evidence-project

Overview ¶

Command evidence-project is the GP2 ingest step. Given a published, signed evidence bundle (OCI ref, pointer file, or unpacked directory), it verifies the signature/issuer/identity and the source registry BEFORE counting, then synthesizes the source-keyed evidence tree (pkg/evidence/project) under -out for upload to the corroboration bucket by a separate, credentialed step.

It holds no bucket-write credentials: its only outputs are local files. The verification it performs is the same engine the `aicr evidence verify` CLI uses, with non-empty issuer + identity pins and an explicit trusted-registry allowlist on the OCI reference.

Usage:

evidence-project -in <oci-ref|pointer.yaml|dir> -out <tree-root> \
  --expected-issuer <url> --expected-identity-regexp <re> \
  --trusted-registry ghcr.io/nvidia,ghcr.io/nvidia/aicr-evidence \
  [--allowlist recipes/evidence/allowlist.yaml] [--run-id <id>]