mirror of
https://github.com/backnotprop/plannotator.git
synced 2026-09-14 14:17:26 +08:00
Michael Ramos
7682628db7
* feat(install): Codex opt-out and credential-free attestation verification Implements both asks from #1178 (reported and designed by @astradevkin): - Per-agent installer opt-outs: --skip-codex / --skip-gemini / --skip-kiro flags, PLANNOTATOR_SKIP_{CODEX,GEMINI,KIRO}_INSTALL env vars, and config.json skipInstall.{codex,gemini,kiro} keys, with flag > env > config precedence mirroring verifyAttestation. Detected-but-skipped is reported as its own honest state, never conflated with not-detected, and a skipped agent's home is neither written nor cleaned up. - Credential-free provenance verification: when --verify-attestation is active, the Sigstore bundle is fetched from GitHub's public attestations endpoint (single unauthenticated attempt, no retry) and verified via gh attestation verify --bundle with the same --repo/--source-ref/--signer-workflow constraints; gh's authenticated fetch remains the fallback. TUF trust-root failures are reported as connectivity, distinct from real provenance failures; every path stays fail-closed. Zero behavior change for users who do not opt in: the default install path is unchanged (verified by sandbox-HOME parity runs against main). * fix(install): address #1197 review round (H1 retry, M2-M7, lows) - H1: a failed gh --bundle invocation now retries once through the exact authenticated path before any classification, so an older gh (unknown flag) or a corrupt bundle never reports as a provenance failure. Pinned by a functional stub-gh test; a real failure still fails again on the retry and aborts. - M2: the sh config layer extracts the skipInstall object (awk, character indexed) before matching per-agent keys and honors explicit false as a veto; cmd now parses the real JSON via PowerShell like ps1. Functional tests cover the foreign-key collision and explicit-true cases. - M3: sh names the real cause when the bundle path cannot run (no JSON extractor vs fetch vs extraction failure) and gains python3 and jq fallback extractors; docs state the dependency. - M4: ps1/cmd gate the existing-integration note on plannotator content in hooks.json and word the skip state as what those platforms actually do (manual instructions suppressed). - M5: sh bundle lives inside a private mktemp -d, one rm -rf on every exit, and a mktemp failure degrades to the fallback instead of aborting. - M6: README, verifying-your-install, environment-variables, and installation docs updated for the credential-free path and skip flags. - M7: ps1/cmd extraction replaced with a byte-exact string scanner (no ConvertFrom/ConvertTo round trip, immune to DateTime coercion), with PowerShell-driven unit tests over the captured real attestations response plus synthetic DateTime and brace-in-string controls. - Lows: fail-closed abort pinned by a functional test; TUF beats auth in cmd classification (matches sh/ps1); skipped-state output mentions the shared ~/.agents/skills; Gemini summary is skip-aware and gains an honest not-detected state; --skip-opencode do-not-write switch added (flag, env var, config key) across all three scripts. * fix(install): review round three (EncodedCommand fetcher, mutation-proof fail-closed test, lows) - R1: install.cmd's attestation fetcher no longer touches disk. The %RANDOM%-named %TEMP% .ps1 (predictable-path code execution, the M5 class escalated) is replaced by powershell -NoProfile -EncodedCommand with a base64(UTF-16LE) payload defined next to its full REM PS: plaintext; a test decodes the blob and asserts byte equality with the documented lines plus the security-relevant shape (env-var inputs, ordinal scan, no JSON round trip, distinct exit codes). Inputs still travel via env vars. Verified end to end under pwsh: the decoded blob fetched the real attestations response, wrote 2 bundles, gh verified the real v0.25.1 binary credential-free (exit 0) and rejected a wrong binary (exit 1). - R2: the fail-closed test now asserts the output ENDS with 'Refusing to install.' - mutation-verified: with the verify-failure exit 1 deleted the mutant still exits 1 via an incidental mv failure, but the trailing mv error breaks the endsWith and the test fails; restored, it passes. - Lows: CI guard test fails loudly when process.env.CI is set and no pwsh/powershell is on PATH (scanner coverage cannot silently vanish); scanner IndexOf calls are ordinal in ps1 and the encoded cmd variant; the awk skipInstall extraction requires optional-whitespace-then-colon- then-brace after the key (string values can no longer anchor it, with non-token occurrences skipped, unit-checked against escaped-embedded payloads); install.cmd comments warn that the fallback-reason literals inside parenthesized blocks must stay parenthesis-free.
17 lines
19 KiB
JSON
17 lines
19 KiB
JSON
{
|
|
"attestations": [
|
|
{
|
|
"repository_id": 1123956658,
|
|
"bundle_url": "https://example.com/sanitized-bundle-url",
|
|
"initiator": "github",
|
|
"bundle": {"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIIC0jADAgEAMIICyQYJKoZIhvcNAQcCoIICujCCArYCAQMxDTALBglghkgBZQMEAgIwgbwGCyqGSIb3DQEJEAEEoIGsBIGpMIGmAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgBs4CkDcdkc2lUmwGBM51JC2SJdbde59Pez7t9ndLP2oCFQChbwwQunILVpJZyrf+1aFfnhP+ehgPMjAyNjA3MzAxMjQ0NTNaMAMCAQGgNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIFRpbWVzdGFtcGluZ6AAMYIB3zCCAdsCAQEwSjAyMRUwEwYDVQQKEwxHaXRIdWIsIEluYy4xGTAXBgNVBAMTEFRTQSBpbnRlcm1lZGlhdGUCFBcz29bp/g76H6hT8wF4gebJRzNSMAsGCWCGSAFlAwQCAqCCAQUwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjA3MzAxMjQ0NTNaMD8GCSqGSIb3DQEJBDEyBDCImPVgWW5UY/jcl+XwvpecL+WH0eOkZ410geeaVwZcbPEmJmk7D9KqEkLnPG13ztswgYcGCyqGSIb3DQEJEAIvMXgwdjB0MHIEIEQWyK5zFGpjoTfC5Vvo3nDjya8wc785i6q6qNsIF87XME4wNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIGludGVybWVkaWF0ZQIUFzPb1un+DvofqFPzAXiB5slHM1IwCgYIKoZIzj0EAwMEaDBmAjEAtVCNyYgFJj2GW5x516IxCjpvC/5050RV0fje03ico4daxw4tRyZKQnteVVWwqyLfAjEA7Cs8ddKYlnn4hqzr9P8uKuVOEdSM40/dJJ3zuxIdAWPrMeBVsLDK1s3DSYdBYN5D"}]},"certificate":{"rawBytes":"MIICKzCCAbCgAwIBAgIUFEsbikF1pCGydxjUbs+jmoS800MwCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZGdWxjaW8gSW50ZXJtZWRpYXRlIGwxMB4XDTI2MDYxMjAwMDAwMFoXDTI3MDYxMjAwMDAwMFowKjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMREwDwYDVQQDEwhBdHRlc3RlcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGUVEVNqcSQmA0J45gqVHzCQkSWaZn4DucVDFhO4Q5OWgVdOP4WF44OUvFXQm9lDfRrHMsIVHEbvMfL7SHOVuVWjgaUwgaIwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDrgKNmcXl2HuRedxYt9HulXf/9IMB8GA1UdIwQYMBaAFMDhuFKkS08+3no4EQbPSY6hRZszMC0GA1UdEQQmMCSGImh0dHBzOi8vZG90Y29tLnJlbGVhc2VzLmdpdGh1Yi5jb20wCgYIKoZIzj0EAwMDaQAwZgIxAJnC2khPGWJqZiEFvgyv0rktYBinUh6AkDn43wYSgUhzm8aRUa+rF25Qk1ZeoGi3IAIxAIgIBMwOkMqDQ1DVCJydaIZu1bxtvgX9Anva7kRDZrboNxsAllbdnorYRTm9mxkZaQ=="}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCAic3ViamVjdCI6W3sidXJpIjoicGtnOmdpdGh1Yi9iYWNrbm90cHJvcC9wbGFubm90YXRvckB2MC4yNS4xIiwgImRpZ2VzdCI6eyJzaGExIjoiYjVjZjA2NWNiYWIxYTViMGI1ZWRhZWU5MGUxNDBlNzM4MDY1MDRiYyJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3ItZGFyd2luLWFybTY0IiwgImRpZ2VzdCI6eyJzaGEyNTYiOiIzMmQyOGZhY2RmMzRjNTExOTgyZDM4ZjIyYjVkYjUzYjcxNTI3NTM2ZDJkMGZjMDhmZWMxY2Y4ZjE4YTc2MjU3In19LCB7Im5hbWUiOiJwbGFubm90YXRvci1kYXJ3aW4tYXJtNjQuc2hhMjU2IiwgImRpZ2VzdCI6eyJzaGEyNTYiOiIyMjU0MWIyZDAxNTQ4ZGVhODA3ODdlYjFjNmJmNDA0NzczYTQxMDM3ZTMzZDBiMDg2MDY5OTJjYjlhY2M3MGY2In19LCB7Im5hbWUiOiJwbGFubm90YXRvci1kYXJ3aW4teDY0IiwgImRpZ2VzdCI6eyJzaGEyNTYiOiJjZTQ1ZGQyZTc4OTYxYzM1MTI1ZmJkN2Q5YTVlMjExMjhjYmMwYzE3NGJmNDZmOGY3ZDNjZGQwN2JkNWY3ZGJlIn19LCB7Im5hbWUiOiJwbGFubm90YXRvci1kYXJ3aW4teDY0LnNoYTI1NiIsICJkaWdlc3QiOnsic2hhMjU2IjoiZTY2MjdhYzY0MmNkODY0YTk4YzU5NGM1ODYxOWFjZTQyYThiNDQzNTI0OWJjYTFiM2JkNTMyNzhlNDFiMTY4MyJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3ItbGludXgtYXJtNjQiLCAiZGlnZXN0Ijp7InNoYTI1NiI6IjllZmRhMjA5NWFiZTllYTE2NWJlMjU0NzhjNDlkZjRmMDg2MGQ3YTZhYTBkNjZiYTMxOWI0ZmQ0Njc3OTg4NTQifX0sIHsibmFtZSI6InBsYW5ub3RhdG9yLWxpbnV4LWFybTY0LnNoYTI1NiIsICJkaWdlc3QiOnsic2hhMjU2IjoiZDZjOTI1ODgxOTk3ODM2ZGI5OWMyMzg5M2FiOGRjODZhOGE2NjIzYTc3ZWFlYzVmMmE3Y2VjNjgwNGViMDhhNiJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3ItbGludXgteDY0IiwgImRpZ2VzdCI6eyJzaGEyNTYiOiI1MTYyNTYyZmJiOTdmNzU0YTljODNjMGQ3NDlmYzYyZDIwYmFjZGU1MDljZDVkMmZlY2MwMDQ5MGJkOWRmZTZmIn19LCB7Im5hbWUiOiJwbGFubm90YXRvci1saW51eC14NjQuc2hhMjU2IiwgImRpZ2VzdCI6eyJzaGEyNTYiOiIxMjVmNmQxYzZmNDc0ZmFhNjg3OGEwZGJjNWYyNzQ3NTg4YmMzYzU5M2YzZmJlYzFlOWVjZjlhYmQyMTlhMWRiIn19LCB7Im5hbWUiOiJwbGFubm90YXRvci1wYXN0ZS1kYXJ3aW4tYXJtNjQiLCAiZGlnZXN0Ijp7InNoYTI1NiI6ImJkMzk0YTA3NmRlYWE1M2M1MTkzYjkyZjk0MjljZDY5NGQ4YmIzZGZiMzkyNjYzMzgyMjQ5M2M0ZTFhMTQ3MmUifX0sIHsibmFtZSI6InBsYW5ub3RhdG9yLXBhc3RlLWRhcndpbi1hcm02NC5zaGEyNTYiLCAiZGlnZXN0Ijp7InNoYTI1NiI6ImVjODdkNTg1MzhjOTIxNDkzYzRhMGFjMDkxNmE0YmY0YmNkYjBmMDYxMDQ3MzFlODQ3ODFmMTQ3NTJiMDUwMzUifX0sIHsibmFtZSI6InBsYW5ub3RhdG9yLXBhc3RlLWRhcndpbi14NjQiLCAiZGlnZXN0Ijp7InNoYTI1NiI6IjgwZWZmZGMzN2JkZDQzZDI3MmM1NDJhMDllM2VkZGEzMTczOGY2YjIzMGFjMjkxNGE3YTE3MTJjNTU0ODY0M2QifX0sIHsibmFtZSI6InBsYW5ub3RhdG9yLXBhc3RlLWRhcndpbi14NjQuc2hhMjU2IiwgImRpZ2VzdCI6eyJzaGEyNTYiOiJkZTcxNmIzY2E2NDkzNDZiYzNjZDI3NmY5MmE5ZDVkODcxMzJhN2I3NWIxODNlMTIzODY1ZGY0NDA5ZTQ0ZjcwIn19LCB7Im5hbWUiOiJwbGFubm90YXRvci1wYXN0ZS1saW51eC1hcm02NCIsICJkaWdlc3QiOnsic2hhMjU2IjoiYWYxNWM4YjY4ZmZhN2JmMzg4M2U2ZGEwNDFmOGZmOWNkYTA1ODJhNTI2NTM3ODVmZmUzMjdjNDJiNGIyZGQyOCJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3ItcGFzdGUtbGludXgtYXJtNjQuc2hhMjU2IiwgImRpZ2VzdCI6eyJzaGEyNTYiOiI1ZDUyY2NkMWZlNDUzNmZhMTVhOWViYTQzMGRlMWUzNmQzZGQ1ZTk3ODM4OWVjODFkMDA0NTliMmZlNGJiZTZlIn19LCB7Im5hbWUiOiJwbGFubm90YXRvci1wYXN0ZS1saW51eC14NjQiLCAiZGlnZXN0Ijp7InNoYTI1NiI6IjNmZTliOGZhOTRkMjUyNTc4NjBjNjc4ZWM1MTY0MDRkMzVlMmViNzFkNjI4YTcyY2U1MzY5ZDVhMDVhNjMwMWUifX0sIHsibmFtZSI6InBsYW5ub3RhdG9yLXBhc3RlLWxpbnV4LXg2NC5zaGEyNTYiLCAiZGlnZXN0Ijp7InNoYTI1NiI6ImZjM2NlMDQyYmUzMjgxYmY2MDRkYjNmYmU2YzFlZDExMTBhMmNkODdhOTJmZDVkZTNlYWFjY2Y1ZTBlOGM1N2QifX0sIHsibmFtZSI6InBsYW5ub3RhdG9yLXBhc3RlLXdpbjMyLWFybTY0LmV4ZSIsICJkaWdlc3QiOnsic2hhMjU2IjoiM2RkNWYwM2ZlYzMwNGFmNmY0M2QyZTUzZGRhYjIyN2Y5OTJlZTkzNGY5ZWFhNzFlYTI5NmIzMzE2Y2RkMTY2ZCJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3ItcGFzdGUtd2luMzItYXJtNjQuZXhlLnNoYTI1NiIsICJkaWdlc3QiOnsic2hhMjU2IjoiOWI0M2RhZjA2MGVhZWE0MTg1NzY5OWRlOTMzN2I3OGZmZDM2ZTM2NDBjYmRlNzdiYmU2Mjk3MDU4ZjA3YmM2ZCJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3ItcGFzdGUtd2luMzIteDY0LmV4ZSIsICJkaWdlc3QiOnsic2hhMjU2IjoiNDZmZDVmNzFhMWE5Yjg3ZmUxZGJkOGVjMjkwYTAxOTUwNzVhNGVhMThjNTMzNmYwZTQxNDBmMTQwOWRmOTc3ZSJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3ItcGFzdGUtd2luMzIteDY0LmV4ZS5zaGEyNTYiLCAiZGlnZXN0Ijp7InNoYTI1NiI6IjYzM2E4OTkzNmQ1MTYyYzQwYTNlMzJjNTYyMGUxYTU3ZWJkYzc1MDc4ODVkNjE1Y2M1OTcxMWY4NTJmYWFjZWUifX0sIHsibmFtZSI6InBsYW5ub3RhdG9yLXdpbjMyLWFybTY0LmV4ZSIsICJkaWdlc3QiOnsic2hhMjU2IjoiYWU3NzhiNjMyZDBhNDUwMmI2N2Q0MDIyZDQ3OTQzM2MwYWI3YWJjOGU2MzliN2MxNzI0OTJhNDQ2Y2M0MjY1MyJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3Itd2luMzItYXJtNjQuZXhlLnNoYTI1NiIsICJkaWdlc3QiOnsic2hhMjU2IjoiOWM0ZjhiNDQzY2NkZTk2NTQ3NmQxZDdkMDc4OGI4Mjc4ZGY5ZjEzOTg0NWZjMmI0MjkzNjljY2RiMjg0MjY4ZiJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3Itd2luMzIteDY0LmV4ZSIsICJkaWdlc3QiOnsic2hhMjU2IjoiYmU0ZGQ3NjJmYmQzMDUzM2I2NmQxMDQxMmY3ZjlkMTc0ZDI1MDczMmRhMzQzOGE2MjBjZjdlNjBlZGQ3NGJlMyJ9fSwgeyJuYW1lIjoicGxhbm5vdGF0b3Itd2luMzIteDY0LmV4ZS5zaGEyNTYiLCAiZGlnZXN0Ijp7InNoYTI1NiI6IjM4YTZlMDJjYzBiNTYxZWI4ODA5OTI4ZGE3ZDA4MjZmMzExOTdjMDIzOTQ4NWE3YjQ5ODI0OWMxYTlmYzMyZWUifX1dLCAicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9hdHRlc3RhdGlvbi9yZWxlYXNlL3YwLjIiLCAicHJlZGljYXRlIjp7ImRhdGFiYXNlSWQiOiIzNjI0Mjc3MDMiLCAib3duZXJJZCI6IjcyNDQzMTciLCAicGFja2FnZUlkIjoiMTEyMzk1NjY1OCIsICJwdXJsIjoicGtnOmdpdGh1Yi9iYWNrbm90cHJvcC9wbGFubm90YXRvckB2MC4yNS4xIiwgInJlcG9zaXRvcnkiOiJiYWNrbm90cHJvcC9wbGFubm90YXRvciIsICJyZXBvc2l0b3J5SWQiOiIxMTIzOTU2NjU4IiwgInRhZyI6InYwLjI1LjEifX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIFZEV4JzRIPVyvG48YuleaLQSMnRcDc/KsYx/Vl8oIBoAiEAgQThvowSHbWusyZbJjJDRvdyX046dfh1JQTh4i4QodY="}]}}
|
|
},
|
|
{
|
|
"repository_id": 1123956658,
|
|
"bundle_url": "https://example.com/sanitized-bundle-url",
|
|
"initiator": "user",
|
|
"bundle": {"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"tlogEntries":[{"logIndex":"2290446847","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1785415430","inclusionPromise":{"signedEntryTimestamp":"MEQCIC2WZDl+c6xEoVqiU8ZxzI5b6o4lycrF8DpqWuc+Yg9kAiAPYNjaRpL8vop6PpvWgy5mvzhSmbMKaKd1LIxDb1qIUA=="},"inclusionProof":{"logIndex":"2168542585","rootHash":"8B+SlxGzhbsCCVt012TM4GzVQMfVx52EkiSzkglnD7Y=","treeSize":"2168542635","hashes":["QtYdsHEx6QcpB9+4jNpkT2oi/A+SP4leBYLN2ts0v94=","0Uw+RJ/0p+iDvkEFTGJDBr4SixL37jycRs9svX0F6jw=","00x8qwXlGIV6IMAhGtQZqeWWNWkf93uFbnCD0FoJfGQ=","WgR+aSeRY2ZtjG67NBUdXE1mXQtAmCH4dHRWum/ANFo=","ZvSvymIH20JWZNJyrWsDD5Fnei8PPrnn8GIgQosIg6c=","7hMtV8ur1wkwbfqS/katSvNjlr+FYA8EOHYfDasMhMw=","piZsCMZAazfRioapcT2sFoWS7cdD6nEp1KUSk/ugdzg=","F3VPwHkj7ibmOgJFU3ZrYM9RHeL+XiQshyFBYo8kiq8=","4GQBHEF4o6G1rIe6ww/+jj1z6EaoaxEVXZgpVgRBwSE=","gtTxXJGtec2r9zCtm2wicg6dBJrh23scz6+gtk9Y8ko=","Za2Wvn4GtUlQwtW+8CVNcAPYhWZ8BvNSq3ScMiUyIY0=","T/vTYTs9rK3RfR+/1Dkp5HI10fbuPrhlqmp24cmEPio=","oc9F7Y6pa5WUxI69qr8HbXN1wSC9c/JAcJXwfgs01D0=","Tw3qDMwFCiefBXC++s1wcgTvtYFvLiigWQR8m49I3eE=","gFCDLuUICPUD+cTxcpdc20bh3Ddh2oUrPn7Cy0NnyoE=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n2168542635\n8B+SlxGzhbsCCVt012TM4GzVQMfVx52EkiSzkglnD7Y=\n\n— rekor.sigstore.dev wNI9ajBFAiBSHBzeVwFSMhbLaYe4Oi6KzzJwLLhhowwGskiffPyGDwIhANiW2W43QGqZR1ddgKKjWddwjk8aQhonQ/oK24DMkdQ4\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNmU1YWM0NmIxN2Q2NDJmZDgzOTU5YTEyZjIyZjUwMmFkNTM0MTYwYWIyMzY0ODEwYTY3MmQyY2Y5NGIwZGYwNSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjNlNDcxYWJjYTAwMjkxMTVmM2M5NzAyNDg2ZmRmNTcxMWIyOGNhNzNmZmRlMTIzOGNhZTVmZmMzYzNiMWRlZTcifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVZQ0lRRDQrUFcyVlNTMWYyTStjWllnYXkwMWNJRmRyaG0wRmdobVhya21LTW5JS0FJaEFKaUFXWEhOUmFzNWxPV0dlQUZkSTFJZmNyZGlHY3ptTnp1cWU2VitIQXE2IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VoSFZFTkRRbkFyWjBGM1NVSkJaMGxWWm5WM2FYZHJNR0kyUjBaalpsSnZhbkYwVmxod1FWZGFXRWhGZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwWmQwNTZUWGROVkVrd1RYcFJOVmRvWTA1TmFsbDNUbnBOZDAxVVNURk5lbEUxVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVnVja1o2TVROVU5WSTBRMk5OTHpkRlZ6aGlabTl1TnpGRFdWaFNaMloxV1hCR1MxTUtkVkpLVkdKU1lWSlRjVkpJVTJWNFVFeDVVWGRLYjNKVmVtWlFkRVJIYzJvclVIZGxZVkZHU25kbVZuQmtNRVowYVRaUFEwSmlOSGRuWjFjMlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVm5WR2x3Q210U1JVZEVRVFpsU0cweWJYcDRaWGxyY25Wa1VFZEpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMkZCV1VSV1VqQlNRVkZJTDBKR05IZFlTVnBoWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBUREpLYUZreWRIVmlNMUozWTIwNWR3cE1NMEp6V1ZjMWRXSXpVbWhrUnpsNVRIazFibUZZVW05a1YwbDJaREk1ZVdFeVduTmlNMlI2VEROS2JHSkhWbWhqTWxWMVpWY3hjMUZJU214YWJrMTJDbVJIUm01amVUa3lUVU0wZVU1VE5IaE5SR3RIUTJselIwRlJVVUpuTnpoM1FWRkZSVXN5YURCa1NFSjZUMms0ZG1SSE9YSmFWelIxV1ZkT01HRlhPWFVLWTNrMWJtRllVbTlrVjBveFl6SldlVmt5T1hWa1IxWjFaRU0xYW1JeU1IZEZaMWxMUzNkWlFrSkJSMFIyZWtGQ1FXZFJSV05JVm5waFJFRXlRbWR2Y2dwQ1owVkZRVmxQTDAxQlJVUkNRMmhwVGxkT2JVMUVXVEZaTWtwb1dXcEdhRTVYU1hkWmFsWnNXa2RHYkZwVWEzZGFWRVV3VFVkVk0wMTZaM2RPYWxWM0NrNUhTbXBOUWxWSFEybHpSMEZSVVVKbk56aDNRVkZSUlVJeFNteGlSMVpvWXpKVmQwcFJXVXRMZDFsQ1FrRkhSSFo2UVVKQ1VWRllXVzFHYW1FeU5YWUtaRWhDZVdJelFYWmpSM2hvWW0wMWRtUkhSakJpTTBsM1NIZFpTMHQzV1VKQ1FVZEVkbnBCUWtKblVWSmpiVlp0WTNrNU1GbFhaSHBNTTFsM1RHcEpNUXBNYWtWM1QzZFpTMHQzV1VKQ1FVZEVkbnBCUWtOQlVYUkVRM1J2WkVoU2QyTjZiM1pNTTFKMllUSldkVXh0Um1wa1IyeDJZbTVOZFZveWJEQmhTRlpwQ21SWVRteGpiVTUyWW01U2JHSnVVWFZaTWpsMFRVZHZSME5wYzBkQlVWRkNaemM0ZDBGUmEwVllRWGhoWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hVS1dUSTVkRXd5U21oWk1uUjFZak5TZDJOdE9YZE1NMEp6V1ZjMWRXSXpVbWhrUnpsNVRIazFibUZZVW05a1YwbDJaREk1ZVdFeVduTmlNMlI2VEROS2JBcGlSMVpvWXpKVmRXVlhNWE5SU0Vwc1dtNU5kbVJIUm01amVUa3lUVU0wZVU1VE5IaE5SR2RIUTJselIwRlJVVUpuTnpoM1FWRnZSVXRuZDI5WmFsWnFDbHBxUVRKT1YwNXBXVmRKZUZsVVZtbE5SMGt4V2xkU2FGcFhWVFZOUjFWNFRrUkNiRTU2VFRSTlJGa3hUVVJTYVZsNlFXUkNaMjl5UW1kRlJVRlpUeThLVFVGRlRFSkJPRTFFVjJSd1pFZG9NVmxwTVc5aU0wNHdXbGRSZDA5bldVdExkMWxDUWtGSFJIWjZRVUpFUVZGelJFTndiMlJJVW5kamVtOTJUREprY0Fwa1IyZ3hXV2sxYW1JeU1IWlpiVVpxWVRJMWRtUklRbmxpTTBGMlkwZDRhR0p0Tlhaa1IwWXdZak5KZDA5QldVdExkMWxDUWtGSFJIWjZRVUpFVVZGeENrUkRhR2xPVjA1dFRVUlpNVmt5U21oWmFrWm9UbGRKZDFscVZteGFSMFpzV2xScmQxcFVSVEJOUjFVelRYcG5kMDVxVlhkT1IwcHFUVU5GUjBOcGMwY0tRVkZSUW1jM09IZEJVVFJGUlhkM1VtTnRWbTFqZVRrd1dWZGtla3d6V1hkTWFra3hUR3BGZDBkbldVdExkMWxDUWtGSFJIWjZRVUpFZDFGTlJFRnZlQXBOVkVsNlQxUlZNazVxVlRSTlF6UkhRMmx6UjBGUlVVSm5OemgzUVZKQlJVbEJkMlZoU0ZJd1kwaE5Oa3g1T1c1aFdGSnZaRmRKZFZreU9YUk1Na3BvQ2xreWRIVmlNMUozWTIwNWQwMUNZMGREYVhOSFFWRlJRbWMzT0hkQlVrVkZRMUYzU0U1NlNUQk9SRTE0VG5wQ2NVSm5iM0pDWjBWRlFWbFBMMDFCUlZNS1FrWjNUVmR0YURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RtSlRPV2xaVjA1eVltMDVNR05JU25aalF6bDNZa2RHZFdKdE9UQlpXRkoyWTJrNGRRcGFNbXd3WVVoV2FVd3paSFpqYlhSdFlrYzVNMk41T1hsYVYzaHNXVmhPYkV4dWJIUmlSVUo1V2xkYWVrd3pVbWhhTTAxMlpHcEJkVTFxVlhWTlZFRTBDa0puYjNKQ1owVkZRVmxQTDAxQlJWUkNRMjlOUzBkSk1Wa3lXWGRPYWxacVdXMUdhVTFYUlRGWmFrSnBUbGRXYTFsWFZteFBWRUpzVFZSUmQxcFVZM29LVDBSQk1rNVVRVEJaYlUxM1JrRlpTMHQzV1VKQ1FVZEVkbnBCUWtaQlVVZEVRVkozWkZoT2IwMUdORWREYVhOSFFWRlJRbWMzT0hkQlVsVkZWVUY0VHdwaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTWtwb1dUSjBkV0l6VW5kamJUbDNURE5DYzFsWE5YVmlNMUpvWkVjNWVVd3lSbXBrUjJ4MkNtSnVUWFpqYmxaMVkzazRlazFFVlhwT1JFRjNUMVJKTVU5RE9XaGtTRkpzWWxoQ01HTjVPSGxOUWxsSFEybHpSMEZSVVVKbk56aDNRVkpaUlVOQmQwY0tZMGhXYVdKSGJHcE5SVWxIUTJselIwRlJVVUpuTnpoM1FWSm5SVTVCZDNsamJWWjNZbnB3YVZsWFRuSmliVGt3WTBoS2RtTkRPWGRpUjBaMVltMDVNQXBaV0ZKMlkycHdlVnBYV1RaamJWWnRZM2s1TUZsWFpIcE1NMWwzVEdwSk1VeHFSWGRuV1c5SFEybHpSMEZSVVVJeGJtdERRa0ZKUldaQlVqWkJTR2RCQ21SblJHUlFWRUp4ZUhOalVrMXRUVnBJYUhsYVducGpRMjlyY0dWMVRqUTRjbVlyU0dsdVMwRk1lVzUxYW1kQlFVRmFLM3BFVnpSQlFVRkJSVUYzUWtnS1RVVlZRMGxSUTJac0t6TmhTVmc1Y0dWd0swMUhOMk5GUzFKaWVqQnhiaTh2TW01a1JGQmxSMjA0WW1KVFNYUjNWMmRKWjJFd2QwMDVVWEpPYmtzMVdBcEpUVTloT0c1dVFUaDJabEJIYTFCT1IxWktkekpIYUZKblYxTk1WRkpKZDBObldVbExiMXBKZW1vd1JVRjNUVVJoUVVGM1dsRkplRUZRSzJkVVRsTlNDa0V6VVcwM1VUaHBTVFJqU0dzclNtUnlOMXBDTmt4TmIwTXdPV3hvUTNRemNrMXRSWE5GU2tseWNEY3ljMGh4UmxrNFRtMDVUbGgxV25kSmQwZGhVbVlLV21kd1dXbHNXWHA2TDNaNE9XeFRXVmxvUmtOSFNESlFXRUpOV1hCV1ZtYzNiVTE2V0dGVldGZEdRVFZQWnpNM1RqUnZORU5OWW5KSWNuRjNDaTB0TFMwdFJVNUVJRU5GVWxSSlJrbERRVlJGTFMwdExTMEsifV19fQ=="}],"timestampVerificationData":{},"certificate":{"rawBytes":"MIIHGTCCBp+gAwIBAgIUfuwiwk0b6GFcfRojqtVXpAWZXHEwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwNzMwMTI0MzQ5WhcNMjYwNzMwMTI1MzQ5WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnrFz13T5R4CcM/7EW8bfon71CYXRgfuYpFKSuRJTbRaRSqRHSexPLyQwJorUzfPtDGsj+PweaQFJwfVpd0Fti6OCBb4wggW6MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUgTipkREGDA6eHm2mzxeykrudPGIwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8waAYDVR0RAQH/BF4wXIZaaHR0cHM6Ly9naXRodWIuY29tL2JhY2tub3Rwcm9wL3BsYW5ub3RhdG9yLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvdGFncy92MC4yNS4xMDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wEgYKKwYBBAGDvzABAgQEcHVzaDA2BgorBgEEAYO/MAEDBChiNWNmMDY1Y2JhYjFhNWIwYjVlZGFlZTkwZTE0MGU3MzgwNjUwNGJjMBUGCisGAQQBg78wAQQEB1JlbGVhc2UwJQYKKwYBBAGDvzABBQQXYmFja25vdHByb3AvcGxhbm5vdGF0b3IwHwYKKwYBBAGDvzABBgQRcmVmcy90YWdzL3YwLjI1LjEwOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMGoGCisGAQQBg78wAQkEXAxaaHR0cHM6Ly9naXRodWIuY29tL2JhY2tub3Rwcm9wL3BsYW5ub3RhdG9yLy5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvdGFncy92MC4yNS4xMDgGCisGAQQBg78wAQoEKgwoYjVjZjA2NWNiYWIxYTViMGI1ZWRhZWU5MGUxNDBlNzM4MDY1MDRiYzAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwOgYKKwYBBAGDvzABDAQsDCpodHRwczovL2dpdGh1Yi5jb20vYmFja25vdHByb3AvcGxhbm5vdGF0b3IwOAYKKwYBBAGDvzABDQQqDChiNWNmMDY1Y2JhYjFhNWIwYjVlZGFlZTkwZTE0MGU3MzgwNjUwNGJjMCEGCisGAQQBg78wAQ4EEwwRcmVmcy90YWdzL3YwLjI1LjEwGgYKKwYBBAGDvzABDwQMDAoxMTIzOTU2NjU4MC4GCisGAQQBg78wARAEIAweaHR0cHM6Ly9naXRodWIuY29tL2JhY2tub3Rwcm9wMBcGCisGAQQBg78wAREECQwHNzI0NDMxNzBqBgorBgEEAYO/MAESBFwMWmh0dHBzOi8vZ2l0aHViLmNvbS9iYWNrbm90cHJvcC9wbGFubm90YXRvci8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjAuMjUuMTA4BgorBgEEAYO/MAETBCoMKGI1Y2YwNjVjYmFiMWE1YjBiNWVkYWVlOTBlMTQwZTczODA2NTA0YmMwFAYKKwYBBAGDvzABFAQGDARwdXNoMF4GCisGAQQBg78wARUEUAxOaHR0cHM6Ly9naXRodWIuY29tL2JhY2tub3Rwcm9wL3BsYW5ub3RhdG9yL2FjdGlvbnMvcnVucy8zMDUzNDAwOTI1OC9hdHRlbXB0cy8yMBYGCisGAQQBg78wARYECAwGcHVibGljMEIGCisGAQQBg78wARgENAwycmVwbzpiYWNrbm90cHJvcC9wbGFubm90YXRvcjpyZWY6cmVmcy90YWdzL3YwLjI1LjEwgYoGCisGAQQB1nkCBAIEfAR6AHgAdgDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAZ+zDW4AAAAEAwBHMEUCIQCfl+3aIX9pep+MG7cEKRbz0qn//2ndDPeGm8bbSItwWgIga0wM9QrNnK5XIMOa8nnA8vfPGkPNGVJw2GhRgWSLTRIwCgYIKoZIzj0EAwMDaAAwZQIxAP+gTNSRA3Qm7Q8iI4cHk+Jdr7ZB6LMoC09lhCt3rMmEsEJIrp72sHqFY8Nm9NXuZwIwGaRfZgpYilYzz/vx9lSYYhFCGH2PXBMYpVVg7mMzXaUXWFA5Og37N4o4CMbrHrqw"}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGxhbm5vdGF0b3ItZGFyd2luLWFybTY0IiwiZGlnZXN0Ijp7InNoYTI1NiI6IjMyZDI4ZmFjZGYzNGM1MTE5ODJkMzhmMjJiNWRiNTNiNzE1Mjc1MzZkMmQwZmMwOGZlYzFjZjhmMThhNzYyNTcifX0seyJuYW1lIjoicGxhbm5vdGF0b3ItZGFyd2luLXg2NCIsImRpZ2VzdCI6eyJzaGEyNTYiOiJjZTQ1ZGQyZTc4OTYxYzM1MTI1ZmJkN2Q5YTVlMjExMjhjYmMwYzE3NGJmNDZmOGY3ZDNjZGQwN2JkNWY3ZGJlIn19LHsibmFtZSI6InBsYW5ub3RhdG9yLWxpbnV4LXg2NCIsImRpZ2VzdCI6eyJzaGEyNTYiOiI1MTYyNTYyZmJiOTdmNzU0YTljODNjMGQ3NDlmYzYyZDIwYmFjZGU1MDljZDVkMmZlY2MwMDQ5MGJkOWRmZTZmIn19LHsibmFtZSI6InBsYW5ub3RhdG9yLWxpbnV4LWFybTY0IiwiZGlnZXN0Ijp7InNoYTI1NiI6IjllZmRhMjA5NWFiZTllYTE2NWJlMjU0NzhjNDlkZjRmMDg2MGQ3YTZhYTBkNjZiYTMxOWI0ZmQ0Njc3OTg4NTQifX0seyJuYW1lIjoicGxhbm5vdGF0b3Itd2luMzIteDY0LmV4ZSIsImRpZ2VzdCI6eyJzaGEyNTYiOiJiZTRkZDc2MmZiZDMwNTMzYjY2ZDEwNDEyZjdmOWQxNzRkMjUwNzMyZGEzNDM4YTYyMGNmN2U2MGVkZDc0YmUzIn19LHsibmFtZSI6InBsYW5ub3RhdG9yLXdpbjMyLWFybTY0LmV4ZSIsImRpZ2VzdCI6eyJzaGEyNTYiOiJhZTc3OGI2MzJkMGE0NTAyYjY3ZDQwMjJkNDc5NDMzYzBhYjdhYmM4ZTYzOWI3YzE3MjQ5MmE0NDZjYzQyNjUzIn19LHsibmFtZSI6InBsYW5ub3RhdG9yLXBhc3RlLWRhcndpbi1hcm02NCIsImRpZ2VzdCI6eyJzaGEyNTYiOiJiZDM5NGEwNzZkZWFhNTNjNTE5M2I5MmY5NDI5Y2Q2OTRkOGJiM2RmYjM5MjY2MzM4MjI0OTNjNGUxYTE0NzJlIn19LHsibmFtZSI6InBsYW5ub3RhdG9yLXBhc3RlLWRhcndpbi14NjQiLCJkaWdlc3QiOnsic2hhMjU2IjoiODBlZmZkYzM3YmRkNDNkMjcyYzU0MmEwOWUzZWRkYTMxNzM4ZjZiMjMwYWMyOTE0YTdhMTcxMmM1NTQ4NjQzZCJ9fSx7Im5hbWUiOiJwbGFubm90YXRvci1wYXN0ZS1saW51eC14NjQiLCJkaWdlc3QiOnsic2hhMjU2IjoiM2ZlOWI4ZmE5NGQyNTI1Nzg2MGM2NzhlYzUxNjQwNGQzNWUyZWI3MWQ2MjhhNzJjZTUzNjlkNWEwNWE2MzAxZSJ9fSx7Im5hbWUiOiJwbGFubm90YXRvci1wYXN0ZS1saW51eC1hcm02NCIsImRpZ2VzdCI6eyJzaGEyNTYiOiJhZjE1YzhiNjhmZmE3YmYzODgzZTZkYTA0MWY4ZmY5Y2RhMDU4MmE1MjY1Mzc4NWZmZTMyN2M0MmI0YjJkZDI4In19LHsibmFtZSI6InBsYW5ub3RhdG9yLXBhc3RlLXdpbjMyLXg2NC5leGUiLCJkaWdlc3QiOnsic2hhMjU2IjoiNDZmZDVmNzFhMWE5Yjg3ZmUxZGJkOGVjMjkwYTAxOTUwNzVhNGVhMThjNTMzNmYwZTQxNDBmMTQwOWRmOTc3ZSJ9fSx7Im5hbWUiOiJwbGFubm90YXRvci1wYXN0ZS13aW4zMi1hcm02NC5leGUiLCJkaWdlc3QiOnsic2hhMjU2IjoiM2RkNWYwM2ZlYzMwNGFmNmY0M2QyZTUzZGRhYjIyN2Y5OTJlZTkzNGY5ZWFhNzFlYTI5NmIzMzE2Y2RkMTY2ZCJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vYWN0aW9ucy5naXRodWIuaW8vYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL3RhZ3MvdjAuMjUuMSIsInJlcG9zaXRvcnkiOiJodHRwczovL2dpdGh1Yi5jb20vYmFja25vdHByb3AvcGxhbm5vdGF0b3IiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTEyMzk1NjY1OCIsInJlcG9zaXRvcnlfb3duZXJfaWQiOiI3MjQ0MzE3IiwicnVubmVyX2Vudmlyb25tZW50IjoiZ2l0aHViLWhvc3RlZCJ9fSwicmVzb2x2ZWREZXBlbmRlbmNpZXMiOlt7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vYmFja25vdHByb3AvcGxhbm5vdGF0b3JAcmVmcy90YWdzL3YwLjI1LjEiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiYjVjZjA2NWNiYWIxYTViMGI1ZWRhZWU5MGUxNDBlNzM4MDY1MDRiYyJ9fV19LCJydW5EZXRhaWxzIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL2dpdGh1Yi5jb20vYmFja25vdHByb3AvcGxhbm5vdGF0b3IvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy90YWdzL3YwLjI1LjEifSwibWV0YWRhdGEiOnsiaW52b2NhdGlvbklkIjoiaHR0cHM6Ly9naXRodWIuY29tL2JhY2tub3Rwcm9wL3BsYW5ub3RhdG9yL2FjdGlvbnMvcnVucy8zMDUzNDAwOTI1OC9hdHRlbXB0cy8yIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEYCIQD4+PW2VSS1f2M+cZYgay01cIFdrhm0FghmXrkmKMnIKAIhAJiAWXHNRas5lOWGeAFdI1IfcrdiGczmNzuqe6V+HAq6"}]}}
|
|
}
|
|
]
|
|
}
|