work

scripts/mirror/ci-sign.sh

@@ -24,3 +24,25 @@ openssl pkey -in "$KEYFILE" -pubout -out "$KEYDIR/ci-ed25519.pub" >/dev/null 2>&
 STAGE=${STAGE:-$ROOT/out/mirror/thin/stage-v1}
 CREATED=${CREATED:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}
 SIGN_KEY="$KEYFILE" STAGE="$STAGE" CREATED="$CREATED" "$ROOT/src/Mirror/StellaOps.Mirror.Creator/make-thin-v1.sh"
+
+# Emit milestone summary with hashes for downstream consumers
+MANIFEST_PATH="$ROOT/out/mirror/thin/mirror-thin-v1.manifest.json"
+TAR_PATH="$ROOT/out/mirror/thin/mirror-thin-v1.tar.gz"
+DSSE_PATH="$ROOT/out/mirror/thin/mirror-thin-v1.manifest.dsse.json"
+SUMMARY_PATH="$ROOT/out/mirror/thin/milestone.json"
+
+sha256() {
+  sha256sum "$1" | awk '{print $1}'
+}
+
+cat > "$SUMMARY_PATH" <<JSON
+{
+  "created": "$CREATED",
+  "manifest": {"path": "$(basename "$MANIFEST_PATH")", "sha256": "$(sha256 "$MANIFEST_PATH")"},
+  "tarball": {"path": "$(basename "$TAR_PATH")", "sha256": "$(sha256 "$TAR_PATH")"},
+  "dsse": $( [[ -f "$DSSE_PATH" ]] && echo "{\"path\": \"$(basename "$DSSE_PATH")\", \"sha256\": \"$(sha256 "$DSSE_PATH")\"}" || echo "null" ),
+  "time_anchor": $( [[ -n "${TIME_ANCHOR_FILE:-}" && -f "$TIME_ANCHOR_FILE" ]] && echo "{\"path\": \"$(basename "$TIME_ANCHOR_FILE")\", \"sha256\": \"$(sha256 "$TIME_ANCHOR_FILE")\"}" || echo "null" )
+}
+JSON
+
+echo "Milestone summary written to $SUMMARY_PATH"