Provenance is built on oxy-core's DSSE, with one build type everywhere 681db69eba17

//! is the public key, as cosign's `--key` takes it.

use crate::Shared;

/// DSSE's payload type for in-toto statements.

/// What the statement says of one artifact.

pub struct Subject<'a> {

    /// The artifact's file name.

        "predicateType": "https://slsa.dev/provenance/v1",

        "predicate": {

            "buildDefinition": {

                "externalParameters": {

                    "repository": format!("{base_url}/{}", s.repo),

                    "bookmark": s.bookmark,

            },

        },

    })

}

/// `statement` in a DSSE envelope signed with the hub's key.

pub fn envelope(app: &Shared, statement: &serde_json::Value) -> anyhow::Result<serde_json::Value> {

    let payload = serde_json::to_vec(statement)?;

    let (key, secret) = crate::keys::load_secret(&app.config.keys_dir())?;

}

/// The hub's Ed25519 public key as a PEM SubjectPublicKeyInfo.

pub fn public_pem(app: &Shared) -> String {

}

    assert_eq!(st, StatusCode::OK);

    let env: serde_json::Value = serde_json::from_slice(&env).unwrap();

    assert_eq!(env["payloadType"], "application/vnd.in-toto+json");

    let payload = unb64(env["payload"].as_str().unwrap());

    let sig = unb64(env["signatures"][0]["sig"].as_str().unwrap());

    let signed = oxygenhub::provenance::pae("application/vnd.in-toto+json", &payload);

  Otherwise the job's result still stands, and the run page says why the receipt was not kept. The run page links each kept receipt, with its signer. The change page lists the receipts for the state whose only head is that change. `/{owner}/{name}/receipts/{attest}` downloads a signed receipt for `oxy receipt verify` or `import`.

- **Variables** (oxygenhub#102): Administration, an organisation's settings and a repository's settings each hold `NAME=value` pairs (a name is a letter or `_` then letters, digits and `_`, up to 64, never `FLOW_*`; a value up to 4096 characters; up to 100 per level) under **Variables**, each page showing what it inherits and which inherited names it overrides. A claim carries the repository's effective set as `env`, inner levels overriding outer; Flow puts them in the job's environment under `FLOW_*` and the pipeline's own `env`, so they are part of the receipt. They are not secrets and are shown in full to whoever sees the page; secrets are mounted by Flow (OxygenFlow spec §9), never put in the environment. Changes are audited (`flow.variable.set`, `flow.variable.deleted`); `flow run --var NAME=VALUE` gives a local run the same.

- **Secrets** (oxygenhub#107; OxygenFlow spec §9): the same three levels hold **Secrets**, named as a pipeline's `secret "name" { mount-path "/run/secrets/…" }` names them (1 to 64 of `A-Z a-z 0-9 . _ -`, a value up to 64 KiB, up to 100 per level), typed once and sealed under `keys/secrets.key`; pages show names, when each was set and where it comes from, never a value. A claim carries only the secrets its job declares, each with its path and value, from the innermost level that sets the name; one no level sets is noted at the top of the job's log and left out, so the job fails on the missing file rather than running with a stand-in. Flow writes each as a file (0400, the job's user's, on an in-memory mount) before the job starts and never puts it in the environment, the receipt or an artifact. Log intake replaces each value, and its base64, with `***` before a record is stored. Changes are audited (`flow.secret.set`, `flow.secret.deleted`), never with the value.

- **Artifacts** (OxygenFlow spec §5.2): a job may declare artifacts with `output`.

  - The runner holding the job uploads each one with `POST /api/v1/flow/jobs/{id}/artifacts/{name}` (raw bytes, at most 512 MiB).

  - The hub refuses names the job does not declare. It keeps each artifact as a blob of the run's repository, records its path, size and BLAKE3 in `flow_artifacts`, and answers with the blob's ObjectRef.