feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

scripts/mirror/ci-sign.sh

@@ -30,12 +30,16 @@ CHECKPOINT_FRESHNESS=${CHECKPOINT_FRESHNESS:-86400}
 OCI=${OCI:-1}
 SIGN_KEY="$KEYFILE" STAGE="$STAGE" CREATED="$CREATED" TENANT_SCOPE="$TENANT_SCOPE" ENV_SCOPE="$ENV_SCOPE" CHUNK_SIZE="$CHUNK_SIZE" CHECKPOINT_FRESHNESS="$CHECKPOINT_FRESHNESS" OCI="$OCI" "$ROOT/src/Mirror/StellaOps.Mirror.Creator/make-thin-v1.sh"
 
+# Default to staged time-anchor unless caller overrides
+TIME_ANCHOR_FILE=${TIME_ANCHOR_FILE:-$ROOT/out/mirror/thin/stage-v1/layers/time-anchor.json}
+
 # Emit milestone summary with hashes for downstream consumers
 MANIFEST_PATH="$ROOT/out/mirror/thin/mirror-thin-v1.manifest.json"
 TAR_PATH="$ROOT/out/mirror/thin/mirror-thin-v1.tar.gz"
 DSSE_PATH="$ROOT/out/mirror/thin/mirror-thin-v1.manifest.dsse.json"
 BUNDLE_PATH="$ROOT/out/mirror/thin/mirror-thin-v1.bundle.json"
 BUNDLE_DSSE_PATH="$ROOT/out/mirror/thin/mirror-thin-v1.bundle.dsse.json"
+TIME_ANCHOR_DSSE_PATH="$TIME_ANCHOR_FILE.dsse.json"
 TRANSPORT_PATH="$ROOT/out/mirror/thin/stage-v1/layers/transport-plan.json"
 REKOR_POLICY_PATH="$ROOT/out/mirror/thin/stage-v1/layers/rekor-policy.json"
 MIRROR_POLICY_PATH="$ROOT/out/mirror/thin/stage-v1/layers/mirror-policy.json"
@@ -46,6 +50,50 @@ sha256() {
   sha256sum "$1" | awk '{print $1}'
 }
 
+# Sign manifest, bundle meta, and time-anchor (if present)
+python "$ROOT/scripts/mirror/sign_thin_bundle.py" \
+  --key "$KEYFILE" \
+  --manifest "$MANIFEST_PATH" \
+  --tar "$TAR_PATH" \
+  --tuf-dir "$ROOT/out/mirror/thin/tuf" \
+  --bundle "$BUNDLE_PATH" \
+  --time-anchor "$TIME_ANCHOR_FILE"
+
+# Normalize time-anchor DSSE location for bundle meta/summary
+if [[ -f "$TIME_ANCHOR_FILE.dsse.json" ]]; then
+  cp "$TIME_ANCHOR_FILE.dsse.json" "$TIME_ANCHOR_DSSE_PATH"
+fi
+
+# Refresh bundle meta hashes now that DSSE files exist
+python - <<'PY'
+import json, pathlib, hashlib
+root = pathlib.Path("$ROOT")
+bundle_path = pathlib.Path("$BUNDLE_PATH")
+manifest_dsse = pathlib.Path("$DSSE_PATH")
+bundle_dsse = pathlib.Path("$BUNDLE_DSSE_PATH")
+time_anchor_dsse = pathlib.Path("$TIME_ANCHOR_DSSE_PATH")
+
+def sha(path: pathlib.Path) -> str:
+    h = hashlib.sha256()
+    with path.open('rb') as f:
+        for chunk in iter(lambda: f.read(8192), b''):
+            h.update(chunk)
+    return h.hexdigest()
+
+data = json.loads(bundle_path.read_text())
+art = data.setdefault('artifacts', {})
+if manifest_dsse.exists():
+    art.setdefault('manifest_dsse', {})['sha256'] = sha(manifest_dsse)
+if bundle_dsse.exists():
+    art.setdefault('bundle_dsse', {})['sha256'] = sha(bundle_dsse)
+if time_anchor_dsse.exists():
+    art.setdefault('time_anchor_dsse', {})['sha256'] = sha(time_anchor_dsse)
+
+bundle_path.write_text(json.dumps(data, indent=2, sort_keys=True) + "\n")
+sha_path = bundle_path.with_suffix(bundle_path.suffix + '.sha256')
+sha_path.write_text(f"{sha(bundle_path)}  {bundle_path.name}\n")
+PY
+
 cat > "$SUMMARY_PATH" <<JSON
 {
   "created": "$CREATED",
@@ -54,7 +102,8 @@ cat > "$SUMMARY_PATH" <<JSON
   "dsse": $( [[ -f "$DSSE_PATH" ]] && echo "{\"path\": \"$(basename "$DSSE_PATH")\", \"sha256\": \"$(sha256 "$DSSE_PATH")\"}" || echo "null" ),
   "bundle": $( [[ -f "$BUNDLE_PATH" ]] && echo "{\"path\": \"$(basename "$BUNDLE_PATH")\", \"sha256\": \"$(sha256 "$BUNDLE_PATH")\"}" || echo "null" ),
   "bundle_dsse": $( [[ -f "$BUNDLE_DSSE_PATH" ]] && echo "{\"path\": \"$(basename "$BUNDLE_DSSE_PATH")\", \"sha256\": \"$(sha256 "$BUNDLE_DSSE_PATH")\"}" || echo "null" ),
-  "time_anchor": $( [[ -n "${TIME_ANCHOR_FILE:-}" && -f "$TIME_ANCHOR_FILE" ]] && echo "{\"path\": \"$(basename "$TIME_ANCHOR_FILE")\", \"sha256\": \"$(sha256 "$TIME_ANCHOR_FILE")\"}" || echo "null" )
+  "time_anchor": $( [[ -n "${TIME_ANCHOR_FILE:-}" && -f "$TIME_ANCHOR_FILE" ]] && echo "{\"path\": \"$(basename "$TIME_ANCHOR_FILE")\", \"sha256\": \"$(sha256 "$TIME_ANCHOR_FILE")\"}" || echo "null" ),
+  "time_anchor_dsse": $( [[ -f "$TIME_ANCHOR_DSSE_PATH" ]] && echo "{\"path\": \"$(basename "$TIME_ANCHOR_DSSE_PATH")\", \"sha256\": \"$(sha256 "$TIME_ANCHOR_DSSE_PATH")\"}" || echo "null" )
   ,"policies": {
     "transport": {"path": "$(basename "$TRANSPORT_PATH")", "sha256": "$(sha256 "$TRANSPORT_PATH")"},
     "rekor": {"path": "$(basename "$REKOR_POLICY_PATH")", "sha256": "$(sha256 "$REKOR_POLICY_PATH")"},