REQ 027

REQ-027: LVLIBP release dependencies require full immutable-release + attestation verification

Requirement

A pre-built .lvlibp release dependency fetched by the native pipeline shall only be accepted from a published, immutable (non-draft) GitHub Release whose in-toto attestation, resolved tag commit, and downloaded release manifest all cross-match the requested repository, tag, version, and asset.

Rationale

A floating, unverified binary dependency would undermine every other supply-chain guarantee this pipeline makes elsewhere (checkout pinning, SBOM generation, vulnerability gating).

Fit Criterion

Invoke-LvlibpReleaseDependencyStage throws on any mismatch across: release immutability/draft status, gh release verify's attestation statement type/repository/tag/purl, the annotated-tag-chain-resolved commit SHA, the release manifest's own module/source/release fields, and a required exactly-one-match for each asset (including its SBOM) with SHA-256 verification after download.

Verification

Code review of internal/Pipeline.Stages.ps1's Invoke-LvlibpReleaseDependencyStage function (lines ~373-620).

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-027

TestArtifact

Code review of the full attestation/tag/manifest/asset cross-match chain

CodeRef

internal/Pipeline.Stages.ps1 Invoke-LvlibpReleaseDependencyStage module

Status

Verified (manual)