Merge pull request #56 from RI-SE/cursor/w2-eval-receipt

fix: minimal W2 eval/receipt split

Author: afelin

.github/workflows/ci.yml

@@ -36,6 +36,15 @@ jobs:
         env:
           SOURCE_DATE_EPOCH: "1704067200"
         run: go test ./...
+      - name: W2 unset-epoch eval stability
+        # Must not inherit the pinned SOURCE_DATE_EPOCH from the prior step.
+        # Proves canonical evaluation bytes stay stable when the epoch is unset.
+        if: runner.os != 'Windows'
+        env:
+          SOURCE_DATE_EPOCH: ""
+        run: |
+          unset SOURCE_DATE_EPOCH || true
+          go test ./internal/clock/ ./internal/ir/ ./internal/validate/ -count=1 -run 'TestRejectInvalidSourceDateEpoch|TestCanonicalEvaluationStableWithoutEpoch|TestCanonicalEvaluationStableAcrossHOME|TestValidateRejectsInvalidSourceDateEpoch|TestLegacyEvaluationAdapterRoundTrip|TestMarshalCanonicalStable|TestRFC3339ForEvidenceStableWithoutEpoch'
       - name: Fuzz (short)
         if: runner.os != 'Windows'
         run: |

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased (on `main`, not yet pinned — Action pin stays `@v0.5.2`)
 
+- **W2 eval/receipt (minimal)** — reject invalid `SOURCE_DATE_EPOCH` (no silent wall-clock fallback); split canonical `curbpack-evaluation:1` from `curbpack-run-receipt:1`; write `latest_evaluation.json` / `latest_receipt.json`; keep legacy `latest_failure.json` / `latest_result.json` via adapter; omit synthetic SLSA `buildFinishedOn`; canonical evaluation stable across HOME when epoch unset; CI leg runs unset-epoch stability tests without inheriting the pinned epoch. Explicit `as_of` binding and content-addressed digest store remain open. Pin stays `@v0.5.2`. Not certification.
+
 ## v0.5.5
 
 High-trust launch readiness — containment, FG closures in the advertised binary, installer version-tag validation. Action pin stayed `@v0.5.2`.

docs/launch-status.md

@@ -69,7 +69,7 @@ These are not closed by compiling binaries or by the passing regression tests.
 
 | Gate | Remaining work | Source |
 |---|---|---|
-| Canonical evaluation and receipt | Separate wall-clock, agent and pathway metadata from canonical evaluation; bind complete rule/input bytes and explicit `as_of`; freeze the versioned format | [SDD W2 and W5](software-design-document.md#12-sequential-work-packages), [current payload](../internal/ir/gatefailure.go) |
+| Canonical evaluation and receipt | **Partial (this slice):** invalid `SOURCE_DATE_EPOCH` rejected (no silent wall-clock fallback); canonical `latest_evaluation.json` omits timestamp/agent; `latest_receipt.json` holds ops metadata; legacy `latest_failure.json` / `latest_result.json` via adapter; SLSA sidecar omits synthetic `buildFinishedOn`; canonical bytes stable across HOME when epoch unset. **Still open:** explicit pack `as_of` binding, content-addressed digest store beyond `latest_*`, TMPDIR/locale axes, full schema freeze (W5) | [SDD W2](software-design-document.md#12-sequential-work-packages), [evaluation IR](../internal/ir/evaluation.go), [eval receipt tests](../internal/validate/eval_receipt_test.go) |
 | Transactional persistence and hostile concurrency | Cache files are individually replaced, but three aliases are not one transaction. Descriptor-based containment and concurrent directory replacement remain outside the path-check guarantee | [cache writer](../internal/validate/cache_write.go), [path jail](../internal/pathjail/pathjail.go) |
 | Resource and command guarantees | Evaluator-wide byte/file/subprocess budgets, interruption recovery, command effects, and consistent typed operational errors across every command | [SDD requirements](software-design-document.md#2-constitutional-invariants), [command implementation](../internal/cli/cli.go) |
 | Independent trust assessment | Typed authenticity/integrity/completeness results, full evidence recomputation, and outside review of trust/digest changes | [SDD W4](software-design-document.md#12-sequential-work-packages), [bind resolution](../internal/attest/bind.go) |
@@ -91,8 +91,8 @@ needs fresh verification and human review; invitations still require A2 and A3.
 |---|---|---|
 | 1 | CUR-01: explicit release/advertisement evidence; declared resource checks including samples; complete static homepage CSS | Corrections on this branch; run `python3 scripts/test_public_assets.py` and `python3 scripts/check-public-assets.py --verify-release` |
 | 2 | Action execution: reject consumer-controlled source builds; treat inputs as shell/JavaScript data | In progress on Action P1 — [resolver](../scripts/action-resolve-bin.sh); consumer path = checksum-pinned download only; dogfood source only via explicit RI-SE env |
-| 3 | Contained, staged output writes; exclusive writers and interruption recovery; Windows path cases | Open — default `review-pack` symlink escape reproduced in [release writer](../internal/release/release.go); pull concurrency/path work forward |
-| 4 | W2 canonical evaluation/receipt split, explicit `as_of`, complete identity, versioned cache; producer and reader determinism | Open — the three-site CUR-CLOCK substitution alone is insufficient; [SDD](software-design-document.md#12-sequential-work-packages) |
+| 3 | Contained, staged output writes; exclusive writers and interruption recovery; Windows path cases | Closed structurally on tip after [#55](https://github.com/RI-SE/curbpack/pull/55) (`de116cd`); three-alias cache still not one transaction ([outwrite](../internal/outwrite/outwrite.go)) |
+| 4 | W2 canonical evaluation/receipt split, explicit `as_of`, complete identity, versioned cache; producer and reader determinism | **Partial** — epoch reject + eval/receipt skeleton + legacy adapter + unset-epoch HOME-stable canonical bytes; `as_of` binding and CA-by-digest cache remain open ([SDD](software-design-document.md#12-sequential-work-packages)) |
 | 5 | Explicit redaction context; failed/evaluated/skipped counts; comparable trends; `conformity_claim: none`; schemas and compatibility | Open — preserve custom-home leak detection and historical machine contracts |
 | 6 | Extend existing offline bundle review with schema/integrity validation and separate trust results | Open — share the existing review engine rather than introducing an independent verifier |
 

internal/attest/attest.go

@@ -146,9 +146,13 @@ func Run(opts Options) (Capsule, error) {
 		evidence["pack_ids"] = packIDs
 	}
 
+	ts, err := clock.RFC3339()
+	if err != nil {
+		return Capsule{}, err
+	}
 	cap := Capsule{
 		SchemaVersion:   SchemaVersion,
-		Timestamp:       clock.RFC3339(), // display-only; not in state_hash
+		Timestamp:       ts, // display-only; not in state_hash
 		CommitSHA:       commit,
 		StateHash:       stateHash,
 		ParentStateHash: parentHash,

internal/cli/cli.go

@@ -786,7 +786,10 @@ func cmdAttest(args []string) error {
 	if verr != nil {
 		return fmt.Errorf("VEX evidence: validate failed while binding digests: %w", verr)
 	}
-	doc := vex.FromGateFailures(filepath.Base(root), res.Payload)
+	doc, werr := vex.FromGateFailures(filepath.Base(root), res.Payload)
+	if werr != nil {
+		return fmt.Errorf("VEX evidence: %w", werr)
+	}
 	if _, werr := vex.Write(root, doc, ""); werr != nil {
 		return fmt.Errorf("VEX write failed while binding digests: %w", werr)
 	}

internal/cli/scan.go

@@ -57,11 +57,18 @@ func cmdScan(args []string) error {
 	}
 
 	notStarted, failing := classifyFindings(res.Payload.Failures)
-	days := clock.DaysUntilUTC(clock.Art14ReportingStart)
+	days, err := clock.DaysUntilUTC(clock.Art14ReportingStart)
+	if err != nil {
+		return err
+	}
+	now, err := clock.NowUTC()
+	if err != nil {
+		return err
+	}
 
 	claimLine := "Prepares evidence for human review — not a conformity assessment."
 	if flags.badge || flags.formatMarkdown {
-		fmt.Println(art14BadgeLine(root, clock.NowUTC()))
+		fmt.Println(art14BadgeLine(root, now))
 		fmt.Println(claimLine)
 		return nil
 	}

internal/clock/clock.go

@@ -1,25 +1,61 @@
 package clock
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"strconv"
 	"time"
 )
 
-// NowUTC returns UTC time for artifact timestamps.
+// ErrInvalidSourceDateEpoch is returned when SOURCE_DATE_EPOCH is set but is
+// not a non-negative Unix second. Callers must not fall back to wall clock.
+var ErrInvalidSourceDateEpoch = errors.New("invalid SOURCE_DATE_EPOCH")
+
+// ParseSourceDateEpoch reports the pinned epoch when SOURCE_DATE_EPOCH is set.
+// Unset/empty → (zero, false, nil). Invalid → (_, false, ErrInvalidSourceDateEpoch).
+// A value that is only whitespace is invalid (the variable is set but unusable).
+func ParseSourceDateEpoch() (time.Time, bool, error) {
+	raw, set := os.LookupEnv("SOURCE_DATE_EPOCH")
+	if !set {
+		return time.Time{}, false, nil
+	}
+	v := stringsTrim(raw)
+	if v == "" {
+		return time.Time{}, false, fmt.Errorf("%w: %q (want non-negative Unix seconds)", ErrInvalidSourceDateEpoch, raw)
+	}
+	sec, err := strconv.ParseInt(v, 10, 64)
+	if err != nil || sec < 0 {
+		return time.Time{}, false, fmt.Errorf("%w: %q (want non-negative Unix seconds)", ErrInvalidSourceDateEpoch, v)
+	}
+	return time.Unix(sec, 0).UTC(), true, nil
+}
+
+// CheckSourceDateEpoch returns nil when unset or valid; otherwise wraps ErrInvalidSourceDateEpoch.
+func CheckSourceDateEpoch() error {
+	_, _, err := ParseSourceDateEpoch()
+	return err
+}
+
+// NowUTC returns UTC time for operational timestamps (receipts, display).
 // Tests and reproducible builds may pin via SOURCE_DATE_EPOCH (Unix seconds).
-func NowUTC() time.Time {
-	if v := stringsTrim(os.Getenv("SOURCE_DATE_EPOCH")); v != "" {
-		if sec, err := strconv.ParseInt(v, 10, 64); err == nil && sec >= 0 {
-			return time.Unix(sec, 0).UTC()
-		}
+// Invalid SOURCE_DATE_EPOCH is rejected — there is no silent wall-clock fallback.
+func NowUTC() (time.Time, error) {
+	if t, set, err := ParseSourceDateEpoch(); err != nil {
+		return time.Time{}, err
+	} else if set {
+		return t, nil
 	}
-	return time.Now().UTC()
+	return time.Now().UTC(), nil
 }
 
 // RFC3339 returns a UTC RFC3339 timestamp using NowUTC.
-func RFC3339() string {
-	return NowUTC().Format(time.RFC3339)
+func RFC3339() (string, error) {
+	t, err := NowUTC()
+	if err != nil {
+		return "", err
+	}
+	return t.Format(time.RFC3339), nil
 }
 
 // EvidenceEpoch is the fixed synthetic UTC timestamp used for digest-bound
@@ -30,11 +66,14 @@ const EvidenceEpoch = "1970-01-01T00:00:00Z"
 // evidence (SBOM metadata.timestamp / VEX timestamp). Honors SOURCE_DATE_EPOCH
 // when set; otherwise uses EvidenceEpoch so re-attest on the same inputs is
 // idempotent without encoding hash entropy into the clock field.
-func RFC3339ForEvidence() string {
-	if v := stringsTrim(os.Getenv("SOURCE_DATE_EPOCH")); v != "" {
-		return RFC3339()
+// Invalid SOURCE_DATE_EPOCH is rejected (no silent wall-clock fallback).
+func RFC3339ForEvidence() (string, error) {
+	if _, set, err := ParseSourceDateEpoch(); err != nil {
+		return "", err
+	} else if !set {
+		return EvidenceEpoch, nil
 	}
-	return EvidenceEpoch
+	return RFC3339()
 }
 
 // Art14ReportingStart is the CRA Art 14 reporting clock start (UTC date).
@@ -43,10 +82,14 @@ var Art14ReportingStart = time.Date(2026, 9, 11, 0, 0, 0, 0, time.UTC)
 
 // DaysUntilUTC returns whole calendar days from NowUTC (date-truncated) until deadline.
 // Negative when the deadline has passed.
-func DaysUntilUTC(deadline time.Time) int {
-	now := NowUTC().Truncate(24 * time.Hour)
+func DaysUntilUTC(deadline time.Time) (int, error) {
+	now, err := NowUTC()
+	if err != nil {
+		return 0, err
+	}
+	now = now.Truncate(24 * time.Hour)
 	d := deadline.UTC().Truncate(24 * time.Hour)
-	return int(d.Sub(now).Hours() / 24)
+	return int(d.Sub(now).Hours() / 24), nil
 }
 
 // FormatArt14Countdown formats days until Art14ReportingStart for site HTML.

internal/clock/clock_test.go

@@ -1,6 +1,7 @@
 package clock_test
 
 import (
+	"errors"
 	"os"
 	"testing"
 	"time"
@@ -28,7 +29,10 @@ func TestFormatArt14Countdown(t *testing.T) {
 
 func TestFormatArt14CountdownPastDeadline(t *testing.T) {
 	t.Setenv("SOURCE_DATE_EPOCH", "1789171200") // 2026-09-12 UTC (day after Art14ReportingStart)
-	days := clock.DaysUntilUTC(clock.Art14ReportingStart)
+	days, err := clock.DaysUntilUTC(clock.Art14ReportingStart)
+	if err != nil {
+		t.Fatal(err)
+	}
 	if days != -1 {
 		t.Fatalf("want -1 day after deadline, got %d", days)
 	}
@@ -41,7 +45,10 @@ func TestFormatArt14CountdownPastDeadline(t *testing.T) {
 
 func TestDaysUntilArt14Reporting(t *testing.T) {
 	t.Setenv("SOURCE_DATE_EPOCH", "1757548800") // 2025-09-11 UTC
-	days := clock.DaysUntilUTC(clock.Art14ReportingStart)
+	days, err := clock.DaysUntilUTC(clock.Art14ReportingStart)
+	if err != nil {
+		t.Fatal(err)
+	}
 	if days != 365 {
 		t.Fatalf("want 365 days until 2026-09-11 from 2025-09-11, got %d", days)
 	}
@@ -53,8 +60,14 @@ func TestDaysUntilArt14Reporting(t *testing.T) {
 func TestRFC3339ForEvidenceStableWithoutEpoch(t *testing.T) {
 	t.Setenv("SOURCE_DATE_EPOCH", "")
 	_ = os.Unsetenv("SOURCE_DATE_EPOCH")
-	a := clock.RFC3339ForEvidence()
-	b := clock.RFC3339ForEvidence()
+	a, err := clock.RFC3339ForEvidence()
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := clock.RFC3339ForEvidence()
+	if err != nil {
+		t.Fatal(err)
+	}
 	if a != b {
 		t.Fatalf("evidence RFC3339 drifted: %q vs %q", a, b)
 	}
@@ -65,9 +78,45 @@ func TestRFC3339ForEvidenceStableWithoutEpoch(t *testing.T) {
 
 func TestRFC3339ForEvidenceHonorsSourceDateEpoch(t *testing.T) {
 	t.Setenv("SOURCE_DATE_EPOCH", "1704067200") // 2024-01-01 UTC
-	got := clock.RFC3339ForEvidence()
+	got, err := clock.RFC3339ForEvidence()
+	if err != nil {
+		t.Fatal(err)
+	}
 	want := "2024-01-01T00:00:00Z"
 	if got != want {
 		t.Fatalf("RFC3339ForEvidence() = %q, want %q", got, want)
 	}
 }
+
+func TestRejectInvalidSourceDateEpoch(t *testing.T) {
+	for _, bad := range []string{"not-a-number", "-1", "1.5", "0x10", " "} {
+		t.Run(bad, func(t *testing.T) {
+			t.Setenv("SOURCE_DATE_EPOCH", bad)
+			if err := clock.CheckSourceDateEpoch(); err == nil {
+				t.Fatal("CheckSourceDateEpoch: want error for invalid epoch")
+			} else if !errors.Is(err, clock.ErrInvalidSourceDateEpoch) {
+				t.Fatalf("CheckSourceDateEpoch: %v, want ErrInvalidSourceDateEpoch", err)
+			}
+			if _, err := clock.NowUTC(); err == nil || !errors.Is(err, clock.ErrInvalidSourceDateEpoch) {
+				t.Fatalf("NowUTC: %v, want ErrInvalidSourceDateEpoch", err)
+			}
+			if _, err := clock.RFC3339(); err == nil || !errors.Is(err, clock.ErrInvalidSourceDateEpoch) {
+				t.Fatalf("RFC3339: %v, want ErrInvalidSourceDateEpoch", err)
+			}
+			if _, err := clock.RFC3339ForEvidence(); err == nil || !errors.Is(err, clock.ErrInvalidSourceDateEpoch) {
+				t.Fatalf("RFC3339ForEvidence: %v, want ErrInvalidSourceDateEpoch", err)
+			}
+		})
+	}
+}
+
+func TestUnsetSourceDateEpochAllowsWallClock(t *testing.T) {
+	t.Setenv("SOURCE_DATE_EPOCH", "")
+	_ = os.Unsetenv("SOURCE_DATE_EPOCH")
+	if err := clock.CheckSourceDateEpoch(); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := clock.NowUTC(); err != nil {
+		t.Fatal(err)
+	}
+}

internal/exportx/optional.go

@@ -18,14 +18,18 @@ func WriteSPDXOptional(root, outPath string) (string, error) {
 	if err != nil && !sbom.IsUnavailable(err) {
 		return "", err
 	}
+	created, err := clock.RFC3339()
+	if err != nil {
+		return "", err
+	}
 	docs := map[string]any{
 		"spdxVersion":       "SPDX-2.3",
 		"dataLicense":       "CC0-1.0",
 		"SPDXID":            "SPDXRef-DOCUMENT",
 		"name":              filepath.Base(root) + "-sbom",
 		"documentNamespace": "https://curbpack.local/spdx/" + filepath.Base(root),
 		"creationInfo": map[string]any{
-			"created":  clock.RFC3339(),
+			"created":  created,
 			"creators": []string{"Tool: curbpack"},
 			"comment":  "Optional SPDX mirror of component list — not a certification. Source=" + source,
 		},
@@ -80,9 +84,10 @@ func WriteSLSAOptional(root, outPath string) (string, error) {
 			{"uri": "sbom.cdx.json", "digest": map[string]string{"sha256": sbomDig}},
 		},
 		"metadata": map[string]any{
-			"buildFinishedOn": clock.RFC3339(),
-			"completeness":    map[string]any{"parameters": false, "environment": false, "materials": false},
-			"comment":         "Optional SLSA-shaped sidecar wrapping local digests — does not replace Git Notes attest honesty. Not a certification.",
+			// Omit buildFinishedOn when no real build-event time is known (W2:
+			// do not synthesize a completion date from wall clock).
+			"completeness": map[string]any{"parameters": false, "environment": false, "materials": false},
+			"comment":      "Optional SLSA-shaped sidecar wrapping local digests — does not replace Git Notes attest honesty. Not a certification.",
 		},
 	}
 	doc := map[string]any{

internal/invariants/capsule_vex_test.go

@@ -33,7 +33,10 @@ func TestHealVEXStaysDraft(t *testing.T) {
 			SanitizedDescription: "missing",
 		}},
 	}
-	doc := vex.FromGateFailures("app", payload)
+	doc, err := vex.FromGateFailures("app", payload)
+	if err != nil {
+		t.Fatal(err)
+	}
 	if doc.Status != "draft_pending_attest" {
 		t.Fatalf("status=%q want draft_pending_attest", doc.Status)
 	}