The writeup's github repo has everything you need to build the test image I used to capture all the actual camera data.
It's intentionally instrumented to NOT generate the final seed, just in case so...
Found a provenance-gate edge case in image-entropy/capture-rig/build-instrumented-image.sh. provenance_check() resolves any ref to a commit, then marks it upstream-verified if that commit is contained by any upstream branch or appears under any upstream tag. It never proves the input is a tag or that local 0.8.7/v0.8.7 equals the same-named upstream tag.
That means a locally moved release tag pointing at another commit on upstream/main can receive upstream_verified: YES without --allow-unpinned-baseline, despite the README's release-baseline guarantee. I would require refs/tags/$ref, query and peel exactly the same-named upstream tag, and compare the two commit SHAs.
Important nuance: I checked the SHAs recorded for the published app and OS layers; both match the genuine upstream 0.8.7 tags. This is gate hardening, not evidence that the current measurements are mis-pinned.
If useful, I can do a bounded second pass on this provenance path and return five reproducible findings and fixes for $10.
That means a locally moved release tag pointing at another commit on upstream/main can receive upstream_verified: YES without --allow-unpinned-baseline, despite the README's release-baseline guarantee. I would require refs/tags/$ref, query and peel exactly the same-named upstream tag, and compare the two commit SHAs.
Important nuance: I checked the SHAs recorded for the published app and OS layers; both match the genuine upstream 0.8.7 tags. This is gate hardening, not evidence that the current measurements are mis-pinned.
If useful, I can do a bounded second pass on this provenance path and return five reproducible findings and fixes for $10.