Ubuntu source material delivery

HDR-3 separates the operating-system package material from the .NET application notice assessment. The preparation receipt binds the installed package inventories to the qualified CLI and Scanner image layers, then records the original source descriptors, archives and Ubuntu patches.

The current collection covers 71 source-package versions and 155 distinct source inputs. Every input matched its descriptor’s size and SHA-256. The source archive contains the original files, source descriptors and package inventories; no downloaded source was executed. Descriptor signatures are retained, with their verification status explicitly recorded as false. This is source-material provenance, not a reproducible binary-build attestation.

Distribution boundary

The material is published as a separate, inert OCI image in the same registry as the binaries. Its content-addressed version tag is v1.0.0-752898e4bfe3; consumers must use registry.stella-ops.org/stellaops/ubuntu-source-materials@sha256:eae90a708383512edc704d180857f0de6dbb7c18e0f9568a6ca70ad78feda999. This keeps upstream source access available through the same anonymous pull channel and supports copying the sources into an offline environment. The carrier must never be started.

The carrier notice preserves the distinction between Stella’s collection documentation and the independently licensed source packages. The first-party licence does not relicense those packages. Retain the source image and its immutable digest for as long as any distributed binary copy refers to it. No registry garbage collection is authorized by this procedure.

Only package inventories whose exact hashes occur in the receipt are covered. Additional or changed package versions require corresponding source material before their images are cleared. The existing Alpine TSA collection is separate.

Prepare and verify

Retain each image’s /var/lib/dpkg/status from verified image bytes. Source descriptors are retrieved from Ubuntu’s archive pools, with the official Launchpad source-file archive used when a superseded descriptor has left the current pool. Exact URLs and retained hashes are in the receipt. Source files are accepted only when their sizes and SHA-256 values match the original descriptor.

The packager takes the retained source-index.json, source-fetch.json, packages.json, per-image *-dpkg-status, dsc/ and checksum-bound source files:

python tools/scripts/dev/package-ubuntu-source-evidence.py --self-test
python tools/scripts/dev/package-ubuntu-source-evidence.py --sources <retained-input-directory> --output tmp/build/os-source-materials/ubuntu-sources.tar.gz

It checks the installed inventory, source identity, complete descriptor input set, every source hash and output containment. Existing output is refused. Archive member order, permissions and timestamps are deterministic.

Use a new build context containing ubuntu-sources.tar.gz, its exact SOURCE-INDEX.json member, the repository LICENSE, and the carrier notice copied as SOURCE-NOTICE.md. Build from devops/docker/Dockerfile.ubuntu-source-materials with the archive/index SHA-256 arguments and the committed source SHA. The build checks both hashes, the canonical licence and the index’s equality with the archive member. An intentionally wrong archive hash must fail.

Before publication, verify the four retained files from a stopped container and run the image-budget gate. After publication, verify the returned immutable manifest and every layer anonymously, then compare the actual source archive, index, notice and licence bytes. Append the observed source-image tag to the publication register only after those checks. Update binary-image source instructions to the verified digest; preparation alone is not delivery.

The anonymous publication receipt verifies all four layers and all four delivered files. Extraction instructions travel with the binary notices. Binary publication and inventory matching remain separate checks; source-carrier delivery alone does not close HDR-3.