64 lines
4.0 KiB
XML
64 lines
4.0 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 840 1040" role="img" aria-labelledby="title desc">
|
||
<title id="title">Trust boundary учебной цепочки поставки</title>
|
||
<desc id="desc">Вертикальная карта synthetic цепочки: source revision, CI identity, граница секрета, artifact digest, declaration attestation и ручной review deploy. У каждого звена отмечено, что оно не доказывает само по себе.</desc>
|
||
<defs>
|
||
<marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="8" markerHeight="8" orient="auto-start-reverse">
|
||
<path d="M 0 0 L 10 5 L 0 10 z" fill="#395a87"/>
|
||
</marker>
|
||
<style>
|
||
.bg { fill: #f6f8fb; }
|
||
.title { font: 700 34px system-ui, sans-serif; fill: #162235; }
|
||
.subtitle { font: 400 21px system-ui, sans-serif; fill: #52667f; }
|
||
.card { fill: #ffffff; stroke: #b8c8dc; stroke-width: 2; }
|
||
.card-warm { fill: #fff7ea; stroke: #d89536; stroke-width: 2; }
|
||
.card-blue { fill: #eff6ff; stroke: #4c82c3; stroke-width: 2; }
|
||
.card-red { fill: #fff0f0; stroke: #c95d5d; stroke-width: 2; }
|
||
.label { font: 700 25px system-ui, sans-serif; fill: #162235; }
|
||
.body { font: 400 22px system-ui, sans-serif; fill: #344b69; }
|
||
.muted { font: 400 19px system-ui, sans-serif; fill: #6b7787; }
|
||
.note { font: 600 19px system-ui, sans-serif; fill: #a23b3b; }
|
||
.arrow { stroke: #395a87; stroke-width: 4; fill: none; marker-end: url(#arrow); }
|
||
.boundary { stroke: #d89536; stroke-width: 4; stroke-dasharray: 10 8; }
|
||
</style>
|
||
</defs>
|
||
<rect class="bg" width="840" height="1040" rx="28"/>
|
||
<text class="title" x="58" y="66">Один synthetic delivery-поток</text>
|
||
<text class="subtitle" x="58" y="102">Стрелка — вопрос evidence, а не готовое доказательство.</text>
|
||
|
||
<rect class="card" x="58" y="142" width="724" height="112" rx="16"/>
|
||
<text class="label" x="84" y="182">1. Source revision</text>
|
||
<text class="body" x="84" y="214">synthetic-source-revision-A</text>
|
||
<text class="note" x="472" y="214">не доказывает build</text>
|
||
<path class="arrow" d="M420 254 L420 292"/>
|
||
|
||
<rect class="card-blue" x="58" y="294" width="724" height="112" rx="16"/>
|
||
<text class="label" x="84" y="334">2. CI identity</text>
|
||
<text class="body" x="84" y="366">synthetic-builder-identity-A</text>
|
||
<text class="note" x="456" y="366">не доказывает execution</text>
|
||
<path class="arrow" d="M420 406 L420 444"/>
|
||
|
||
<line class="boundary" x1="40" y1="442" x2="800" y2="442"/>
|
||
<text class="muted" x="60" y="427">trust boundary: ссылка на секрет</text>
|
||
<rect class="card-warm" x="58" y="446" width="724" height="122" rx="16"/>
|
||
<text class="label" x="84" y="486">3. Secret boundary</text>
|
||
<text class="body" x="84" y="518">synthetic-secret-reference-no-value</text>
|
||
<text class="note" x="84" y="548">label не доказывает отсутствие значения в output</text>
|
||
<path class="arrow" d="M420 568 L420 606"/>
|
||
|
||
<rect class="card" x="58" y="608" width="724" height="112" rx="16"/>
|
||
<text class="label" x="84" y="648">4. Artifact digest</text>
|
||
<text class="body" x="84" y="680">synthetic-digest-artifact-A</text>
|
||
<text class="note" x="476" y="680">не доказывает deploy</text>
|
||
<path class="arrow" d="M420 720 L420 758"/>
|
||
|
||
<rect class="card-blue" x="58" y="760" width="724" height="118" rx="16"/>
|
||
<text class="label" x="84" y="800">5. Attestation declaration</text>
|
||
<text class="body" x="84" y="832">subject = synthetic-digest-artifact-A</text>
|
||
<text class="note" x="84" y="860">declaration не равна verification или provenance</text>
|
||
<path class="arrow" d="M420 878 L420 916"/>
|
||
|
||
<rect class="card-red" x="58" y="918" width="724" height="78" rx="16"/>
|
||
<text class="label" x="84" y="951">6. Deploy decision: manual review required</text>
|
||
<text class="muted" x="84" y="980">Сверить deploy input с digest отдельным evidence.</text>
|
||
</svg>
|