150b3730ef
Some checks failed
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
Mirror Thin Bundle Sign & Verify / mirror-sign (push) Has been cancelled
api-governance / spectral-lint (push) Has been cancelled
28 lines
1.1 KiB
Markdown
28 lines
1.1 KiB
Markdown
# Portable Evidence Bundles (DOCS-AIRGAP-58-004)
|
||
|
||
Guidance for exporting/importing portable evidence bundles across enclaves.
|
||
|
||
## Bundle contents
|
||
- Evidence payloads (VEX observations/linksets) as NDJSON.
|
||
- Timeline events and attestation DSSE envelopes.
|
||
- Manifest with `bundleId`, `source`, `tenant`, `createdAt`, `files[]`, `dsseEnvelopeHash` (optional).
|
||
|
||
## Export
|
||
- Produce from Evidence Locker/Excititor with deterministic ordering and SHA-256 hashes.
|
||
- Include Merkle root over evidence files; store in manifest.
|
||
- Sign manifest (DSSE) when trust roots available.
|
||
|
||
## Import
|
||
- Verify manifest hash, Merkle root, and DSSE signature offline.
|
||
- Enforce tenant scoping; refuse cross-tenant bundles.
|
||
- Emit timeline event upon successful import.
|
||
|
||
## Constraints
|
||
- No external lookups; verification uses bundled roots.
|
||
- Max size per bundle configurable; default 500 MB.
|
||
- Keep file paths UTF-8 and slash-separated; avoid host-specific metadata.
|
||
|
||
## Determinism
|
||
- Sort files lexicographically; use ISO-8601 UTC timestamps.
|
||
- Avoid re-compressing files; if tar is used, set deterministic headers (uid/gid=0, mtime=0).
|