FA-9996 / Packaging / Open access
Package publication plan: Unsigned provenance is ignored · case 01
Unsigned provenance is ignored.
ROOT CAUSE
The implementation substitutes if False: for if not attested:, so unsigned provenance is ignored.
VERIFIED REPAIR
Require the configured publication attestation.
Unsuccessful approach: The attempted repair substitutes if attested:. Fixture 1 still yields 'missing-attestation' instead of 'publish'.
Case contract
Reject an immutable version with changed digest; skip equal published digests; reject missing attestations; reject private packages on public registries; otherwise publish. Existing equality takes precedence over publication checks.
Why this case matters
An offline model of package publication plan, suitable for testing build and release tooling without external services.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(version, digest, existing, attested, private, registry):
if version in existing:
if existing[version] == digest: return 'skip'
return 'immutable-conflict'
if False: return 'missing-attestation'
if private and registry == 'public': return 'private-package'
return 'publish'
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('1', 'a', {}, True, False, 'public'), 'publish')
check('fixture 2', solve('1', 'a', {'1': 'a'}, False, True, 'public'), 'skip')
check('fixture 3', solve('1', 'a', {'1': 'b'}, True, False, 'public'), 'immutable-conflict')
check('fixture 4', solve('1', 'a', {}, False, False, 'public'), 'missing-attestation')
check('fixture 5', solve('1', 'a', {}, True, True, 'public'), 'private-package')
check('fixture 6', solve('1', 'a', {}, True, True, 'private'), 'publish')
check('fixture 7', solve('2', 'a', {'1': 'b'}, True, False, 'public'), 'publish')
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | publish | publish | Passed |
| fixture 2 | skip | skip | Passed |
| fixture 3 | immutable-conflict | immutable-conflict | Passed |
| fixture 4 | publish | missing-attestation | Failed |
| fixture 5 | private-package | private-package | Passed |
| fixture 6 | publish | publish | Passed |
| fixture 7 | publish | publish | Passed |
SHA-256 / 0884b52e2c993a4806729b5c20f7d3ca1eb3b87154cdd83313ab8c6078e6754a
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(version, digest, existing, attested, private, registry):
if version in existing:
if existing[version] == digest: return 'skip'
return 'immutable-conflict'
if attested: return 'missing-attestation'
if private and registry == 'public': return 'private-package'
return 'publish'
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('1', 'a', {}, True, False, 'public'), 'publish')
check('fixture 2', solve('1', 'a', {'1': 'a'}, False, True, 'public'), 'skip')
check('fixture 3', solve('1', 'a', {'1': 'b'}, True, False, 'public'), 'immutable-conflict')
check('fixture 4', solve('1', 'a', {}, False, False, 'public'), 'missing-attestation')
check('fixture 5', solve('1', 'a', {}, True, True, 'public'), 'private-package')
check('fixture 6', solve('1', 'a', {}, True, True, 'private'), 'publish')
check('fixture 7', solve('2', 'a', {'1': 'b'}, True, False, 'public'), 'publish')
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | missing-attestation | publish | Failed |
| fixture 2 | skip | skip | Passed |
| fixture 3 | immutable-conflict | immutable-conflict | Passed |
| fixture 4 | publish | missing-attestation | Failed |
| fixture 5 | missing-attestation | private-package | Failed |
| fixture 6 | missing-attestation | publish | Failed |
| fixture 7 | missing-attestation | publish | Failed |
SHA-256 / 9d487e919eead34cf38ff20fea51dfd67034faa01871293e929dc9691eb4027d
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(version, digest, existing, attested, private, registry):
if version in existing:
if existing[version] == digest: return 'skip'
return 'immutable-conflict'
if not attested: return 'missing-attestation'
if private and registry == 'public': return 'private-package'
return 'publish'
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('1', 'a', {}, True, False, 'public'), 'publish')
check('fixture 2', solve('1', 'a', {'1': 'a'}, False, True, 'public'), 'skip')
check('fixture 3', solve('1', 'a', {'1': 'b'}, True, False, 'public'), 'immutable-conflict')
check('fixture 4', solve('1', 'a', {}, False, False, 'public'), 'missing-attestation')
check('fixture 5', solve('1', 'a', {}, True, True, 'public'), 'private-package')
check('fixture 6', solve('1', 'a', {}, True, True, 'private'), 'publish')
check('fixture 7', solve('2', 'a', {'1': 'b'}, True, False, 'public'), 'publish')
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | publish | publish | Passed |
| fixture 2 | skip | skip | Passed |
| fixture 3 | immutable-conflict | immutable-conflict | Passed |
| fixture 4 | missing-attestation | missing-attestation | Passed |
| fixture 5 | private-package | private-package | Passed |
| fixture 6 | publish | publish | Passed |
| fixture 7 | publish | publish | Passed |
SHA-256 / 547ca9fee9b6a8d368115b3a6c8eda59df0d444f3bf68ecea0f97f67e9e723db
Verification & scope
This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:38:34.881502+00:00.
Case digest / dc82958963dc16d969ffc4f182948c303dfa36c9e4dada25feeadf4b9bacfecf