Release Verification¶

Release binding: v0.1.0-enterprise-ready · AMI ami-010806d4d3445660e · 2026-05-19

Every HX-SDP release ships with a signed evidence bundle that verifies offline with the public key and standard tools. No network access and no vendor service are required.

Step 1: verify the release attestation signature¶

The release attestation is the root of trust; it contains the SHA-256 hash of every evidence file.

openssl pkeyutl -verify \
  -pubin -inkey release-public-key.pem \
  -rawin \
  -in release-attestation.json \
  -sigfile release-attestation.sig

Expected output: Signature Verified Successfully. If verification fails, the bundle has been tampered with; do not trust its contents.

Step 2: verify each evidence file hash¶

cat release-attestation.json | python3 -c "
import json, sys
att = json.load(sys.stdin)
for f in att['files']:
    print(f'{f[\"sha256\"]}  {f[\"path\"]}')
" > expected-hashes.txt

sha256sum -c expected-hashes.txt

Every line must show OK.

Step 3: verify the appliance manifest¶

The image's embedded manifest hash is recorded in the attestation and can be compared against a running instance:

grep "MANIFEST.sha256" release-attestation.json
# On the instance:
sha256sum /opt/hx-sdp/MANIFEST.sha256

The attestation also records the validated image identity; confirm it matches ami-010806d4d3445660e for the AWS release.

Evidence bundle contents¶

Artifact	Purpose
`release-attestation.json` and `.sig`	Signed root of trust over every evidence file
`release-decision.json` and `.sig`	Signed release decision
SBOM (CycloneDX and SPDX)	Software bill of materials
`source.MANIFEST.sha256`	Source tree manifest
`build.MANIFEST.sha256`	Build output manifest
`appliance.MANIFEST.sha256`	Deployed appliance manifest
`static-analysis-report.json`	Static analysis results
`vulnerability-report.json`	Vulnerability scan results
`test-summary.json`	Test results
`validation-summary.json`	Target validation matrix
`CLAIM_LEDGER.jsonl`	Claim-to-evidence ledger

Release state¶

ENTERPRISE-READY, 2026-05-19, 18 signatures OK, 0 FAIL. Promotion chain: SOURCE-VALID to BUILD-VALID to AMI-VALID to MARKETPLACE-READY to ENTERPRISE-READY.

These are dated release-stage labels, not evidence of a currently orderable marketplace listing. Current HX-SDP access is through a Private Appliance or scoped pilot.

Private Appliance bundles¶

Private Appliance release bundles verify the same way with the shipped commands:

sha256sum -c manifests/artifacts.sha256
hx-sdp release verify-signature \
  --file manifests/artifacts.sha256 \
  --public-key manifests/release-pubkey.pem \
  --signature manifests/artifacts.sha256.sig
cat manifests/validation-summary.json

Accept a release only if all blocking target rows in the validation matrix are PASS and the claim boundary matches your deployment target.