[avrabe]

This PR adds the pgp-sums ingestion rung, discharging REQ-SIGNEDSUMS-001 for v0.47.0. A publisher's PGP-signed digest list now counts as proof of origin, and is never confused with an unsigned list. It also carries the REQ-VERIFYPAR-001 rewording, a rivet-only commit.

What it does

Input. The producer's committed tool entry gains four fields:

Field	Meaning
pgp-sums	The digest list's asset name or template
pgp-sums-signature	The detached signature; defaults to the list name plus .asc
pgp-sums-format	sha256sums (default) or rust-channel
pgp-key-file	The pinned OpenPGP certificate, relative to the input file

The key lives in producer input, not in the realm. The maintainer decided this on 2026-11-08 (factory-notice 20261107T163508-5f01e8): a realms-file field would make every released varve refuse the realms file, and consumers never verify the upstream signature themselves. Clauses 2 and 3 are reworded to match, and DD-034 notes the change. The key is never fetched, and never read from beside the artifact.

Ladder position. cosign-sums, then build-provenance, then pgp-sums, then upstream-sums. A failure of any kind is fatal and never falls through to a weaker rung. That covers a bad signature, another key, a revoked certificate, a text-type signature, a weak digest, a missing signature, a fetch error, an unparseable list, an absent asset, a digest mismatch, and the wrong release.

Clause 5. Digests are reachable only through a VerifiedList, whose fields are private. The ladder's PgpSumsProbe::Verified can be built only from one. A compile_fail doctest holds this.

What the signed manifest records:

• proof = pgp-sums.
• proof-signer = openpgp:<primary fingerprint> (<user ID>). The identity is the fingerprint; the user ID is only a label.
• A separate proof-signing-key field, holding the fingerprint of the key that actually signed.
• proof-asserts, which names the release the list was bound to.

An older varve reads an unknown proof string as UnknownProof and prints it. It does not refuse the layer.

OCI encoding: it refuses to encode any pgp-sums field rather than silently drop the mechanism.

Which key may vouch (clauses 1 and 3)

A subkey vouches only if all of these hold:

• Its newest binding from the primary states SIGN. A binding with no flags refuses, and in a same-second tie the binding without SIGN wins.
• It carries the 0x19 back-signature. rPGP enforces this.
• No entry with its fingerprint carries a SubkeyRevocation.
• Its binding and back-signature meet the 256-bit digest floor.

The primary key:

• It refuses if the newest direct-key signature, or the newest certification on a non-revoked user ID, states flags without SIGN.
• It refuses if no eligible self-signature remains.
• If both are silent, it refuses whenever any self-signature anywhere stated flags. A certificate that states no flags at all, like Rust's, is unrestricted.
• Deliberate exception: the primary's own self-certification is not held to the 256-bit floor, because Rust's release key certifies itself with SHA-1 and must keep verifying. A test pins this. That signature only states flags and grants the pinned key nothing.

The data signature:

• It must be binary type, with a digest of at least 256 bits.
• It needs a hashed creation time.
• Critical hashed subpackets other than creation time and issuer are refused.
• Signature, binding and key expiry are recorded in clause 6 as not checked, for want of a trusted clock.

Release binding (clause 7, new)

A signature says who published the digests, not which release they belong to.

sha256sums format:

• %V or %R must expand to a token that names exactly one release: MAJOR.MINOR[.PATCH] with an optional suffix, or a full date.
• The token is refused if it contains wildcards, or moving words such as latest, lts or stable.
• It is also refused if its last segment is a cycle label (nightly, snapshot, dev and similar) not followed by a number.
• /, % and whitespace are refused.
• Both the list name and every asset template must carry the version.
• At ingestion, every expanded asset name must contain the concrete version on a token boundary.

rust-channel format:

• A stable channel binds by version.
• A prerelease (-nightly, -beta) binds by the manifest's date.

Plans that disagree. Plans of one (repo, release) group that disagree on pgp-sums or upstream-sums are refused before anything is fetched.

Limits stated in the docs:

• This is a check on names, not a cryptographic binding.
• A hub release whose payloads carry different versions cannot use pgp-sums. It fails closed.

Reviews

Clean-room review of 1bfdc9d. Of nine claims, four were confirmed (R2, R3, R5, R8), four partial and one confirmed with one test that cannot fail.

• Medium-high: a revoked signing subkey was accepted.
• Medium: nightly replay; moving tags; the probe type could be built without verifying.
• Low: the subkey was not a separate field; the documentation had drifted.

All fixed, each with a test that fails before the fix.

Adversarial review of 866f161, focused on key usage and release binding.

• No forgery found: no signature that should not count got through without the upstream's private key or an altered pinned certificate.
• Medium: channel-wide prerelease labels passed as one release.
• Low:
  • a substring version re-check;
  • weak-hash bindings;
  • critical notation and a missing creation time were accepted;
  • per-entry revocation;
  • same-second ties decided by packet order.

All fixed, each with a test that fails before the fix.

Automated security reviews raised:

• the group-disagreement fail-open;
• the replay of an older signed list;
• moving tags;
• the newest-self-signature and restriction-stated-anywhere rules;
• a loose names_a_release.

All fixed, each with a test.

Not in this PR. The same replay gap in the existing rungs (cosign-sums, build-provenance, upstream-sums) is tracked privately as a draft security advisory and will be fixed in a following v0.47.0 PR.

Evidence

Negative controls, each restored after:

Change to production code	Red tests
Ignore a failed pgp rung	10
Disable the plan-time version check	3
Make channel_is_for always accept	2
Drop the subkey revocation check	1
Raw member paths, from the earlier review fixes	1

Mutants on the final tree, restricted to the changed files:

Shard	Tested	Caught	Unviable	Missed
pgp (pgpsums.rs)	85	70	15	0
varve-producer (plan.rs)	87	79	8	0
forge (orchestrate.rs)	79	70	9	0
delta (delta.rs and ingest.rs), earlier round	48	45	3	0

Rust channel end to end: the real channel-rust-stable.toml and its .asc verify against Rust's real key and yield 1213 (url, digest) pairs. An asset gets its digest from the verified list, and the proof signer starts with Rust's fingerprint.

Local gates, on fa8f1ec

• cargo fmt --check: OK.
• clippy with -D warnings: clean.
• Workspace tests: 2105 passed, 0 failed.
• tools unittest: OK.
• rivet validate: exits 0.
• rivet check verification-evidence, trace-gate, claim-check, tracepack-check and review-check all exit 0.
• tools/systest/install-shadow.sh: exits 0.
• shellcheck 0.11.0, -S warning: clean.
• cargo deny check: exits 0.

🤖 Generated with Claude Code

https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu