Documentation
¶
Overview ¶
Command evidence-pointercheck enforces the per-source evidence-pointer contract (#1347 / #1401) over the committed recipes/evidence/ tree. It is the anti-squat gate run in CI on PRs touching recipes/evidence/**: every committed pointer must parse as a single-attestation V1 pointer, be signed, live under the <recipe>/<source>/ directory its own claimed signer hashes to, and name a signer that is allowlisted as community or partner.
This gate is structural, not cryptographic (#1535): it trusts the issuer/identity the pointer supplies and checks path ownership + allowlist membership offline (no registry or Sigstore egress). It does NOT verify that a Fulcio/Rekor signature actually binds the claimed signer to the bundle digest. That cryptographic check runs at ingest (.github/workflows/evidence-ingest.yaml); a pointer that claims a signer it does not control passes here but fails ingest and is never counted in corroboration. Trust derives from the ingest verification, not from this gate.
Usage: evidence-pointercheck [-root recipes/evidence] [-allowlist <path>]
Exits 0 when the tree is clean, 1 on any contract violation, 2 on an operational error (unreadable allowlist or root).
Source Files