Consume Sigstore-authorized enclave releases

[AnthonyRonning]

Summary

• replace runtime GitHub PCR-history consumption with dynamically refreshed, fixed-origin TUF authorization from `https://attestations.trymaple.ai/tuf/\`
• require one complete PCR0/PCR1/PCR2 tuple from an active environment-scoped release before key exchange; new clients have no legacy PCR-file fallback
• embed only the Maple TUF root and authenticate the current channel, exact release manifest, portable Sigstore bundle, and Sigstore trusted-root bytes
• cryptographically verify the Sigstore bundle locally in both Rust and browser TypeScript, then verify the fresh nonce-bound Nitro attestation and exact PCR tuple
• consume the in-tree SDK from Maple and proxy, remove GitHub URLs from the runtime trust path, and preserve explicit feature-gated local mock attestation only
• persist rollback/fork/expiry/root/channel/high-water state across restarts/tabs

Browser and dependency boundary

Browser TypeScript uses the unmodified exact-pinned `@freedomofpress/sigstore-browser@0.1.14` package with a committed lockfile and Maple-owned strict adapter. The adapter requires exact Sigstore bundle v0.3, one message signature/certificate/Rekor entry, SHA-256, a signed inclusion checkpoint, one RFC3161 timestamp, and explicit tlog/CT/TSA thresholds. It injects the TUF-authenticated trusted root and supplements upstream verification with full certificate-path validity at authenticated observer time. It never invokes the package's network TUF loader.

Rust performs the corresponding local portable-bundle verification through its pinned Sigstore crates.

Neither runtime contacts GitHub, Fulcio, Rekor, or Sigstore's TUF service. Provenance strings may name GitHub, but clients do not dereference or authorize those strings.

Client trust contract

TUF authorizes exact bytes and current release membership. Clients do not embed or enforce a builder identity, GitHub repository, workflow filename, or CI provider. A repository/CI migration changes protected backend promotion configuration and future signed manifests, not the SDK trust protocol.

Sigstore provides attributable, transparency-recorded provenance. It is not an independent release authority in the initial one-authority design because Maple TUF also authenticates the Sigstore trusted-root target.

Nitro verification remains mandatory: after policy/evidence verification, the client sends a fresh nonce and accepts only an AWS-signed document whose key binding and complete PCR0/PCR1/PCR2 tuple match one active release atomically.

Rollback and root contract

• clients traverse every numbered TUF root sequentially and persist high-water/authority history
• root and online-role material remain lifetime-disjoint; retired online keys cannot be reauthorized
• the initial root limit is 33 versions / 32 client transitions
• existing clients can follow ordinary sequential dual-signed root rotations, including future key/threshold/HSM upgrades
• SDK releases must not skip to a newer embedded bootstrap until an authenticated bridge-history design exists
• the checked-in root assets are identical unpublished sentinels and fail closed before publication

Compatibility and activation

Old released clients remain supported by the backend's unchanged signed GitHub PCR histories during the overlap. New clients in this PR are intentionally TUF/Sigstore-only.

No package or app version is bumped by this draft. Activation still requires:

1. review/merge backend publication infrastructure and publish/review the real root plus initial TUF state
2. replace the placeholder root assets in a reviewed change
3. publish the breaking SDK release
4. publish/update dependent proxy and Maple versions
5. run hosted real-repository/platform smoke tests

No production root, TUF repository, SDK/proxy release, Sigstore evidence, enclave deployment, or live smoke test is created by this PR.

Validation

• browser Sigstore focused suite: 18 passed
• canonical TypeScript SDK suite: 201 passed, 3 intentional hosted skips
• Rust SDK library: 150 passed; focused trusted-release/Sigstore tests: 6 passed
• Maple commit hook: SDK/frontend builds, 799 frontend tests, 397 native tests plus 3 CLI tests passed; 2 native tests intentionally ignored
• Worker/proxy/frontend/platform and exact-head CI builds passed across Rust, TypeScript, web, macOS, Linux, Windows, iOS, and Android
• exact-head CI: 32 passed, 2 expected skips, 0 pending
• independent browser dependency, TypeScript, Rust, proxy, Tinfoil-comparison, trust-boundary, and final scope reviews: no remaining P0/P1/P2 findings

The sole red aggregate CodeQL check includes 39 alerts already open on `master` plus one PR-ref alert at the byte-identical, credential-free `test_connection` health GET. Two independent reviews traced it as a field-insensitive false positive: no API key, JWT, session ID/key, request body, cookie, or trusted-release data flows into that request; every language-specific CodeQL analysis job passed. No code suppression or security-path refactor was made for the false positive.

The branch is rebased/current on `origin/master`, was not merged with `master`, and this PR remains draft and unmerged.

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	9ccbb8a
Status:	✅  Deploy successful!
Preview URL:	https://4b7f7951.maple-ca8.pages.dev
Branch Preview URL:	https://codex-sigstore-tee-attestati.maple-ca8.pages.dev

View logs