feat: add Debian clang-format official evidence

[SSobol77]

Summary

Add verified official-source distro evidence for the existing Debian clang-format mapping.

This PR promotes exactly one additional existing mapping:

• artifact: deb
• source policy artifact: deb
• distro family: debian
• tool: clang-format
• package name: clang-format
• executable name: clang-format

After this PR, exactly five generated evidence records are verified-official-source:

• deb/yamllint
• deb/shellcheck
• deb/clang-tidy
• deb/cppcheck
• deb/clang-format

No other mapping is promoted.

What changed

• Extended OFFICIAL_DISTRO_EVIDENCE_BY_POLICY with one new override:

  • ("deb", "clang-format")

• Generated evidence for deb/clang-format now uses:

  • evidence_source_type = official-distro-metadata
  • evidence_status = verified-official-source
  • official_source_kind = distro-package-index
  • verification_scope = package-name-and-executable
  • official_source_url = https://packages.debian.org/clang-format
  • evidence_record_id = official-distro-metadata:deb:clang-format
  • external_verification_required_for_new_mappings = false
  • release_blocking = false

Official Debian evidence basis

The evidence note references:

• Debian package metadata:
  • https://packages.debian.org/clang-format
• Debian filelist metadata:
  • https://packages.debian.org/sid/amd64/clang-format/filelist
• Debian manpage metadata:
  • https://manpages.debian.org/testing/clang-format-15/clang-format-15.1

These sources are used only as evidence for the existing package/executable mapping. No versions are added as contract fields.

Promotion boundary

Existing official evidence is preserved:

• deb/yamllint
• deb/shellcheck
• deb/clang-tidy
• deb/cppcheck

Docker helper mappings are intentionally not promoted:

• docker-deb-helper/yamllint remains repository-local-policy/current-policy-baseline
• docker-deb-helper/shellcheck remains repository-local-policy/current-policy-baseline
• docker-deb-helper/clang-tidy remains repository-local-policy/current-policy-baseline
• docker-deb-helper/cppcheck remains repository-local-policy/current-policy-baseline
• docker-deb-helper/clang-format remains repository-local-policy/current-policy-baseline

All RPM/openSUSE/Arch/Slackware mappings remain unchanged.

Scope controls

This PR does not:

• add package names
• change OS_PACKAGE_NAMES
• change executable names
• add package versions as contract fields
• add checksums
• run package managers
• download anything
• perform network operations
• vendor binaries or archives
• add generated artifacts
• weaken the Full-required baseline
• reclassify required tools as optional
• touch UI/provider/parser/runtime/TextMate/theme code

Verifier behavior

The existing promotion gate remains enforced.

Added/updated tests verify rejection of tampered deb/clang-format official evidence, including:

• official source URL drift
• official source kind drift
• verification scope drift
• verified package-name drift
• verified executable-name drift
• source type downgrade to repository-local-policy
• missing verification note
• evidence record ID downgrade to repository-local-policy:deb:clang-format

Validation

Passed locally / by agent report:

uv run ruff check src tests scripts
uv run ruff format --check src tests scripts
uv run python scripts/check_runtime_imports.py
uv run pytest -q tests/packaging/test_f4_linter_linux_provisioning.py
uv run pytest -q tests/packaging
uv run pytest -q tests/extensions/linters
uv run pytest -q tests/docs

Observed results:

tests/packaging/test_f4_linter_linux_provisioning.py: 108 passed
tests/packaging: 481 passed
tests/extensions/linters: 226 passed
tests/docs: 18 passed

Safety:

No new package names.
No OS_PACKAGE_NAMES changes.
No executable-name changes.
No package versions as contract fields.
No checksums.
No package-manager calls.
No downloads.
No network operations.
No generated artifacts.
No vendored binaries.
No UI/provider/parser/runtime/TextMate/theme changes.

Next work

A follow-up PR can promote the next single existing Debian mapping only after adding similarly explicit official-source evidence and verifier coverage.

Summary by CodeRabbit

• New Features

  • Added official Debian mapping and verification support for the clang-format tool.
  • Included verified source evidence and release-blocking validation for the new mapping.

• Bug Fixes

  • Improved detection of altered, incomplete, or invalid official evidence records.
  • Expanded validation coverage for Debian tool mappings and evidence summaries.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 877d7c04-17aa-4b5c-978f-f7930eac9925

📥 Commits

Reviewing files that changed from the base of the PR and between 7aef1d6 and 1f6ec9d.

📒 Files selected for processing (2)

• scripts/f4_linter_linux_provisioning.py
• tests/packaging/test_f4_linter_linux_provisioning.py

---

📝 Walkthrough

Walkthrough

Adds canonical Debian clang-format distro evidence and updates Linux provisioning tests for mapping, promotion counts, baseline handling, and rejection of tampered or incomplete evidence.

Changes

Debian clang-format evidence

Layer / File(s)	Summary
Canonical Debian evidence record scripts/f4_linter_linux_provisioning.py	Registers official-source evidence metadata for the Debian clang-format package and executable pair.
Mapping and promotion coverage tests/packaging/test_f4_linter_linux_provisioning.py	Extends Debian mapping, promotion, baseline, helper, and release-blocking summary expectations for clang-format; preserves baseline-specific checks with checkstyle.
Manifest verifier validation tests/packaging/test_f4_linter_linux_provisioning.py	Adds rejection tests for tampered clang-format evidence fields, missing verification notes, invalid record identifiers, and invalid baseline evidence claims.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• SSobol77/ecli#125: Introduces the F4 provisioning framework extended by this Debian evidence record.
• SSobol77/ecli#126: Adds the evidence-gate wiring consumed by these Debian evidence entries.
• SSobol77/ecli#131: Introduces related evidence promotion and verifier-hardening logic.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding verified official evidence for Debian clang-format.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/f4-linux-deb-clang-format-official-evidence

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud