AppUpdater 4.1.0: verify GitHub artifact attestations

[mxcl]

Closes automic-vault/automic-vault#88

Adds opt-in, fail-closed GitHub Actions provenance verification directly to AppUpdater.

• introduces GitHubAttestationPolicy while preserving AppUpdater 4 behavior when unset
• verifies GitHub SLSA v1 / Sigstore bundle v0.3 provenance natively with Foundation, Security, and CryptoKit
• validates TUF trust metadata, certificate identity, DSSE, Rekor transparency material, artifact digest, workflow/ref, and release commit
• hashes downloads before verification and re-hashes promoted DMGs before read-only mounting
• documents the security model and releases 4.1.0

Validation: all 73 tests pass, including TUF, parser/network, mutation, transaction, compatibility, and Automic Vault 2.8.0 fixture coverage.

[coveralls]

Coverage Report for CI Build 30756539078

Coverage increased (+9.1%) to 70.447%

Details

• Coverage increased (+9.1%) from the base build.
• Patch coverage: 312 uncovered changes across 6 files (1113 of 1425 lines covered, 78.11%).
• 1 coverage regression across 1 file.

Uncovered Changes

File	Changed	Covered	%
Attestation/Sigstore.swift	107	20	18.69%
Attestation/TUF.swift	377	293	77.72%
AppUpdater.swift	133	61	45.86%
Attestation/Primitives.swift	318	277	87.11%
Attestation/X509.swift	248	227	91.53%
Attestation/Verification.swift	242	235	97.11%

Coverage Regressions

1 previously-covered line in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
AppUpdater.swift	1	59.39%

---

Coverage Stats

Relevant Lines:	2575
Covered Lines:	1814
Line Coverage:	70.45%
Coverage Strength:	447.18 hits per line

---

💛 - Coveralls

[Copilot]

Pull request overview

Adds opt-in, fail-closed verification of GitHub Artifact Attestations (Sigstore bundle + SLSA provenance) to AppUpdater, including an embedded Sigstore trust bootstrap and TUF-based trust root refresh, with accompanying fixtures and tests.

Changes:

• Introduces GitHubAttestationPolicy and end-to-end provenance verification (bundle, cert identity, Rekor transparency, SLSA statement binding).
• Adds Sigstore TUF client + embedded bootstrap resources for offline/bootstrapping behavior.
• Expands test coverage with fixtures for Sigstore bundles and Sigstore TUF metadata rotation/rollback cases.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
AppUpdater.swift	Wires attestation verification into update preparation; tightens network transfer handling; adds promoted-DMG digest re-check.
Package.swift	Adds Attestation sources and processes embedded resources + test fixtures.
Attestation/Sigstore.swift	Implements GitHub attestations API client, policy validation, bundle fetching/decompression, and verification loop.
Attestation/Verification.swift	Verifies Sigstore bundle (DSSE, cert identity/chain/SCT) + Rekor transparency material + SLSA statement constraints.
Attestation/TUF.swift	Implements Sigstore TUF trusted-root refresh, caching, rotation/rollback checks, and trusted-root decoding.
Attestation/X509.swift	Minimal X.509 parsing + EKU/key-usage checks, chain validation, SCT verification, and signature verification.
Attestation/Primitives.swift	Provides canonical JSON, DER/TLS parsing helpers, signature verification, Snappy, and Merkle proof verification.
Resources/tuf-root.json	Embedded TUF root used for Sigstore trust bootstrapping.
Resources/trusted-root.json	Embedded Sigstore trusted root snapshot fallback.
Resources/README.txt	Documents purpose of embedded trust resources.
README.md	Documents new provenance feature and updated security model; bumps package version to 4.1.0.
Tests/AppUpdaterTests/AppUpdaterTests.swift	Adds decoding + promoted-digest validation tests; asserts default attestationPolicy is nil.
Tests/AppUpdaterTests/SigstoreVerificationTests.swift	Adds fixture-based Sigstore bundle verification test + mutation-based negative tests.
Tests/AppUpdaterTests/TUFTests.swift	Adds tests for root rotation, rollback, expiry, truncation/tampering, and threshold enforcement.
Tests/AppUpdaterTests/AttestationPrimitiveTests.swift	Adds unit tests for canonical JSON, DER parsing, Snappy, P-256 verification, and Merkle proof basics.
Tests/Fixtures/AutomicVault-2.8.0.bundle.json	Fixture: decompressed GitHub SLSA/Sigstore bundle used by verification tests.
Tests/Fixtures/README.md	Fixture provenance/licensing note for the Automic Vault bundle fixture.
Tests/Fixtures/tuf-trusted-root.json	Fixture: Sigstore trusted root JSON used by TUF tests.
Tests/Fixtures/tuf-timestamp.json	Fixture: TUF timestamp metadata used by TUF tests.
Tests/Fixtures/tuf-742.timestamp.json	Fixture: older TUF timestamp metadata used to test rollback detection.
Tests/Fixtures/tuf-165.snapshot.json	Fixture: TUF snapshot metadata used by TUF tests.
Tests/Fixtures/tuf-14.targets.json	Fixture: TUF targets metadata used by TUF tests.
Tests/Fixtures/tuf-14.root.json	Fixture: older TUF root used to test sequential root rotation.
Tests/Fixtures/tuf-15.root.json	Fixture: newer TUF root used to test sequential root rotation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mxcl]

@copilot do you consider your issues resolved by the latest commit?

[Copilot]

@copilot do you consider your issues resolved by the latest commit?

Yes, both issues are resolved in commit edf5f5b:

1. AppUpdater.swift:475 – data.count is now cast with Int64(data.count) < maximumBytes, fixing the Int/Int64 mismatch.
2. Attestation/Verification.swift – The checkpoint host is now dynamically extracted from the header line rather than hard-coded. It's validated to be exactly rekor.sigstore.dev or a *.rekor.sigstore.dev subdomain, and the expected signature prefix is constructed from that extracted host, so sharded log hosts like log2025-1.rekor.sigstore.dev are accepted correctly.