guests/heimdall/0.2.1/PINS.toml
# Heimdall's verify-bundle guests, release heimdall-guests-0.2.1 (lane HOL-HEIMDALL-02).
# Vendored, never fetched at build time (hermetic, airgap). Built reproducibly from heimdall
# 1336bd6 (tag heimdall-guests-v0.2.1 at d2f92d15) by dwarves' release runner; SLSA provenance
# signed with the owner's YubiKey (heimdall 7edc32b attestations/heimdall-guests-0.2.1.intoto.jsonl,
# the key is Holger's slsa/release-signing-key.pub); each .wasm.p7s is a detached CMS over the
# module's BLAKE3 by the forge's plugin-signing key under korp-root-ca.
# Held by jobs/runner/tests/vendored_heimdall_guests.rs. Holger runs the SPLIT pair with
# nordisk-heimdall 0.2 (verifier + decoder); the single-instance guest is vendored beside it.
release = "heimdall-guests-0.2.1"
tag = "heimdall-guests-v0.2.1"
commit = "d2f92d154bc3314d7acddcb01ff9339f30b1162a"
attestation = "heimdall-guests-0.2.1.intoto.jsonl"
[[guest]]
role = "verifier"
file = "heimdall-verify-bundle-verifier.wasm"
sha256 = "9d2b008265be177e24f5303bb1b2af32716a2c0ffce6ec4185d2f5a7d6d97e32"
blake3 = "b49330e0eedd47231b3e481d828e3eaba726b8ad03dc01c02b6e7aa983366f2f"
[[guest]]
role = "decoder"
file = "heimdall-verify-bundle-decoder.wasm"
sha256 = "8fb7028920beb1f30804481bf7851a288b4f984619394486978edb04d0449b03"
blake3 = "2a1960512f8b941eccb428fa5d897cf24a11af84423c9312f1a4360bb4b5e4df"
[[guest]]
role = "single"
file = "heimdall-verify-bundle.wasm"
sha256 = "531157fe62223bf21e3946c292f17dedd5abb48ff709ce8b01ea34a0ed84956b"
blake3 = "75481d12e5546b12d2670179a7f6ba8de76251e88ffd8d50de4a238daa94df05"