revise June 2023 supply chain articles

2026-07-31 14:53:35 +03:00
parent bb964e1f54
commit 42e4060f92
7 changed files with 645 additions and 1 deletions
@@ -0,0 +1,71 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 840 1040" role="img" aria-labelledby="title desc">
+  <title id="title">Контракт учебной attestation</title>
+  <desc id="desc">Схема показывает, что source revision, builder identity, secret boundary и artifact digest образуют отдельные поля, declaration ссылается на subject digest, а provenance, verification и deploy остаются явно не подтверждёнными.</desc>
+  <defs>
+    <marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="8" markerHeight="8" orient="auto">
+      <path d="M 0 0 L 10 5 L 0 10 z" fill="#345b8d"/>
+    </marker>
+    <style>
+      .bg { fill: #f6f8fb; }
+      .title { font: 700 34px system-ui, sans-serif; fill: #162235; }
+      .subtitle { font: 400 21px system-ui, sans-serif; fill: #52667f; }
+      .head { font: 700 24px system-ui, sans-serif; fill: #ffffff; }
+      .label { font: 700 23px system-ui, sans-serif; fill: #1e3047; }
+      .value { font: 400 20px system-ui, sans-serif; fill: #415876; }
+      .small { font: 400 18px system-ui, sans-serif; fill: #64748b; }
+      .warn { font: 600 21px system-ui, sans-serif; fill: #9c3b3b; }
+      .box { fill: #ffffff; stroke: #b8c8dc; stroke-width: 2; }
+      .blue { fill: #eaf3ff; stroke: #5488c7; stroke-width: 2; }
+      .amber { fill: #fff7e7; stroke: #d89a3c; stroke-width: 2; }
+      .red { fill: #fff0f0; stroke: #c86363; stroke-width: 2; }
+      .arrow { stroke: #345b8d; stroke-width: 4; fill: none; marker-end: url(#arrow); }
+    </style>
+  </defs>
+  <rect class="bg" width="840" height="1040" rx="28"/>
+  <text class="title" x="56" y="66">Контракт: data ≠ declaration ≠ proof</text>
+  <text class="subtitle" x="56" y="102">Модель хранит то, что надо проверить, но не делает проверку.</text>
+
+  <rect x="56" y="142" width="340" height="52" rx="14" fill="#345b8d"/>
+  <text class="head" x="82" y="176">Входные поля</text>
+  <rect class="box" x="56" y="194" width="340" height="378" rx="16"/>
+  <text class="label" x="82" y="238">Source revision</text>
+  <text class="value" x="82" y="268">synthetic-source-…</text>
+  <line x1="82" y1="292" x2="370" y2="292" stroke="#d6e0ec" stroke-width="2"/>
+  <text class="label" x="82" y="332">Builder identity</text>
+  <text class="value" x="82" y="362">synthetic-builder-…</text>
+  <line x1="82" y1="386" x2="370" y2="386" stroke="#d6e0ec" stroke-width="2"/>
+  <text class="label" x="82" y="426">Secret boundary</text>
+  <text class="value" x="82" y="456">reference, no value</text>
+  <line x1="82" y1="480" x2="370" y2="480" stroke="#d6e0ec" stroke-width="2"/>
+  <text class="label" x="82" y="520">Artifact digest</text>
+  <text class="value" x="82" y="550">synthetic-digest-…</text>
+
+  <path class="arrow" d="M412 382 L454 382"/>
+  <rect x="474" y="142" width="310" height="52" rx="14" fill="#4c82c3"/>
+  <text class="head" x="500" y="176">Declaration</text>
+  <rect class="blue" x="474" y="194" width="310" height="378" rx="16"/>
+  <text class="label" x="500" y="238">Attestation subject</text>
+  <text class="value" x="500" y="268">= artifact digest</text>
+  <line x1="500" y1="292" x2="758" y2="292" stroke="#b7d0ee" stroke-width="2"/>
+  <text class="label" x="500" y="332">Statement</text>
+  <text class="value" x="500" y="362">synthetic declaration</text>
+  <line x1="500" y1="386" x2="758" y2="386" stroke="#b7d0ee" stroke-width="2"/>
+  <text class="label" x="500" y="426">Signature</text>
+  <text class="warn" x="500" y="456">not-created</text>
+  <line x1="500" y1="480" x2="758" y2="480" stroke="#b7d0ee" stroke-width="2"/>
+  <text class="label" x="500" y="520">Verification</text>
+  <text class="warn" x="500" y="550">not-run</text>
+
+  <path class="arrow" d="M420 594 L420 642"/>
+  <rect class="amber" x="56" y="644" width="728" height="148" rx="18"/>
+  <text class="label" x="84" y="690">Что требуется вне модели</text>
+  <text class="value" x="84" y="724">1. Проверить identity, подпись и claims в известном контексте.</text>
+  <text class="value" x="84" y="756">2. Сопоставить subject с digest и digest с deploy input.</text>
+
+  <path class="arrow" d="M420 792 L420 840"/>
+  <rect class="red" x="56" y="842" width="728" height="136" rx="18"/>
+  <text class="label" x="84" y="888">Статус учебной записи</text>
+  <text class="warn" x="84" y="924">provenance: not-verified</text>
+  <text class="warn" x="84" y="956">release: manual-review-required</text>
+  <text class="small" x="486" y="956">Никакого deploy в fixture нет.</text>
+</svg>