redact

Overview ¶

Package redact minimizes the sensitive operational detail an evidence bundle physically ships, while leaving the cryptographic verification story intact.

The signed predicate commits to artifacts by hash and carries the derived fingerprint / criteria-match / per-phase counts — that is the conformance signal. The snapshot and CTRF payloads are the *backing content* those digests point at, not the signal itself, so they can be shrunk without weakening the binding.

Two transforms are applied by the minimal policy:

• Snapshot: a fail-closed allowlist that is enforced at every level — measurement type, subtype, AND data key. Only enumerated types, subtypes, and keys survive; a new type, subtype, or key a future collector adds is dropped until explicitly allowlisted (there is no keep-all subtype). Node names, provider instance IDs, the raw node label/taint set, kernel/sysctl tuning, loaded modules, and systemd service config are dropped.
• CTRF: per-test Stdout and Message (free-form log text that can leak IPs, DNS names, secret/cert names, internal URLs) are omitted; the pass/fail signal (name, status, duration, suite, summary counts) is preserved.

Both functions are pure and non-mutating: they build fresh structures and never alter their inputs, so the full (unredacted) artifacts remain available for the --full emit path and for computing the predicate fingerprint from the raw snapshot.