77ccfcb36e496ff793879f13a84cbb7484a673ed7e204 43380 modemmanager_1.24.2-2.debian.tar.xz
libmbim:
upstream_tag: "1.34.0"
upstream_repo: "https://gitlab.freedesktop.org/mobile-broadband/libmbim.git"
upstream_tag_sha: "008fd1117bf44419a2e809fcd4feabe5914077dd"
upstream_commit_sha: "2bca5d22137883f348cb117597746483637491db"
signer_fingerprint: "796DB393DC3FF40222B6EA22D3EBB5966BB99196"
signer_key_file: "keys/796DB393DC3FF40222B6EA22D3EBB5966BB99196.asc"
orig_tar_name: "libmbim_1.34.0.orig.tar.gz"
orig_tar_url: "https://deb.debian.org/debian/pool/main/libm/libmbim/libmbim_1.34.0.orig.tar.gz"
orig_tar_sha256: "ba6c1f316b108c0b59c920044a363b7fdcc87d41882b3dfd5a4ece7c003d112b"
salsa_repo: "https://salsa.debian.org/DebianOnMobile-team/libmbim.git"
salsa_tag: "debian/1.34.0-1"
salsa_tag_sha: "c95aa88a715fc300d6a51d5a01c96adc8e78296d"
salsa_commit_sha: "c9b0205739e0ae119a9242ff5eab60111b5914c5"
dsc_url: "https://deb.debian.org/debian/pool/main/libm/libmbim/libmbim_1.34.0-1.dsc"
dsc_sha256: "5413fccb85631eeded506f0ba7ef33f9ad107162f74c1894d2952fb52f04bf03"
dsc_signer: "Arnaud Ferraris <arnaud.ferraris@gmail.com>"
debian_tar_name: "libmbim_1.34.0-1.debian.tar.xz"
debian_tar_url: "https://deb.debian.org/debian/pool/main/libm/libmbim/libmbim_1.34.0-1.debian.tar.xz"
debian_tar_sha256: "3f89429565d1310ef25acf51427caf6f2782e2268cac8d9a384014219aadab39"
dsc_checksums_sha256: |
ba6c1f316b108c0b59c920044a363b7fdcc87d41882b3dfd5a4ece7c003d112b 299023 libmbim_1.34.0.orig.tar.gz
3f89429565d1310ef25acf51427caf6f2782e2268cac8d9a384014219aadab39 15828 libmbim_1.34.0-1.debian.tar.xz
libqmi:
upstream_tag: "1.38.0"
upstream_repo: "https://gitlab.freedesktop.org/mobile-broadband/libqmi.git"
upstream_tag_sha: "5de022769c13a30706deed53185bddfc3c1e30a1"
upstream_commit_sha: "e3d79ed3f7fdc6a7fa8b374860b1c23a8f172812"
signer_fingerprint: "63F6CCDF96229D09286B2AC325BF86524AFCC1E3"
signer_key_file: "keys/63F6CCDF96229D09286B2AC325BF86524AFCC1E3.asc"
orig_tar_name: "libqmi_1.38.0.orig.tar.gz"
orig_tar_url: "https://deb.debian.org/debian/pool/main/libq/libqmi/libqmi_1.38.0.orig.tar.gz"
orig_tar_sha256: "0bb02f08b8dac678540f865cac3cf1156e487aae1d3b350e1c45f03be651bb2e"
salsa_repo: "https://salsa.debian.org/DebianOnMobile-team/libqmi.git"
salsa_tag: "debian/1.38.0-1"
salsa_tag_sha: "4b096a77c2d8a7e82172e0e863e25f93ab31800a"
salsa_commit_sha: "b8f602daeeee8347b6c710ac29c2d51a6449bf84"
dsc_url: "https://deb.debian.org/debian/pool/main/libq/libqmi/libqmi_1.38.0-1.dsc"
dsc_sha256: "0c94dbb7f05937762a2dc26a8c34f855a5065f9a42a14deabeb2dd24d0c04340"
dsc_signer: "Guido Günther <agx@sigxcpu.org>"
debian_tar_name: "libqmi_1.38.0-1.debian.tar.xz"
debian_tar_url: "https://deb.debian.org/debian/pool/main/libq/libqmi/libqmi_1.38.0-1.debian.tar.xz"
debian_tar_sha256: "2a91645df461992da096ea3ae25f20c79be2d767cd3991b5e09ebed9348dbe67"
dsc_checksums_sha256: |
0bb02f08b8dac678540f865cac3cf1156e487aae1d3b350e1c45f03be651bb2e 4395875 libqmi_1.38.0.orig.tar.gz
2a91645df461992da096ea3ae25f20c79be2d767cd3991b5e09ebed9348dbe67 47588 libqmi_1.38.0-1.debian.tar.xz
libqrtr-glib:
upstream_tag: "1.4.0"
upstream_repo: "https://gitlab.freedesktop.org/mobile-broadband/libqrtr-glib.git"
upstream_tag_sha: "459c2042c24b21cb9f05ee0f318b5e6203a2e5c4"
upstream_commit_sha: "69791f8f2a092d0ec8eb83cbe51dfc3d157c3079"
signer_fingerprint: "63F6CCDF96229D09286B2AC325BF86524AFCC1E3"
signer_key_file: "keys/63F6CCDF96229D09286B2AC325BF86524AFCC1E3.asc"
orig_tar_name: "libqrtr-glib_1.4.0.orig.tar.gz"
orig_tar_url: "https://deb.debian.org/debian/pool/main/libq/libqrtr-glib/libqrtr-glib_1.4.0.orig.tar.gz"
orig_tar_sha256: "b57068934577b0070c2f180f3dfcd115ce19efec10aeaf877b8a99c9226aaa2c"
salsa_repo: "https://salsa.debian.org/DebianOnMobile-team/libqrtr-glib.git"
salsa_tag: "debian/1.4.0-1"
salsa_tag_sha: "b886af45dfcc1356748f93fd6db0abe1bb2ac581"
salsa_commit_sha: "0b45abffcc9fafeb50ecbe9ac6f78b94559112ed"
dsc_url: "https://deb.debian.org/debian/pool/main/libq/libqrtr-glib/libqrtr-glib_1.4.0-1.dsc"
dsc_sha256: "736ff0cf0aeb5e78f5d8fcf2858733b7ad5a2d06647b83a50dfb6d3b03d01659"
dsc_signer: "Guido Günther <agx@sigxcpu.org>"
debian_tar_name: "libqrtr-glib_1.4.0-1.debian.tar.xz"
debian_tar_url: "https://deb.debian.org/debian/pool/main/libq/libqrtr-glib/libqrtr-glib_1.4.0-1.debian.tar.xz"
debian_tar_sha256: "3feec39c03c29824a6ce30b3beff6188501e771abca44eff64d9a267f0598241"
dsc_checksums_sha256: |
b57068934577b0070c2f180f3dfcd115ce19efec10aeaf877b8a99c9226aaa2c 29521 libqrtr-glib_1.4.0.orig.tar.gz
3feec39c03c29824a6ce30b3beff6188501e771abca44eff64d9a267f0598241 5084 libqrtr-glib_1.4.0-1.debian.tar.xz