git.stella-ops.org/src/__Tests/EvidenceLocker/Bundles/Golden

Evidence Locker Golden Fixtures (EB10)

Purpose: reference bundles and replay records used by CI to prove deterministic packaging, DSSE subject stability, and portable redaction behaviour.

Layout

• sealed/ – sealed bundle ingredients (manifest.json, checksums.txt, DSSE signature.json, bundle.json, evidence ndjson) plus expected.json.
• portable/ – redacted bundle ingredients and expected.json noting masked fields and tenant token.
• replay/ – replay.ndjson with expected.json (recordDigest, sequence, ledger URI); ordering is canonical (recordedAtUtc, scanId).

Expectations

• Gzip timestamp pinned to 2025-01-01T00:00:00Z; tar entries use 0644 perms and fixed mtime.
• checksums.txt sorted lexicographically by canonicalPath; Merkle root equals sha256sum checksums.txt.
• DSSE subject ties to the Merkle root; manifest validates against schemas/bundle.manifest.schema.json.
• Portable bundles must exclude tenant identifiers and include redaction metadata in the manifest.

How to (re)generate

1. Set TZ=UTC and ensure deterministic tool versions.
2. Run EvidenceLocker pipeline to produce sealed bundle; copy outputs here with expected hash values.
3. Produce portable bundle and replay records using the same input set; write expected.json capturing root hashes and replay digests.
4. Update xUnit tests in StellaOps.EvidenceLocker.Tests to consume these fixtures without network calls.