feat: Add DigestUpsertRequest and LockEntity models

- Introduced DigestUpsertRequest for handling digest upsert requests with properties like ChannelId, Recipient, DigestKey, Events, and CollectUntil.
- Created LockEntity to represent a lightweight distributed lock entry with properties such as Id, TenantId, Resource, Owner, ExpiresAt, and CreatedAt.

feat: Implement ILockRepository interface and LockRepository class

- Defined ILockRepository interface with methods for acquiring and releasing locks.
- Implemented LockRepository class with methods to try acquiring a lock and releasing it, using SQL for upsert operations.

feat: Add SurfaceManifestPointer record for manifest pointers

- Introduced SurfaceManifestPointer to represent a minimal pointer to a Surface.FS manifest associated with an image digest.

feat: Create PolicySimulationInputLock and related validation logic

- Added PolicySimulationInputLock record to describe policy simulation inputs and expected digests.
- Implemented validation logic for policy simulation inputs, including checks for digest drift and shadow mode requirements.

test: Add unit tests for ReplayVerificationService and ReplayVerifier

- Created ReplayVerificationServiceTests to validate the behavior of the ReplayVerificationService under various scenarios.
- Developed ReplayVerifierTests to ensure the correctness of the ReplayVerifier logic.

test: Implement PolicySimulationInputLockValidatorTests

- Added tests for PolicySimulationInputLockValidator to verify the validation logic against expected inputs and conditions.

chore: Add cosign key example and signing scripts

- Included a placeholder cosign key example for development purposes.
- Added a script for signing Signals artifacts using cosign with support for both v2 and v3.

chore: Create script for uploading evidence to the evidence locker

- Developed a script to upload evidence to the evidence locker, ensuring required environment variables are set.

scripts/mirror/sign_thin_bundle.py

@@ -7,7 +7,8 @@ Usage:
     --key out/mirror/thin/tuf/keys/mirror-ed25519-test-1.pem \
     --manifest out/mirror/thin/mirror-thin-v1.manifest.json \
     --tar out/mirror/thin/mirror-thin-v1.tar.gz \
-    --tuf-dir out/mirror/thin/tuf
+    --tuf-dir out/mirror/thin/tuf \
+    --time-anchor out/mirror/thin/stage-v1/layers/time-anchor.json
 
 Writes:
   - mirror-thin-v1.manifest.dsse.json
@@ -48,6 +49,7 @@ def main():
     ap.add_argument("--tar", required=True, type=pathlib.Path)
     ap.add_argument("--tuf-dir", required=True, type=pathlib.Path)
     ap.add_argument("--bundle", required=False, type=pathlib.Path)
+    ap.add_argument("--time-anchor", required=False, type=pathlib.Path)
     args = ap.parse_args()
 
     key = load_key(args.key)
@@ -75,12 +77,29 @@ def main():
         bundle_dsse_path = args.bundle.with_suffix(".dsse.json")
         write_json(bundle_dsse_path, bundle_dsse)
 
+    anchor_dsse_path = None
+    if args.time_anchor:
+        anchor_bytes = args.time_anchor.read_bytes()
+        anchor_sig = sign_bytes(key, anchor_bytes)
+        anchor_dsse = {
+            "payloadType": "application/vnd.stellaops.time-anchor+json",
+            "payload": b64url(anchor_bytes),
+            "signatures": [{"keyid": keyid, "sig": b64url(anchor_sig)}],
+        }
+        anchor_dsse_path = args.time_anchor.with_suffix(".dsse.json")
+        write_json(anchor_dsse_path, anchor_dsse)
+
     # update TUF metadata
     for name in ["root.json", "targets.json", "snapshot.json", "timestamp.json"]:
         sign_tuf(args.tuf_dir / name, keyid, key)
 
-    extra = f", bundle DSSE -> {bundle_dsse_path}" if args.bundle else ""
-    print(f"Signed DSSE + TUF using keyid {keyid}; DSSE -> {dsse_path}{extra}")
+    parts = [f"manifest DSSE -> {dsse_path}"]
+    if args.bundle:
+        parts.append(f"bundle DSSE -> {bundle_dsse_path}")
+    if anchor_dsse_path:
+        parts.append(f"time anchor DSSE -> {anchor_dsse_path}")
+    parts.append("TUF metadata updated")
+    print(f"Signed DSSE + TUF using keyid {keyid}; " + ", ".join(parts))
 
 if __name__ == "__main__":
     main()