Portable Evidence Bundles (DOCS-AIRGAP-58-004)

Audience: Evidence Locker / Excititor operators moving evidence between enclaves.

Guidance for exporting and importing portable evidence bundles across enclaves. For consumer-side verification steps, see Portable Evidence Bundle Verification.

Bundle contents

Evidence payloads (VEX observations/linksets) as NDJSON.
Timeline events and attestation DSSE envelopes.
Manifest with bundleId, source, tenant, createdAt, files[], dsseEnvelopeHash (optional).

Export

Produce from Evidence Locker/Excititor with deterministic ordering and SHA-256 hashes.
Include Merkle root over evidence files; store in manifest.
Sign manifest (DSSE) when trust roots available.

Import

Verify manifest hash, Merkle root, and DSSE signature offline.
Enforce tenant scoping; refuse cross-tenant bundles.
Emit timeline event upon successful import.

Constraints

No external lookups; verification uses bundled roots.
Max size per bundle configurable; default 500 MB.
Keep file paths UTF-8 and slash-separated; avoid host-specific metadata.

Determinism

Sort files lexicographically; use ISO-8601 UTC timestamps.
Avoid re-compressing files; if tar is used, set deterministic headers (uid/gid=0, mtime=0).

Portable Evidence Bundle Verification — consumer-side integrity and authenticity checks.
Offline Bundle Format — broader offline bundle layout.
Airgap Operations — import, recovery, and audit runbooks.