fix(deps): update ccatoken digest to ce0b02b - #229

#!/bin/bash
set -e
printf '%s\n' '--- manifest ---'
cat -n deps/verifier/Cargo.toml | sed -n '100,115p'
printf '%s\n' '--- lockfile ccatoken entries ---'
rg -n -A12 -B4 '^name = "ccatoken"$|ccatoken' Cargo.lock
printf '%s\n' '--- repository status and changed paths ---'
git status --short
git diff --stat

#!/usr/bin/env bash
set -euo pipefail

new_rev='6a108e59e783fc61dbbc43601e2892317ccbaa94'

curl -fsS -X POST https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  -d "{\"commit\":\"${new_rev}\"}" |
  jq -e '((.vulns // []) | length) == 0'

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- manifest and lockfile ---'
sed -n '96,116p' deps/verifier/Cargo.toml
sed -n '1568,1595p' Cargo.lock

printf '%s\n' '--- upstream commit metadata ---'
curl -fsS https://api.github.com/repos/veraison/rust-ccatoken/commits/6a108e59e783fc61dbbc43601e2892317ccbaa94 |
  jq '{sha: .sha, message: .commit.message, author: .commit.author, parents: [.parents[].sha]}'

printf '%s\n' '--- upstream diffstat and changed files ---'
curl -fsS https://api.github.com/repos/veraison/rust-ccatoken/compare/870c83f83c9690643c4eb8e5986ef1a4779fc596...6a108e59e783fc61dbbc43601e2892317ccbaa94 |
  jq '{status, ahead_by, behind_by, total_commits, files: [.files[] | {filename, status, additions, deletions, changes}]}'

printf '%s\n' '--- upstream manifest and license files at new revision ---'
for path in Cargo.toml LICENSE LICENSE-MIT LICENSE-APACHE-2.0; do
  printf '\n### %s\n' "$path"
  curl -fsSL -w '\nHTTP %{http_code}\n' \
    "https://raw.githubusercontent.com/veraison/rust-ccatoken/6a108e59e783fc61dbbc43601e2892317ccbaa94/$path" ||
    true
done

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- repository CI supply-chain controls ---'
git ls-files '.github/workflows/*' '.github/workflows/**/*' | sort
rg -n -i 'osv|dependabot|cargo.audit|cargo-deny|sbom|provenance|attestation|cosign|sigstore|sign(ed|ing)? artifact' .github Makefile* Containerfile* Dockerfile* 2>/dev/null || true

printf '%s\n' '--- upstream lockfile at selected revision ---'
curl -fsS https://raw.githubusercontent.com/veraison/rust-ccatoken/6a108e59e783fc61dbbc43601e2892317ccbaa94/Cargo.lock |
  awk '
    /^name = "ccatoken"$/ {show=1}
    show {print}
    show && /^$/ {exit}
  '

printf '%s\n' '--- OSV results for the selected package and direct dependency versions ---'
python3 - <<'PY'
import json, urllib.request

queries = [
    {"package": {"name": "ccatoken", "ecosystem": "crates.io"}, "version": "0.1.0"},
    {"package": {"name": "base64", "ecosystem": "crates.io"}, "version": "0.21.7"},
    {"package": {"name": "bitflags", "ecosystem": "crates.io"}, "version": "2.13.1"},
    {"package": {"name": "ciborium", "ecosystem": "crates.io"}, "version": "0.2.2"},
    {"package": {"name": "clap", "ecosystem": "crates.io"}, "version": "4.4.10"},
    {"package": {"name": "cose-rust", "ecosystem": "crates.io"}, "version": "0.1.7"},
    {"package": {"name": "ear", "ecosystem": "crates.io"}, "version": "0.5.0"},
    {"package": {"name": "hex", "ecosystem": "crates.io"}, "version": "0.4.3"},
    {"package": {"name": "hex-literal", "ecosystem": "crates.io"}, "version": "0.4.1"},
    {"package": {"name": "jsonwebtoken", "ecosystem": "crates.io"}, "version": "10.3.0"},
    {"package": {"name": "multimap", "ecosystem": "crates.io"}, "version": "0.9.1"},
    {"package": {"name": "openssl", "ecosystem": "crates.io"}, "version": "0.10.72"},
    {"package": {"name": "serde", "ecosystem": "crates.io"}, "version": "1.0.0"},
    {"package": {"name": "serde_json", "ecosystem": "crates.io"}, "version": "1.0.0"},
    {"package": {"name": "serde_with", "ecosystem": "crates.io"}, "version": "3.14.0"},
    {"package": {"name": "thiserror", "ecosystem": "crates.io"}, "version": "1.0.0"},
]
body = json.dumps({"queries": queries}).encode()
req = urllib.request.Request(
    "https://api.osv.dev/v1/querybatch",
    data=body,
    headers={"Content-Type": "application/json"},
)
with urllib.request.urlopen(req) as r:
    data = json.load(r)
for q, result in zip(queries, data.get("results", [])):
    p = q["package"]
    print(f'{p["name"]} {q["version"]}: {len(result.get("vulns", []))} advisories')
PY

#!/usr/bin/env bash
set -u

printf '%s\n' '--- Cargo invocation mode in CI ---'
rg -n -C 2 --glob '*.yml' --glob '*.yaml' --glob 'Makefile*' --glob '*.toml' \
  'cargo (build|check|test|clippy|fmt|metadata|audit|deny)|--locked|--frozen' \
  .github Makefile* Cargo.toml deps/verifier/Cargo.toml 2>/dev/null || true

printf '%s\n' '--- all ccatoken lockfile references ---'
rg -n -C 2 'ccatoken|rust-ccatoken|870c83f|6a108e59' Cargo.lock deps/verifier/Cargo.toml .github Makefile* 2>/dev/null || true

printf '%s\n' '--- OSV results for the selected crate dependencies ---'
python3 - <<'PY'
import json, urllib.request

packages = [
    ("base64", "0.21.7"), ("bitflags", "2.13.1"), ("ciborium", "0.2.2"),
    ("clap", "4.4.10"), ("cose-rust", "0.1.7"), ("ear", "0.5.0"),
    ("hex", "0.4.3"), ("hex-literal", "0.4.1"), ("jsonwebtoken", "10.3.0"),
    ("multimap", "0.9.1"), ("openssl", "0.10.72"), ("serde", "1.0.0"),
    ("serde_json", "1.0.0"), ("serde_with", "3.14.0"), ("thiserror", "1.0.0"),
]
queries = [{"package": {"name": n, "ecosystem": "crates.io"}, "version": v}
           for n, v in packages]
body = json.dumps({"queries": queries}).encode()
req = urllib.request.Request(
    "https://api.osv.dev/v1/querybatch",
    data=body,
    headers={"Content-Type": "application/json"},
)
try:
    with urllib.request.urlopen(req) as response:
        results = json.load(response).get("results", [])
    for (name, version), result in zip(packages, results):
        vulns = result.get("vulns", [])
        print(f"{name} {version}: {len(vulns)} advisories")
        for vuln in vulns:
            print(f"  - {vuln.get('id')}: {vuln.get('summary', '')}")
except Exception as exc:
    print(f"OSV query failed: {exc}")

#!/usr/bin/env bash
set -euo pipefail

revision='1aa851d78f825ba352c017f65f225a7c8b2189f1'

curl -fsS -X POST https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  -d "{\"commit\":\"${revision}\"}" |
  jq -e '((.vulns // []) | length) == 0'

cargo deny check advisories

#!/usr/bin/env bash
set -euo pipefail

revision='c2257a351f792cb64a8d230b4caa6256fd8118ed'

printf '%s\n' '--- OSV commit query ---'
curl -fsS -X POST https://api.osv.dev/v1/query \
  -H 'Content-Type: application/json' \
  -d "{\"commit\":\"${revision}\"}" |
  jq '{vulns: [(.vulns // [])[] | {id, summary}]}'

printf '%s\n' '--- tracked build and workflow controls ---'
git ls-files -z -- '.github/workflows/**' 'Makefile*' '**/Makefile*' \
  'Dockerfile*' '**/Dockerfile*' 'Containerfile*' '**/Containerfile*' \
  '*.yml' '*.yaml' '*.sh' |
  xargs -0 -r rg -n -i 'sbom|provenance|attest|sigstore|cosign' || true

#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- dependency declaration and lockfile references ---'
sed -n '100,116p' deps/verifier/Cargo.toml
rg -n -C 2 'ccatoken|rust-ccatoken|c2257a351f792cb64a8d230b4caa6256fd8118ed|870c83f' Cargo.lock deps/verifier/Cargo.lock 2>/dev/null || true

printf '%s\n' '--- build action ---'
sed -n '55,90p' .github/actions/build-single-image/action.yml

printf '%s\n' '--- callers of build-single-image and relevant workflow controls ---'
rg -n -C 3 'build-single-image|provenance|attest|cosign|sigstore|sbom' .github/workflows .github/actions --glob '*.yml' --glob '*.yaml' --glob 'action.yml'

set -eu
printf '%s\n' '--- manifest base/head ---'
git show 0ba50f1b6b8dd3551285cfcbeee1a7a2cf42ab35:deps/verifier/Cargo.toml | nl -ba | sed -n '104,114p'
git show 66f9daa4445bb9109f9a1f865a0f3218bfc6ff70:deps/verifier/Cargo.toml | nl -ba | sed -n '104,114p'
printf '%s\n' '--- lock base/head ---'
git show 0ba50f1b6b8dd3551285cfcbeee1a7a2cf42ab35:Cargo.lock | nl -ba | sed -n '1566,1576p'
git show 66f9daa4445bb9109f9a1f865a0f3218bfc6ff70:Cargo.lock | nl -ba | sed -n '1566,1576p'
printf '%s\n' '--- attestation-service Docker locked commands ---'
for f in attestation-service/docker/as-grpc/Dockerfile attestation-service/docker/as-restful/Dockerfile; do
  printf '%s\n' "--- $f"
  nl -ba "$f" | sed -n '1,42p'
done
printf '%s\n' '--- KBS locked commands and feature binding ---'
nl -ba kbs/Makefile | sed -n '40,98p'
nl -ba kbs/Cargo.toml | sed -n '112,132p'
printf '%s\n' '--- verifier feature binding and commit requirement ---'
nl -ba deps/verifier/Cargo.toml | sed -n '48,60p'
nl -ba attestation-service/Cargo.toml | sed -n '82,92p'
nl -ba AGENTS.md | sed -n '48,64p'