Attest distributed PDF artifacts and visual fidelity #9

Closed

clawlter wants to merge 9 commits from audit/pdf-artifact-provenance into audit/deterministic-media-inputs

clawlter commented

2026-07-12 20:13:52 -04:00

Owner

Scope and dependency

Stacked on approved reviewed-media work in #3 so the PDF attestation can bind the deterministic local inputs without duplicating generator changes. The base is audit/deterministic-media-inputs to keep this review limited to provenance, CI, docs, tests, and refreshed draft artifacts; retarget to main after #3 merges. Do not merge from this task.

Summary

add a reviewable PDF artifact provenance record for the committed pages and imposed-print draft PDFs
pin each distributed PDF by SHA-256, page count, extracted layout text, and ordered per-page 72-DPI raster fingerprints
reject fresh builds whose rendered page pixels differ even when page count and extracted text are unchanged
bind the reviewed asset/data/TeX/build input inventory to a canonical tree digest and signed source commit
make Forgejo CI verify the trusted signer, provenance ancestry, regression tests, and offline rebuild gate
refresh both committed draft PDFs from the current reviewed inputs after the new visual gate exposed stale renderings on pages 3, 6, 7, and 8
pin raster attestation to pdftoppm 24.02.0 and fail closed if either the CI Ubuntu release, exact Poppler package, runtime version, or provenance toolchain declaration drifts

Verification

make clean && make attest-pdfs — passed with fresh LuaLaTeX PDFs and pinned Poppler 24.02.0 rasterization
make test — 26 tests passed
changed-input probe — rejected with reviewed PDF inputs differ
substituted-distribution probe — rejected with sha256 does not match its committed provenance
visual-staleness probe using the previous draft PDF — rejected with build rendered pages differ
unsupported-rasterizer probe — rejected before rasterization
git diff --check — passed
signed implementation commit 10780cc
signed provenance commit adbdb3b
Forgejo Actions run 3561 — passed

The workflow only gates CI; it does not upload, publish, deploy, or regenerate network media.

## Scope and dependency Stacked on approved reviewed-media work in #3 so the PDF attestation can bind the deterministic local inputs without duplicating generator changes. The base is `audit/deterministic-media-inputs` to keep this review limited to provenance, CI, docs, tests, and refreshed draft artifacts; retarget to `main` after #3 merges. Do not merge from this task. ## Summary - add a reviewable PDF artifact provenance record for the committed pages and imposed-print draft PDFs - pin each distributed PDF by SHA-256, page count, extracted layout text, and ordered per-page 72-DPI raster fingerprints - reject fresh builds whose rendered page pixels differ even when page count and extracted text are unchanged - bind the reviewed asset/data/TeX/build input inventory to a canonical tree digest and signed source commit - make Forgejo CI verify the trusted signer, provenance ancestry, regression tests, and offline rebuild gate - refresh both committed draft PDFs from the current reviewed inputs after the new visual gate exposed stale renderings on pages 3, 6, 7, and 8 - pin raster attestation to `pdftoppm` 24.02.0 and fail closed if either the CI Ubuntu release, exact Poppler package, runtime version, or provenance toolchain declaration drifts ## Verification - `make clean && make attest-pdfs` — passed with fresh LuaLaTeX PDFs and pinned Poppler 24.02.0 rasterization - `make test` — 26 tests passed - changed-input probe — rejected with `reviewed PDF inputs differ` - substituted-distribution probe — rejected with `sha256 does not match its committed provenance` - visual-staleness probe using the previous draft PDF — rejected with `build rendered pages differ` - unsupported-rasterizer probe — rejected before rasterization - `git diff --check` — passed - signed implementation commit `10780cc` - signed provenance commit `adbdb3b` - Forgejo Actions run 3561 — passed The workflow only gates CI; it does not upload, publish, deploy, or regenerate network media.

clawlter added 2 commits

2026-07-12 20:13:52 -04:00

Add PDF artifact attestation gate cdbaddb91c

Record draft PDF provenance

Booklet CI / Validate and build booklet PDFs (pull_request) Has been cancelled

Details

3de580d561

clawlter added 1 commit

2026-07-12 21:01:41 -04:00

Detect visual PDF artifact drift

Booklet CI / Validate and build booklet PDFs (pull_request) Successful in 7m19s

Details