This commit is contained in:
@@ -0,0 +1,71 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 840 1040" role="img" aria-labelledby="title desc">
|
||||
<title id="title">Контракт учебной attestation</title>
|
||||
<desc id="desc">Схема показывает, что source revision, builder identity, secret boundary и artifact digest образуют отдельные поля, declaration ссылается на subject digest, а provenance, verification и deploy остаются явно не подтверждёнными.</desc>
|
||||
<defs>
|
||||
<marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="8" markerHeight="8" orient="auto">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" fill="#345b8d"/>
|
||||
</marker>
|
||||
<style>
|
||||
.bg { fill: #f6f8fb; }
|
||||
.title { font: 700 34px system-ui, sans-serif; fill: #162235; }
|
||||
.subtitle { font: 400 21px system-ui, sans-serif; fill: #52667f; }
|
||||
.head { font: 700 24px system-ui, sans-serif; fill: #ffffff; }
|
||||
.label { font: 700 23px system-ui, sans-serif; fill: #1e3047; }
|
||||
.value { font: 400 20px system-ui, sans-serif; fill: #415876; }
|
||||
.small { font: 400 18px system-ui, sans-serif; fill: #64748b; }
|
||||
.warn { font: 600 21px system-ui, sans-serif; fill: #9c3b3b; }
|
||||
.box { fill: #ffffff; stroke: #b8c8dc; stroke-width: 2; }
|
||||
.blue { fill: #eaf3ff; stroke: #5488c7; stroke-width: 2; }
|
||||
.amber { fill: #fff7e7; stroke: #d89a3c; stroke-width: 2; }
|
||||
.red { fill: #fff0f0; stroke: #c86363; stroke-width: 2; }
|
||||
.arrow { stroke: #345b8d; stroke-width: 4; fill: none; marker-end: url(#arrow); }
|
||||
</style>
|
||||
</defs>
|
||||
<rect class="bg" width="840" height="1040" rx="28"/>
|
||||
<text class="title" x="56" y="66">Контракт: data ≠ declaration ≠ proof</text>
|
||||
<text class="subtitle" x="56" y="102">Модель хранит то, что надо проверить, но не делает проверку.</text>
|
||||
|
||||
<rect x="56" y="142" width="340" height="52" rx="14" fill="#345b8d"/>
|
||||
<text class="head" x="82" y="176">Входные поля</text>
|
||||
<rect class="box" x="56" y="194" width="340" height="378" rx="16"/>
|
||||
<text class="label" x="82" y="238">Source revision</text>
|
||||
<text class="value" x="82" y="268">synthetic-source-…</text>
|
||||
<line x1="82" y1="292" x2="370" y2="292" stroke="#d6e0ec" stroke-width="2"/>
|
||||
<text class="label" x="82" y="332">Builder identity</text>
|
||||
<text class="value" x="82" y="362">synthetic-builder-…</text>
|
||||
<line x1="82" y1="386" x2="370" y2="386" stroke="#d6e0ec" stroke-width="2"/>
|
||||
<text class="label" x="82" y="426">Secret boundary</text>
|
||||
<text class="value" x="82" y="456">reference, no value</text>
|
||||
<line x1="82" y1="480" x2="370" y2="480" stroke="#d6e0ec" stroke-width="2"/>
|
||||
<text class="label" x="82" y="520">Artifact digest</text>
|
||||
<text class="value" x="82" y="550">synthetic-digest-…</text>
|
||||
|
||||
<path class="arrow" d="M412 382 L454 382"/>
|
||||
<rect x="474" y="142" width="310" height="52" rx="14" fill="#4c82c3"/>
|
||||
<text class="head" x="500" y="176">Declaration</text>
|
||||
<rect class="blue" x="474" y="194" width="310" height="378" rx="16"/>
|
||||
<text class="label" x="500" y="238">Attestation subject</text>
|
||||
<text class="value" x="500" y="268">= artifact digest</text>
|
||||
<line x1="500" y1="292" x2="758" y2="292" stroke="#b7d0ee" stroke-width="2"/>
|
||||
<text class="label" x="500" y="332">Statement</text>
|
||||
<text class="value" x="500" y="362">synthetic declaration</text>
|
||||
<line x1="500" y1="386" x2="758" y2="386" stroke="#b7d0ee" stroke-width="2"/>
|
||||
<text class="label" x="500" y="426">Signature</text>
|
||||
<text class="warn" x="500" y="456">not-created</text>
|
||||
<line x1="500" y1="480" x2="758" y2="480" stroke="#b7d0ee" stroke-width="2"/>
|
||||
<text class="label" x="500" y="520">Verification</text>
|
||||
<text class="warn" x="500" y="550">not-run</text>
|
||||
|
||||
<path class="arrow" d="M420 594 L420 642"/>
|
||||
<rect class="amber" x="56" y="644" width="728" height="148" rx="18"/>
|
||||
<text class="label" x="84" y="690">Что требуется вне модели</text>
|
||||
<text class="value" x="84" y="724">1. Проверить identity, подпись и claims в известном контексте.</text>
|
||||
<text class="value" x="84" y="756">2. Сопоставить subject с digest и digest с deploy input.</text>
|
||||
|
||||
<path class="arrow" d="M420 792 L420 840"/>
|
||||
<rect class="red" x="56" y="842" width="728" height="136" rx="18"/>
|
||||
<text class="label" x="84" y="888">Статус учебной записи</text>
|
||||
<text class="warn" x="84" y="924">provenance: not-verified</text>
|
||||
<text class="warn" x="84" y="956">release: manual-review-required</text>
|
||||
<text class="small" x="486" y="956">Никакого deploy в fixture нет.</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 4.6 KiB |
@@ -0,0 +1,69 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 840 1040" role="img" aria-labelledby="title desc">
|
||||
<title id="title">Маршрут решения при неполной цепочке поставки</title>
|
||||
<desc id="desc">Дерево решения для учебного выпуска: сравнить deploy input с digest, digest с subject declaration, отдельно определить verification и границу секрета. При каждом отсутствующем факте статус остаётся manual review, а не подтверждённое provenance.</desc>
|
||||
<defs>
|
||||
<marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="8" markerHeight="8" orient="auto">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" fill="#355d8b"/>
|
||||
</marker>
|
||||
<style>
|
||||
.bg { fill: #f6f8fb; }
|
||||
.title { font: 700 34px system-ui, sans-serif; fill: #162235; }
|
||||
.subtitle { font: 400 21px system-ui, sans-serif; fill: #52667f; }
|
||||
.label { font: 700 24px system-ui, sans-serif; fill: #1c3049; }
|
||||
.body { font: 400 21px system-ui, sans-serif; fill: #405a79; }
|
||||
.small { font: 400 18px system-ui, sans-serif; fill: #65768b; }
|
||||
.box { fill: #ffffff; stroke: #b9c9de; stroke-width: 2; }
|
||||
.decision { fill: #eaf3ff; stroke: #5087c7; stroke-width: 2; }
|
||||
.review { fill: #fff0f0; stroke: #c86060; stroke-width: 2; }
|
||||
.next { fill: #edf8f1; stroke: #5d9b76; stroke-width: 2; }
|
||||
.arrow { stroke: #355d8b; stroke-width: 4; fill: none; marker-end: url(#arrow); }
|
||||
.no { font: 700 19px system-ui, sans-serif; fill: #a13f3f; }
|
||||
.yes { font: 700 19px system-ui, sans-serif; fill: #347150; }
|
||||
</style>
|
||||
</defs>
|
||||
<rect class="bg" width="840" height="1040" rx="28"/>
|
||||
<text class="title" x="54" y="66">Deploy виден: как не придумать provenance</text>
|
||||
<text class="subtitle" x="54" y="102">Каждый ответ «нет» — остановка вывода и новый вопрос evidence.</text>
|
||||
|
||||
<rect class="box" x="60" y="142" width="720" height="92" rx="18"/>
|
||||
<text class="label" x="90" y="180">Старт: есть только deploy event</text>
|
||||
<text class="body" x="90" y="212">Не считать его доказательством source или artifact.</text>
|
||||
<path class="arrow" d="M285 234 L285 258"/>
|
||||
|
||||
<rect class="decision" x="60" y="260" width="450" height="104" rx="18"/>
|
||||
<text class="label" x="88" y="302">Deploy input = digest?</text>
|
||||
<text class="small" x="88" y="334">Нужен общий ключ сопоставления.</text>
|
||||
<path class="arrow" d="M510 312 L540 312"/>
|
||||
<text class="no" x="518" y="298">нет</text>
|
||||
<rect class="review" x="550" y="260" width="230" height="104" rx="18"/>
|
||||
<text class="label" x="574" y="300">Manual review</text>
|
||||
<text class="body" x="574" y="330">Найти deploy input.</text>
|
||||
<path class="arrow" d="M285 364 L285 408"/>
|
||||
<text class="yes" x="300" y="394">да</text>
|
||||
|
||||
<rect class="decision" x="60" y="410" width="450" height="104" rx="18"/>
|
||||
<text class="label" x="88" y="452">Subject = digest?</text>
|
||||
<text class="small" x="88" y="484">Declaration не заменяет сравнение.</text>
|
||||
<path class="arrow" d="M510 462 L540 462"/>
|
||||
<text class="no" x="518" y="448">нет</text>
|
||||
<rect class="review" x="550" y="410" width="230" height="104" rx="18"/>
|
||||
<text class="label" x="574" y="450">Manual review</text>
|
||||
<text class="body" x="574" y="480">Не использовать statement.</text>
|
||||
<path class="arrow" d="M285 514 L285 562"/>
|
||||
<text class="yes" x="300" y="548">да</text>
|
||||
|
||||
<rect class="next" x="60" y="564" width="720" height="180" rx="18"/>
|
||||
<text class="label" x="90" y="608">Следующий технический шаг</text>
|
||||
<text class="body" x="90" y="644">Отдельно определить verification identity и claims.</text>
|
||||
<text class="body" x="90" y="678">Отдельно проверить secret boundary без значения секрета.</text>
|
||||
<text class="small" x="90" y="716">Только затем обсуждать provenance и решение о release.</text>
|
||||
|
||||
<path class="arrow" d="M420 744 L420 780"/>
|
||||
<rect class="review" x="60" y="782" width="720" height="96" rx="18"/>
|
||||
<text class="label" x="90" y="822">До проверки: provenance not-verified</text>
|
||||
<text class="body" x="90" y="854">Release остаётся manual-review-required, а не подтверждённым.</text>
|
||||
|
||||
<rect class="box" x="60" y="910" width="720" height="82" rx="18"/>
|
||||
<text class="label" x="90" y="946">Остановка вывода безопаснее</text>
|
||||
<text class="body" x="90" y="974">выдуманного подтверждения.</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 4.7 KiB |
@@ -0,0 +1,63 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 840 1040" role="img" aria-labelledby="title desc">
|
||||
<title id="title">Trust boundary учебной цепочки поставки</title>
|
||||
<desc id="desc">Вертикальная карта synthetic цепочки: source revision, CI identity, граница секрета, artifact digest, declaration attestation и ручной review deploy. У каждого звена отмечено, что оно не доказывает само по себе.</desc>
|
||||
<defs>
|
||||
<marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="8" markerHeight="8" orient="auto-start-reverse">
|
||||
<path d="M 0 0 L 10 5 L 0 10 z" fill="#395a87"/>
|
||||
</marker>
|
||||
<style>
|
||||
.bg { fill: #f6f8fb; }
|
||||
.title { font: 700 34px system-ui, sans-serif; fill: #162235; }
|
||||
.subtitle { font: 400 21px system-ui, sans-serif; fill: #52667f; }
|
||||
.card { fill: #ffffff; stroke: #b8c8dc; stroke-width: 2; }
|
||||
.card-warm { fill: #fff7ea; stroke: #d89536; stroke-width: 2; }
|
||||
.card-blue { fill: #eff6ff; stroke: #4c82c3; stroke-width: 2; }
|
||||
.card-red { fill: #fff0f0; stroke: #c95d5d; stroke-width: 2; }
|
||||
.label { font: 700 25px system-ui, sans-serif; fill: #162235; }
|
||||
.body { font: 400 22px system-ui, sans-serif; fill: #344b69; }
|
||||
.muted { font: 400 19px system-ui, sans-serif; fill: #6b7787; }
|
||||
.note { font: 600 19px system-ui, sans-serif; fill: #a23b3b; }
|
||||
.arrow { stroke: #395a87; stroke-width: 4; fill: none; marker-end: url(#arrow); }
|
||||
.boundary { stroke: #d89536; stroke-width: 4; stroke-dasharray: 10 8; }
|
||||
</style>
|
||||
</defs>
|
||||
<rect class="bg" width="840" height="1040" rx="28"/>
|
||||
<text class="title" x="58" y="66">Один synthetic delivery-поток</text>
|
||||
<text class="subtitle" x="58" y="102">Стрелка — вопрос evidence, а не готовое доказательство.</text>
|
||||
|
||||
<rect class="card" x="58" y="142" width="724" height="112" rx="16"/>
|
||||
<text class="label" x="84" y="182">1. Source revision</text>
|
||||
<text class="body" x="84" y="214">synthetic-source-revision-A</text>
|
||||
<text class="note" x="472" y="214">не доказывает build</text>
|
||||
<path class="arrow" d="M420 254 L420 292"/>
|
||||
|
||||
<rect class="card-blue" x="58" y="294" width="724" height="112" rx="16"/>
|
||||
<text class="label" x="84" y="334">2. CI identity</text>
|
||||
<text class="body" x="84" y="366">synthetic-builder-identity-A</text>
|
||||
<text class="note" x="456" y="366">не доказывает execution</text>
|
||||
<path class="arrow" d="M420 406 L420 444"/>
|
||||
|
||||
<line class="boundary" x1="40" y1="442" x2="800" y2="442"/>
|
||||
<text class="muted" x="60" y="427">trust boundary: ссылка на секрет</text>
|
||||
<rect class="card-warm" x="58" y="446" width="724" height="122" rx="16"/>
|
||||
<text class="label" x="84" y="486">3. Secret boundary</text>
|
||||
<text class="body" x="84" y="518">synthetic-secret-reference-no-value</text>
|
||||
<text class="note" x="84" y="548">label не доказывает отсутствие значения в output</text>
|
||||
<path class="arrow" d="M420 568 L420 606"/>
|
||||
|
||||
<rect class="card" x="58" y="608" width="724" height="112" rx="16"/>
|
||||
<text class="label" x="84" y="648">4. Artifact digest</text>
|
||||
<text class="body" x="84" y="680">synthetic-digest-artifact-A</text>
|
||||
<text class="note" x="476" y="680">не доказывает deploy</text>
|
||||
<path class="arrow" d="M420 720 L420 758"/>
|
||||
|
||||
<rect class="card-blue" x="58" y="760" width="724" height="118" rx="16"/>
|
||||
<text class="label" x="84" y="800">5. Attestation declaration</text>
|
||||
<text class="body" x="84" y="832">subject = synthetic-digest-artifact-A</text>
|
||||
<text class="note" x="84" y="860">declaration не равна verification или provenance</text>
|
||||
<path class="arrow" d="M420 878 L420 916"/>
|
||||
|
||||
<rect class="card-red" x="58" y="918" width="724" height="78" rx="16"/>
|
||||
<text class="label" x="84" y="951">6. Deploy decision: manual review required</text>
|
||||
<text class="muted" x="84" y="980">Сверить deploy input с digest отдельным evidence.</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 4.0 KiB |
Reference in New Issue
Block a user