Repository navigation
Collect validated TLS evidence and export signed observations - #7
Merged
Merged
Conversation
leonacostaok
force-pushed
the
implementation/authenticated-evidence
branch
from
October 11, 2026 18:03
e70cc8e to
ad44d06
Compare
Require completed TLS 1.3 negotiation and certificate validation, retain bounded provenance, and export fresh observations through an independently configured authority. Preserve legacy reporting semantics where supported and explicitly document the measurement methodology break. Add real TLS, policy and persistence tests with exact-head CI.
leonacostaok
force-pushed
the
implementation/authenticated-evidence
branch
from
October 11, 2026 18:08
ad44d06 to
4be89bc
Compare
leonacostaok
marked this pull request as ready for review
October 11, 2026 18:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aggregate measurements cannot establish authenticated TLS evidence. Require a completed TLS 1.3 handshake with certificate-chain and hostname validation, retain bounded fresh provenance, and export authorized subjects through the existing independently configured authority with optional exact-manifest binding.
Preserve ticket and resumption reporting and historical unsigned rows. The deployment runbook documents the discovered worker, corrected historical public-key pin, authenticated handoff and durable-ledger requirements. The stricter reachability denominator is a methodology break that must be disclosed in the website metrics.
Companion verifier: quantakrypto/crypto-agility#2.