Skip to content
Sarj Repo Standards
rest/artifact/provenance-contradiction

Contradictory artifact provenance

Declared artifact provenance describes the exact supplied bytes.

error

Examples

FlaggedFails
{
  "documents": {
    "dist/bundle.json": {
      "bundled": true
    },
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json",
  "semantics": {
    "artifacts": [
      {
        "artifact": "dist/bundle.json",
        "derived_from": "openapi.json",
        "output_digest": "4f27ced194f5ef4c74763492e9a1b97d8bdb5ca90cb0d676089f86f9d80b2628",
        "producer": {
          "config_digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
          "name": "fixture-bundler",
          "version": "1.2.3"
        },
        "role": "bundle",
        "source_digest": "0000000000000000000000000000000000000000000000000000000000000000"
      }
    ],
    "operations": [],
    "schema_version": 1
  }
}
PassesClean
{
  "documents": {
    "dist/bundle.json": {
      "bundled": true
    },
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json",
  "semantics": {
    "artifacts": [
      {
        "artifact": "dist/bundle.json",
        "derived_from": "openapi.json",
        "output_digest": "4f27ced194f5ef4c74763492e9a1b97d8bdb5ca90cb0d676089f86f9d80b2628",
        "producer": {
          "config_digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
          "name": "fixture-bundler",
          "version": "1.2.3"
        },
        "role": "bundle",
        "source_digest": "76b48dd17d2560425745035aa6b01d2237e2d40eb04f366ad60fc8c936cd83fe"
      }
    ],
    "operations": [],
    "schema_version": 1
  }
}

Why it matters

The provenance statement does not describe the artifact being reviewed.

How detection works

Declared artifact or source bytes are absent, or a declared source or output digest does not match the supplied bytes.

What is inspected

  • explicit artifact metadata and SHA-256 digests of supplied source and artifact bytes

Limits

  • compiling generated code
  • inferring generated artifacts from paths
  • Only explicit non-source artifact declarations are checked.
  • Digest comparisons use the exact supplied bytes without executing repository code.
  • Missing optional provenance fields use the separate advisory rule.

How to fix it

Make the declaration match the reviewed bytes.

  1. Supply the declared artifact and canonical source bytes.
  2. Recompute and record their exact SHA-256 digests.

Verify

  • Run repo-lint rest check again against the same tracked contract and semantics.